Subscribe
Share
Share
Embed
Technology isn't built by companies. It's built by people.
Random Access Memories (RAM) is where technology gets personal. Host Jake Bernardes sits down with founders, CISOs, engineers, operators, investors, and community builders to explore the stories behind the products, the pivots, the failures, and the moments that shaped their careers.
Whether we're talking cybersecurity, AI, startups, leadership, or life outside the office, every conversation asks the same question:
What shaped the person behind the technology?
New episodes every week.
Presented by Hubscale.
Hello and welcome to another episode of Random Access Memories Stories that bite with me,
Jake Bernardes.
Today I've got one of my dearest friends and minor or major social celebrity that is Ayoub
Fandi, the GRC Engineerer.
and I want to talk a bit today about how he got to that.
And a lot of people who I speak to want to ask the question of how do I build a brand, how
do I become relevant, how do I build my own career path where people offer me jobs and I'm
not applying for them.
And I think this is a great story.
And great learning lesson for many of us.
So are you?
Thank you for joining us.
what is your hobby?
Maybe something people don't know about you.
And then who is your hero or inspiration in life?
which can be anything from family to famous.
So go.
Perfect.
yes.
So thank you for having me, Jake.
I've been working in GRC like eight years.
probably too passionate about.
Hobby, favorite hobby.
A eating.
Eating.
Okay.
If I have to be fully honest, eating.
In London a bit spoiled with restaurants.
So yeah, I'm like anyone from outside the UK that comes to London, any recommendations.
I've been I've been pretty good at dishing out
are you is this is this a French well Frenchman recommending London as a great food scene?
This is the greatest takeaway
for this podcast.
Ignore anything else he says.
That is a Frenchman saying that England and London has good food.
Yeah, and any French person who disagrees, just just come to my DMs, we'll we'll chat
because you know I have opinions, okay?
Tamil Prince.
Yeah.
what's Tattoo?
Tattoo's pretty nice.
yeah, and I had to s I have to say dishum because you know, it's like yeah, I've been way
too many times.
All right.
Who's your hero inspiration in life?
I wanna say my mom.
I wanna say my mom.
I think so my background is Moroccan.
my my mom yeah, she kinda came with without much to friends and we were younger, and she
kind of built a career for herself and battled a lot of like difficulties, let's say,
when you come from abroad, especially as a woman as well.
So like she's a big inspiration for me in terms of like
How to thrive through adversity and still keep going and at some point, you know, some
things get unlocked.
So yeah, I would say my mom.
There's an interesting thing here, a trend that happens.
If anyone went back and watched the first three minutes or of my podcast, you'll find it.
Most men go for their mum and most women go for their dad.
It's really interesting.
You rarely
find a man who says his dad or a woman who says her mum.
It's fascinating.
cool.
Good.
Look, I think what's most interesting about you is you went, and don't take offense, but
you went from being a GRC practitioner in a great company but little known to becoming a
Minor celebrity, right?
You speak to and know multiple CEOs of massive tech companies.
You've been offered more jobs than most people have applied for.
Like you you created a brand where you've got tens of thousands of followers and and
pretty much changed your own life, right?
In a in a long way, in your career trajectory and path.
So I want to talk a bit about that.
But take me back to where it started.
At some point did you just go, right?
I'm gonna be the GRC Engineer, I'm gonna get famous.
Like, how did this whole thing begin?
Yeah.
It's an interesting story because it goes back way before I started in cybersecurity.
And I was always passionate about economics and stuff like that, and I used to write a
blog in twenty fourteen, twenty fifteen, around economics in France and stuff like this.
And I'm I always loved writing.
So it was always something I was passionate about.
And but I didn't like social media.
Which was a little bit of a weird thing to say.
And I didn't like I liked YouTube as a consumer, but I didn't like it as a producer back
then.
So I was like, now I work in GRC.
This is the domain I picked for myself.
and I like writing.
And you know, I like to think.
I like to combine different areas and try to see if we can come up with a new idea.
So I'll pick pick up stuff I know from economics, like concepts, and how does it apply in
GRC and kind of use those mental models and try to see if we can find new ways that would
be more like fitting for trying to solve the problems we have.
And I think like for me, LinkedIn was good because I can write longer form, but not like
proper like full blog posts.
and what was good also at the time is GRC people, they were mostly LinkedIn.
They were not on the other platforms.
So for me it was about like, okay, I like writing.
don't really know if you know it well.
so it's it's it allows me to also like fact check if I actually know what I'm talking
about.
Because if I can't lay it out in a structured way in writing, it means actually it was
just like a bit foggy in my mind.
so it was mostly for me, in a sense at first, because I had like zero like.
Zero visibility, of course.
So for me at first, it was mostly like, okay, I want to make sure I put down to paper
everything I think.
And then I just publish it.
Like that it's just an additional step.
about external activities from their employees.
And when but back so I moved to the UK like six years, six years ago.
Back when I was in France, it was not seen as like positively.
So I had to do it.
But actually, I was going a little bit against my employer when I was doing it back then
in France.
so that was also challenging for me because I I wanted to build like my understanding and
my knowledge in in my domain, but also at the same time, I wanted to create my network.
So there was the two main objectives was like the thinking part and being clear about what
I know and what I don't know.
And also through that, an ability to find a way to intro myself to people.
I've heard it everywhere, like you need to have a network, you need to know people and
that's the way you d you get things done.
And yeah, my family comes from public sector more, so I didn't know how to navigate
private sector kind of, but I've heard that in some random Simon Sinek or whatever video.
So you you got this point where almost cathartically you start writing your thoughts in
long form LinkedIn posts or semi blogs, right?
With a regular cadence or just sporadically like
Yeah, I I think it became consistent two two years ago.
But I was writing like more erratically for like six years.
So consistency was like it's kind of everything.
And for years, like I would do like a couple of weeks, and then something would come up at
work or family or whatever, and I like completely stopped for like six months.
it was so tough to keep going.
And I think I was becoming a bit better, like once a week, more likely, I'll be able to
post something.
And it was like probably now like close to three years now.
Yeah, it was probably mid twenty twenty three where I was like, you know what, like I I'll
post every day if I can.
And if I can't, I'll post every other day.
and I think in the course of like those three years, I've posted probably like close to
twelve hundred times.
So it like the cons i it started to go into a flywheel mode where like I I was like
triggered it?
What triggered it two years ago where you said, I'm gonna s I'm gonna change?
It was like some kind of willpower moment.
It was like I I think I think it started because I was like, okay, I'll try a 30 days.
So for 30 days, I try to post every single day.
And then if I like it, I'll keep going.
If I don't, I'll go back to something a little bit less con like consistent.
And then actually I liked it.
So I I was very scared of losing running out of ideas and just like saying the same
thing numerous times.
and I was
Like some of my friends that read my stuff, I use them as like kind of like echo I I was
just asking them like, do you actually think whatever I'm posting is relevant after
fifteen days of posting every day?
And they said yes.
Yeah, we don't feel like you've been repeating yourself, like it's a lot of different
topics in GRC and you can tackle it in like a more humorous way, like analytical way.
And I was just a willpower moment.
I was like, Okay, I 30 days, and then if the habit kicks in.
Then I can keep going.
I've heard twenty one days or whatever, like to to kick off a habit.
So I like, I'll do thirty days.
couple times a week, I'll be I'll be posting.
Let's come back to the content problem in a second.
But how did you was there a conscious decision where you're like, I'm gonna make myself
like a a social media influencer?
Like I wanna build a massive network, I wanna create job opportunities, like was it just
because you just wanted to see what would happen?
Yeah, no, not really.
So I think it's so weird.
Like so the content, like I always think about it as like a company.
So there's like top funnel, bottom funnel.
So like people get like understand me the first time through my content.
And what is weird is depending on if you engage with my content or you reach out directly,
like I care more about the relationship that comes off of it.
So there's many people.
Who discovered me with my content that haven't read anything I've written for over a year,
but we're very close.
because those people are not really active on LinkedIn, but once they were on LinkedIn and
then they saw my thing, and then maybe they reached
out or something.
And I think like it's probably more than 100.
and these people, I kept the relationship going because actually that's why I love the
most.
awareness.
But then for me, like actually what feeds the content is the relationship I have with
these people.
They share stuff about their GRC program or their security program, which also kind of
channels additional ideas for posts because I can also validate, okay, this idea doesn't
work for financial services or doesn't work for like AI native companies.
So then I can like fine-tune how I think, but also share anonymized experience from other
teams, which I'm very close to.
crowdsource from fifty, sixty, a hundred JRC programs, like the patterns that I can see.
And that that is built on like random one on ones on Zoom, like on a Friday,
Yeah, I mean, you are always on the phone to somebody.
It's my general life lesson.
But 177
when you talk about the content thing, initially that's hard, right?
But even now, like the regularity and the depth with which you go into on your like on
your newsletter and other content, how do you keep coming up with material?
Because GRC is finite eventually, like how do
you keep coming up?
How do you like do you sit there with Claude saying, like, I wanna I need some ideas, I
wanna brainstorm?
Like, how do you come up with the content?
Yeah, so so my current system, so my favorite AI tool ever is Wispr Flow.
so I I I already spoken to Wispr Flow close to half a million words.
So it's it's a tool I use quite a bit.
So the way I work is sorry.
will have heard of that.
You've explained to me before, but not everyone listening will have known.
That's a good point.
So Wispr Flow is a voice dictation tool.
computer and you can just toggle, you press a button and then you can speak.
And it would like it so it would transform your speech into something that looks like
it's bit written by a human, but also it would create for you like things like bullet
lists and create different paragraphs and it
The AI part is kind of like refining your speech so it looks like it's been written.
So I have a ton of ideas that come up and often so I have a connection between we can
dive into it, but it's a long story, but on my WhatsApp, I can send myself Wispr Flow 198
kind of like a paragraph.
And when I hit send, it would get into a queue in my kind of AI system.
which allows me to not like lose any ideas that I might have like in the shower or like in
it in the f on a flight or something.
So what is interesting with ideas is I think the more you write, the more you have ideas.
Because like there's
an infinite like it's it's finite, but in and of itself, like if you think about just risk
itself, like risk is finite, but there's like risk assessments, risk identification, risk
quantification, and within each, like there's also
Like you can tackle it through first principles, through the experience of a specific
team, through your own experience, through how it co correlates with compliance and
TPRM.
And very quickly you understand that like like a lot of people that are active on LinkedIn
at some point they use a post they posted six months ago and they repost it by changing a
couple of lines.
Like I don't even do that.
I don't even remember what I talked about six months ago.
I can gut check if I already spoke about this.
But there's like for me an infinite way of like i I don't know, there's this image like
there's like a mirror with like so many different faces.
And once you turn it, the same topic can like light in a different way.
So by
thinking about it, I don't even care about like losing out of good ideas now because you
know, someone would tell me if I if I if I write crap.
Yeah.
I wanna come back to your to your your platform and how you build 'cause I think that's
it.
You've shown me before it's really interesting.
But let's go back to the thought train you were on about content creation before I
interrupted you.
Like how so you sit there with Wispr Flow, but how do you then create like meaningful
content that's broken down into sub content and that kind of approach?
Yeah, so so in my system, so I I'll just like spell it out with Wispr Flow and then it
goes into the queue and then what I do is I have a triage phase.
So I have lots of ideas, right?
And then I need to understand what are the these ideas about.
Are they like GRC memes?
Is this something a little bit funnier, like like ironic about industry?
Is it like just a LinkedIn post that provides a little bit value but like still fairly
shallow?
Or is it a topic that probably warrants like o over a thousand words, so most likely it'll
be a newsletter.
So on my AI system, I would just like I have a skill for ideation triage, and I just
say, okay, what what ideas are in the pipeline right now that I can triage and give me 10?
And then I just once again use Wispr Flow.
I'm the okay, I didn't idea number one is meme, idea number two is X.
And I it takes me like 10 minutes.
and then once they're banked, once I need to create something, I can just ask on the on
the pipeline, what's in the pipeline for a meme?
And they might have like 50 different ideas.
like maybe there's a news that happened, whatever I'm like, okay, I want something about
token maxing and risk management.
And then if there's nothing about token maxing, then I'll just add that part myself.
And then I'll have the risk part of the equation already like banked.
So like it feels very, like, very sophisticated.
May maybe it's not that sophisticated, but it's like a way for me to ensure that I don't
like sometimes I might have like 50 new ideas in a day.
Well that was gonna be
next question.
How many ideas how let's say you can have what between five to fifteen ideas a day go from
Wispr Flow into the ideation queue to be effectively triaged?
So we're talking
about anywhere up to like a hundred a week.
Yes, yeah.
It it's not always a hundred a week, meaning like some days I don't have as many.
And some days I'm not focused on like having new ideas, but like at least I'll have a
couple of day that just pops up from regular regular chats.
and something you can do as well, which I've been starting doing a bit more now, is you
can leverage also your work.
If you work with an some kind of AI an AI harness, if you work with a clot code or codex
or something, like they're good at reviewing.
the sessions you've had that day and like understanding what is new for you that day.
And often by just by reviewing what I've worked on during that day, it it it spins up
net new ideas because I've worked on stuff.
querying, codecs or clawed code?
What have I been doing?
Like tell me the things that I've done today that I haven't done before that might be
interesting to talk about.
I exactly.
And then I have to sanitize it, work through, you know, whatever I can share.
but it's also a good way to have new new things to talk about which are directly
correlated to what you've been doing.
That's very interesting.
Talk about your actual tech stack, because you've talked about putting the queue and I've
got a a skill which triages.
I've seen
this and it's amazing.
So talk about what you've actually built and how it works compared to what the average
person has access to.
Yeah, okay.
So the tech stack.
So right now it's still on on clot code.
industry, strong practitioner, newsletter.
So he built something called a PAI, which is a personal AI infrastructure.
I think that's the way he thinks about it.
I use it in a different way, so I don't
run my life through anything AI.
It's just specifically for my my content.
So the way it works is it allows you to create specific skills and those skills they will
have the skill that MD, but also you are able to have like scripts that can run and create
like sub-skills and workflows based on whatever you've said.
So my core pipeline has four skills.
It has an admin scale that allows me to manage like invoicing and like relationships and
like it checks my emails and stuff like that.
And then I have my ideation scale.
And the role of that scale mostly is to make sure I don't forget anything.
So everything I can track, I push through WhatsApp mostly.
Or directly when I'm on front in front of my computer, I can just use RISPRFlow and I like
just add that to the just add that to the ideation queue.
So that skill, once I use it, I'll ask 284
I'll ask Klo to add it to the queue.
And that scale has queue, then it has triage, and then it feeds into the next scale, which
is GRC content.
So everything goes in through the ideation queue, then I triage it based on my needs.
big idea, it'll also spin up the LinkedIn post idea, which would accompany the newsletter.
So it also like atomizes.
That's I think that's what they call it.
And then once it's done, I have the GRC content where I actually build stuff.
So in there is a create LinkedIn post, create newsletter, maybe create podcast, but I
haven't been that consistent.
I don't use it.
So when I say on slash GRC content, create a LinkedIn post, the first thing you see is
feed from the queue, which is another scale.
And then tell me which one you want to pick from the ideas.
And often when I invoke it, I'll also say the topic I'm interested in.
And if it's the newsletter, it's very complex because the newsletter has like it's a big it's a big work item.
So what I'll do is I'll create a newsletter, probably whisper for for like three straight
minutes.
I probably speak a thousand words in in a sense.
So that's why also a lot of things.
Or my voice is because I speak almost all of the content.
So I obviously speak the outlines, speak each section what I want in there.
that matches what I've said.
And then I have a file, which is called a Voxist file.
And that file has been trained, it it like extracted patterns from every single one of
my LinkedIn posts and newsletters, and it matches the way I like to write, and it would do
an audit.
on every single draft, how close it is from like zero to a hundred to the baseline, which
is like some of the golden posts that really represent how I write.
So I'll have one, I'm like, okay, I don't like this, this is too long, this is actually
crap, like this is not the way it works in JARC.
So then I'll iterate up until I'm happy with the draft.
And it would add mermit diagrams and like add reference to my old posts, etc.
And once it's done, so I
I port it myself, I finished like kind of tweaking the details, but that's the iterative
process.
Once it's done, I'll log it into a JSON file, which is a JSON L, so as a new as a new
line.
same for the LinkedIn post.
So then I keep also the historical record.
And then I have a webhook with my newsletter provider, which will feed in the stats for
the newsletter, how good it's been doing, like the stats, the click through rate and all
these things.
So I know what people like and what people don't like.
I mean, that in itself is is mad.
T like I I've I've got a bunch of questions, but I'm gonna try and pick some poignant ones
I think people will be interested in.
some people listening won't know what how what a skill is or how to build a skill.
So
they'll understand the fact that you've gone and pulled a GitHub repo, that's what your
person your PAI is and you've laid it on top of Claude Code, right?
That's that bit we can assume people know.
It these aren't you know, you've built these skills, so talk me through how do you go
let's talk about triage, right?
How have you built the triage skill?
And what would someone need to know or be capable in to be able to do that themselves?
Yeah, so a good idea good question.
So PAI, when you install it, it adds a lot of additional skills to the ones that Cloud
already has.
So Cloud already has some skills, right?
They they come baked in.
And through the marketplace and stuff, you can add new ones.
So the way it works is Cloud has their baseline of skills and then PAI adds like maybe
like fifty or sixty skills, which have been built.
On the way how Daniel likes to do his thing.
And for me, I use a skill called CreateSkill.
So that skill allows me to create a skill that matches how PAI expects you to build
something that also connects with everything else.
Because in that part, something we didn't speak about is the content skill.
I also map it to a skill that allows me to create visuals.
And that skill is called art, and that skill is native within Daniel's PAI.
And it calls like either Nano or Banana Pro.
I added myself a GPT image too as well.
And it would feed the content of the newsletter to think about what kind of good visual
based on like my pixel art kind of like personal brand.
It's interesting because a lot of people will know your style but will be thinking you've
actually been building a lot of this stuff and you actually have that's why you're so
consistent in your images and your styling and format, is because you've effectively built
a skill which makes sure that it always almost audits against itself and how it looks.
Okay.
Cool.
I'm not a designer by any any stretch, you know.
Gemini and and OpenAI are my designers.
but yeah, and I think also but my image are a bit more refined because the prompt
themselves are like extremely long because they're based on my content.
I'm not just saying like create a JRC diagram or dashboard or whatever.
but yeah, so the way I create the skill is in PAI, I think now Claude or or Codex, they
also have this like create skill.
You would like use that skill.
And then name whatever you want to do.
And for a first month and a half, I was just iterating.
So I started the scale and I was like, how can I plug it in into my ideas?
And then I added that on the scale.
And then I was like, okay, but like once I'm done with the idea, how can I feed it into
like the way I create the post?
And then I added that in.
So it was not like finished the way it is right now at first.
It probably took me like good six weeks of like semi-regular kind of tinkering.
Like you learn so much about CLIs, you learn so much about how you store information so
you can be leveraged by like another another API code and all these things.
And I think it's like in of itself it it it made me better, but allowed me to like scale.
And that it's so weird because you need time to to get time back in a sense.
You need to actually take the time to learn.
no, is isn't it true you have to invest time to save time?
you've obviously mentioned API, webhooks, command lines.
How technical does someone need to be to be able to recreate what you've done?
Is it someone who goes, I'm a great content creator, but I have no technical skill set?
Could they go and do this stuff?
Or is it like, man, you're not gonna wear that yourself?
I don't know.
We have new models now, new models dropping.
So maybe I think if you're clear enough with your intent, I I think in a sense, like
with AI, I think you you can get away with your business requirements being translated
into technical requirements.
So if you say like, okay, like I want a scale that allows me to say whatever I want and
then slice it into potential ideas for like LinkedIn posts.
And then once I post it, like I want to make sure I know like I don't know who liked it or
whatever, or if it's a newsletter, like okay, my newsletter provider like Substack.
Beehive and like this is the API key.
I want to make sure, like, probably don't just put the API key in the prompt, please.
but like just say, okay, I want to hook in there, and then like seven days later, I want
to make sure I can get the stats.
Like, I think it's deterministic enough, and like there's not a hundred thousand ways to
do that.
So most likely the AI would and if it breaks, no, you know, you can just work on fixing.
So I think it's I think I
I like to think it's feasible.
I think what's tough is like getting the whole system right.
Like the system has many moving pieces and sometimes one break, but at the end of the day
what the stakes are.
The stakes are not high.
It's not like a production system that runs like w whatever, right?
It's just you know, it's just a good helper for someone who's busy.
Maybe if you're less technical, you could compartmentalize it into like smaller segments.
Then if one breaks, you've only got like one thing that's broken and the other bits still
work.
Whereas yours works as like one single workflow.
So it's almost like it's like a a traditional kind of circuit approach where if one thing
breaks, the light's not turning on the end.
Like you you it's it's a bit more of a complex process.
So we've gone through the test, I went off topic, but you you started iterating, you did
your thirty days, you start being more consistent.
When did it become the GRC Engineerer?
And then on that journey, when did that go from just being you sharing your thoughts in a
concise manner to tens of thousands of people following?
Yeah, so kind of like the swi switch.
So I had one post on November, yeah, September, September twenty twenty three, so close
to three years ago.
And I post like kind of really in the grand scheme of things, like it did okay, but back
then it it did pretty well.
I probably had like a hundred DMs from that post.
It was like a bit crazy.
and that post was the first time
A lot how can I say a let loose.
So in a sense, like before I would speak about GRC topics in a way that still felt conventional to how the rest of the industry was thinking.
And I was like, okay, like I want to write something that really fills me, like how I
really think about GRC, if there was no barrier through how people have been doing it so
far.
So I was like, okay, if it was like first principles, like no no background from the
industry.
what would I what would I enjoy doing in GRC?
And then Charles kind of posted about this the same, had a podcast episode about it
with Francesco.
podcast.
And for me, I think that's where I kind of I I kind of hit product market fit.
So that's where like my content was
becoming a lot more relevant for people.
I was talking about architectural concepts, like CI, like things I really enjoyed
because I joined cybersecurity for the technical part, not for GRC.
And that's the part I like, but I worked in JRC.
So for me I was finally able to combine both of my like I don't know both of the things
I like into one a single narrative.
before like no there was none of people talking about GRC on LinkedIn before that, to
be honest.
or like you know basic it was like now everyone talks about Jars on LinkedIn like three
years ago there it was not many.
So I think maybe I was one of the first that was very consistent in like trying to get
quality instead of either saying everything's broken or like buy my course.
I there was only two narratives, right?
And I was like
I don't sell anything.
And also, everything is like not broken, but you know, just think about it in a different
way.
Instead of just saying like you're trash or you'll be out of unemployed or whatever.
people without any ulterior motives.
Anything I produce is free.
So that was the core goal, and I always kept to it up until now.
And I think that would help me as well, because everyone else, a lot of them, they were
sharing some things, some consulting service, some course, some because it's it was a way
for them to get custom acquisition, but I didn't care about that.
How do you go then from or was there moments where you went from sharing your content,
market fit, people interacting, to like real market thought leadership position?
The reason I say it is like you've obviously met with the founders and are quite close to
the CEOs of like Vanta, Drada, Anecdotes, What What's Dell, Hyperproof, like you've met
based service now, you've met all people all over the place, right?
And you have these people on Speed Tell effectively.
Like was there a point at which that went from being I'm posting LinkedIn, I'm sharing it,
YouTube, Spotify, Apple, wherever, right?
And it's resonating, people are liking it, I'm gaining followers to like suddenly I'm
getting called by like the CEO of a company with like a five billion dollar valuation.
Yeah, I think there's like it they're two different groups in a way.
Like practitioners, they care about the content because it was providing them value.
Or like the Zahid GRC at a high frequency trading firm.
He was he was telling me, that this one of the two, three biggest ones on the planet.
It was telling me I was getting kind of disrespected before.
And using your language or your lingo, I was able to get back some of the like office
capital that he lost in the past.
and
And I had that quite a bit.
my work is better perceived by the CISO because my CISO follows you.
And that the practitioner route was one.
For the vendors, the two main events was the podcast you were part of in March.
So
was.
there's a long story, but it started with Kevin Krieble from from Drata.
and he was like, dude, if you if if if if you have the whatever, you know, try to get all
the vendors.
I was thinking about the idea.
It was like, yeah, you could get all the vendors in one room and we could just chat about
the industry, the automation market, what's our position in JRC on like commoditization
was a big topic at the time.
So then I was like, okay, deal.
I try to make it.
So literally the same day, I go on LinkedIn and I was like, okay, I want to do a podcast
episode with like, I don't know.
Five, six, seven GRC vendors all in one room.
And then I'll ask you questions that I think practitioners have, and then we can chat and
we can debate.
And literally in two hours, I had almost every one of the big automation vendors approve.
So there was Drata, Vanta, Anecdotes, Scrut, Sprinto, Thoropass, and anecdotes.
I said anecdotes twice.
I think that was all of them.
Yeah.
yeah, so and that was very fun.
I don't know, kind of unprecedented unprecedented.
I don't see in many other domains like CSPM or EDR that you see all of them in one room.
And Jake, you were the the anecdotes champion at that event.
and so that one was big.
that one was big first because no one thought it would be possible.
No one thought the vendors would have said yes.
And the other thing, I think it was either just before or just after.
I wrote for Ross, Ross's newsletter, Venture and Security, an analysis on the GRC
market.
So it was the evolution of GRC, and it kind of did the genesis of the GRC platform.
So it was vendor, like a vendor analyst and analysis, similar to, I don't know, Forrester
or whatever we would do, but like my
own spin, how I think about it.
So that one, actually, that one had a massive impact on the vendor side.
So that one I know for sure it's been shared at Sequoia and Insight, like a lot of the top
VCs, because some of the CEOs shared with their boards as well.
So that one had a huge impact.
And some of the most successful VC firms and cyber, like they've leveraged that in their
Reddit.
So I've had people from those firms like reach out to me.
So that one was big.
If to be honest, now I don't really speak about the vendor side too much publicly in a
sense.
even just analysis and stuff, just because my my position in the industry has changed.
I I I I'm still unbiased, but I technically know all these people personally now.
And
Yeah, it's
different when you know the people you're talking about, yeah, for sure.
I can still talk about it.
But the main issue also is every time I try to do it, I had a I had a good I which I think
was a good news to throw on it, like maybe six months ago.
Like practitioners don't like it.
It's at the end of the day, that's it.
Like I like economics a lot.
I like product.
I like growth.
I always like to say I produce ninety percent of GRC content and I consume ninety percent
of non GRC content.
So because everything I consume is not GRC, like I like to geek out on product strategy,
on marketing.
So I talk to those executives about it.
But then when I try to speak to the broader audience, like if you work in GRC, you
wouldn't care, like, you know, how to breach from like being strong in internal audit to
like sell GRC automation.
Like no one would care.
I would care because it's something I'm passionate about.
So then the audience for these end up being more private and less like just posting about
it because they like n most of my audience don't care.
so it's like
Yeah, I'm like sk skisurf skisurf schizophrenic or whatever.
Like sometimes I feel like I have two different audiences.
Yeah.
Exactly.
you you talk about then to for someone who wants to build a brand, one or two things that
can just go absolutely viral take you from being a good influencer to being like in the
spotlight massively, is what you're saying.
And then you have to leverage that and build on that and turn that into traction.
Yeah, I would say like
One thing I like think about is like what's what's your unfair advantages.
So there are things where either naturally or through your upbringing, you're very, very
good at.
And those things you need to harness.
So to give an example.
Like I I'm very okay with like talking to people for a long time, numerous times a day,
and I it doesn't drain me.
So for example, when we met at RSA,
That day, you know, similar to you, I think you're a similar in that matter, maybe even
like stronger than me.
But probably talk to people from like 6 a.m.
to I don't know, probably 11 PM about GRC most
like I don't know, 15, 16 hours straight.
And I didn't I was not prop I was not drained.
I just went to bed and then next day I was fine.
So maybe you have another superpower.
Think about that superpower and make that the way you kind of build your uniqueness.
Because if you're amazing at writing.
Or you're very good at design, or you're very good at like finding like completely
unrelated things and making them click.
Like, like lean on that because that's your uniqueness.
And for example, there's people in the industry in GRC, which are not public on LinkedIn,
but those people are extremely influential behind the scenes and they know everyone as
well.
And those people, like when you're in the right rooms, like we everyone talks about them
because they're like very nice to talk to, like they're very
Fabble, I don't know if it's it's a word in English, but
yeah.
like, you know, like the the these people, like they're still very influential, they still
have an impact.
And you can still be impactful without like X or Y number of followers.
they're still the people that everyone looks up to and think like, okay, those people are
like the the real
about effectively finding your superpower and what's something I've talked about quite a
lot, which I think is missing in our modern culture is rather than trying to focus on how
do you strengthen your weaknesses, you're saying strengthen your strengths, right?
Take the things that you're good at and focus on yeah.
I'm similar, I I'm not the best writer.
And like unlike you, I get drained when I've got six hours of conversations.
But I love like I'm an OBS guy.
I love an argument, like a ho a passionate, happy argument.
I think that's become
My superpower.
I'll get in a room and just get people to discuss and to debate and to argue.
And I think that's important.
I think everyone needs to find out what they're good at and what they like.
thing I want to add, because you asked for two things.
The other thing is you need to be consistent on whatever you've picked.
So, like saying, for example, I'm not good at writing, like you need to write to know if
you're not good at writing.
Or you
don't like it.
I think you need, you can't say without having tried it, like, I'm not good at X.
So, for example, I was an introvert growing up.
So I was like, There's no way every single day after my work day, I'd take
One and a half, two hours on Zoom and trying to meet with people in the Bay on Zoom every
single day for like two years.
I still did it.
And I found myself to really like those conversations because that I like learning more
about people.
I'm generally interested in their private lives, what they're doing, their background.
But also I can talk about JRC for hours.
So combining these two was good enough for 30 minutes on Zoom, which meant I multiply that
by every single people I was meeting.
But I didn't know that before.
I thought before I would hate these things because I don't want to do meetings.
I prefer being by my and actually I don't.
But I only knew that through exposure.
So you need to expose
yourself and then you'll know if you actually like it.
That's interesting actually.
I think people often like they try things once and go, Yeah, that's not for me.
But what you're saying is you have to kind of go deeper into an experiment to try and work
that out.
if someone wants to start, where do they start?
Someone wants to go, right, tomorrow I'm gonna I'm gonna I wanna be a you I want a Yu's
life, right?
How do they how do they even start?
I know you want my life.
But yeah, so what I would say is like if you want to start, just pick one.
Okay, so for me, I really like this.
I don't know, I've heard it from some newsletter guy.
So you need to niche down twice.
So if maybe you're in security or in GRC, I'll give you a very specific example so you
have an idea.
So me it was like GRC and then GRC Engineerering.
But even now, like let's say GRC has moved forward, so now even GRC Engineerering is
becoming a top topic.
Like the what you need to be.
is if we have one specific keyword, when I think about it, I think of you.
That's a good way for you to think about like how to have an impact.
So like there's numerous like even when I think about ISO, I think about like someone R on
Lange, for example.
Like there's there's for each kind of like domain there's someone that comes to mind.
And one good way thinking about it is okay, you work in TPRM and maybe your niche is
like okay this GRC and this TPRM and there's like how TPRM leads with like
Application security posture management.
And then that's your niche.
Your niche is you combine enterprise security and TPRM.
And you focus only on that.
And then as you build this expertise, at any point, like people in this space will need
what you know.
And they'll need like to read what you've you've written to be better in this specific
thing, which is a thing that people need.
There is like a big like lack of expertise in.
And potentially can lead to like positive outcomes for you as a person.
And once you've found that, you can move up the abstraction layers.
So then you can explain how this niche, because now people say, Are you the GRC guy?
But yeah, there's no GRC guys, right?
But it's just because from GRC Engineerering, it kind of moved up when people like, I want
to shift my GRC program, did a fireside chat, I think Zach talked about it with the
Datadog security team like last week.
And there's like most of the questions were GRC questions, right?
Because now I moved up the abstraction layers.
People just asked like what you are seeing strategy and how to run their programs.
But at the time I was very focused on the subsection.
And I moved up because more the more you speak, the more people want to learn more about
what you think on adjacent topics.
And that's how you build back kind of like the strategic vision from someone that was
probably seen as like, you have this very small niche.
Hmm.
What if someone thinks they haven't got a topic?
What if you find people who go, you know, I don't like you naturally had a passion and an
interest in an area where you resonated quite quickly?
What if someone goes, Look, I'm a security analyst, love this, want to try and build
something for myself.
I have no idea where to start because they're abroad already from a nature of what they
do.
Okay, so hot take.
You like hot takes, Jake, right?
Not a hot take.
I don't I don't believe in passion.
Okay.
So there's a book I love.
It's called So Good They Can't Ignore You from Cal Newport.
I like this author quite
a bit.
S So good they can't ignore you.
So good they can't ignore you, okay?
Like it might maybe in twenty twelve, twenty thirteen.
So he wrote digital minimalism, quite a few books that people know about.
And in in in like knowledge work, okay.
Maybe like you you're good at football since you were two and a half, like okay, you might
be passionate.
But some people they're good at football and they're not passionate still, right?
So 652
The the the passion thing for me is like do it.
Then you'll do it more.
Maybe you're good at it, but you don't want to do it, but that's fine.
But you only will know that once you've done it enough.
And I think that's what I said, like in 30 days, or like at least you need to keep at it
for a little bit.
Because I became more passionate as I became better.
I was not I I I wanted when I started my career in GRC, I wanted to shift careers every
week.
I was like, okay, I want to become a suite, I wanna become a data analyst.
Because I was I was bad at my job, like like like frankly.
And I became better by just sticking to it, learning more, leaning into, but still, like
because I wanted to switch jobs, I was learning domain expertise, like basic things in
other domains, and it made myself more like whole.
But still, like you need to go at it for quite some time.
Like no one is like, I don't know.
It's like the Malcolm Gladwell 10,000 hour rows and stuff like that.
It's like
you need to at least like give it some some amount of effort before you know this thing, I
actually.
Both I'm not good at it and I actually hate it.
Yeah, made sense.
Look, man, I I we could talk for hours and I'm sure we'll get you back in some form in
some way in the future.
cover?
Yes, yes.
I think there's we should think about you should think about your why.
I think it's something that's important.
Because I think it's nice to like, I don't know, like be influential or whatever.
Like, why do you do it?
Because at the end of the day, like I like GRC, but I like like my wife, like my kids,
like my family, I like my parents, right?
I like I I care about these things more than I care about my career.
So you need to understand why you're doing these things and
Like what kind of outcome you're trying to get out of it.
Because I never did it to become famous.
Because I don't actually care too much about that.
Like I
I care about that because I might have I might have a leverage that I can use for like my
the things I care about.
Because one thing I'll say, like it's cool to be friends with CEOs or whatever, but like a
CEO cares about their company.
Okay.
Like you, like they might like you as a person, which is fine, they might give you time or
whatever.
But at the end of the day, like they're trying to run a company.
And if you're in this room with them, it's also because they think, as someone who owns a
company that might be worth billions, like the best use of their time at this specific
moment is to talk to you because they think there's something for them in there.
So you have
to also keep that in mind.
hobby like knitting, whatever.
Okay.
If they stay with you in a room, like it also means that there is an information exchange
that they're trying to get through that as well.
And you have to be fully aware of that because when someone give like you have to be
confident in yourself because when someone gives you importance and you think you don't
deserve it, then you might actually be used more than like use, if you get what I mean.
Interesting.
There's a lot of truth in that.
I had a conversation, it's actually one of these episodes with Karl Mattson, now the
founder and managing partner of Squared Circle Ventures and former CISO at multiple companies.
when you want to find real mentors, you find people who have nothing in it for them.
Like
when their their only motivation, their why is karma, right?
They don't there's nothing to serve them.
I guess.
Let me finish lasting a question then.
What what is your why?
You said you need a why, what is your why?
my family.
it's honest, it's fine.
but in reality, like what I love the most about the stuff I've been doing is when someone
like when someone says I love your content, like that's fine.
But when someone says like through your stuff, like I've been able to get promoted, I've
been able to hire more, I've been able to like
get a big raise and like I've been able to find this new job that didn't exist.
Like, you know, a JRC engineer position, like those positions didn't exist when before we
were starting about these things, or they were very scarce.
Like companies that had insane resources like Google would have them.
Now most JRC teams are starting to hire for one, and every week people reaching out,
actually speak to someone later today, how to help them hire it's the big 15 billion AI
company and they need help or how to spell out a job description for a position like that.
I'm like all those net new roles are for us.
And they're well compensated.
and you're able to actually like do cool stuff.
And for that, for that that's what I care about the most, because at the end of the day,
like you're impacting directly people's lives in a positive way.
But if you can like be more respected, better paid, better benefits, more impact, then you
you're probably
Hopefully you're more happy and like you know, you live the better life.
And that's that's probably what I liked the most out of all the feedback I'm getting from
my stuff.
I think there is no better why than wanting to help others be happier and help myself and
my family be happier.
a great place to end.
Ayoub, thank you very much.
It's been a pleasure as it always is.
on LinkedIn or speak to him in any GRC Engineerering capacity.
There is nobody he doesn't know if you want to be connected to someone as well in the
space.
But it's been actually a pleasure.
Thank you all for listening.
We'll speak to you again soon.
Ayoub, thank you very much for your time.
Cheers.
Thank you.