Subscribe
Share
Share
Embed
Technology isn't built by companies. It's built by people.
Random Access Memories (RAM) is where technology gets personal. Host Jake Bernardes sits down with founders, CISOs, engineers, operators, investors, and community builders to explore the stories behind the products, the pivots, the failures, and the moments that shaped their careers.
Whether we're talking cybersecurity, AI, startups, leadership, or life outside the office, every conversation asks the same question:
What shaped the person behind the technology?
New episodes every week.
Presented by Hubscale.
Hello and welcome to another episode of Random Access Memory Stories That Bite.
Today I have the CISO of Upwind Rinki, who has held pretty much every CISO role from a
company that you've heard of, as well as her own VC and having more LinkedIn followers
than people you probably know in some countries.
So let's kick it right off.
If I ask you first, Rinki, introduce yourself, tell us what you do, who you are, tell us
your hobby, and tell us who your hero is, someone that inspires you.
Yeah, first of all, Jake, it's an honor to be here.
And I'm glad we're finally doing this.
I know this was in the works for a while.
Yes, I'm Rinki.
Nice to meet all of you.
I was born and raised in the Bay Area.
I have two kids, 18-year-old girl, 14-year-old son.
I've been in cyber for almost 25 years, started at Pacific Gas and Electric, went to
Walmart, eBay, Intuit, Palo Alto Networks, short stint at IBM before I took on my first
CISO job at Rubrik, my second one at Twitter.
Third one at Bill.com as CISO and CIO, and then just joined Upwind Security on my fourth
CISO gig here.
That's a little bit about me.
And let's see, my favorite hobby outside of traveling is a grandma hobby.
I love to crochet.
So I do crochet blankets all the time.
Yeah.
it.
That's cool.
Yeah.
So if you watch my Instagram, it's usually travel post, something about cybersecurity, or
my crocheted blankets.
So you have to get
on the you have to get on the Christmas list to get a blanket then.
Okay.
I understand.
Life
goals.
What about your hero?
My hero would be my dad.
He has always been an inspiration and someone I continue to learn from. I've seen him change.
You know, people say people can't change after a certain age and I don't believe that's
true because of him.
Mm, that is a really interesting thought, that people don't change.
I actually just commented, did you did you know Aisha Khan at Treasure Data?
Yes.
So she posted something on LinkedIn today, about doing something with one of her kids at
middle school.
But it was the whole point was that kids don't have fears.
They just come up with an idea.
They don't think of like the drawbacks or the possibility or the plausibility, right?
And I I think that as we age, we lose this ability to see like opportunity.
And I think what what you're calling is right so it it's a choice.
It's like we still have the ability to choose to change or to to believe in the impossible
at any age.
We just have to kind of rewire our brains to be like the kids that we once were.
I like that.
That's cool.
I need to go read the post.
I haven't been on LinkedIn this morning yet.
Yeah, well that that's a first view.
So I think I wanted to ask you a few subjects.
So I think the first one was look, you your background, as you just mentioned, is pretty
mad.
So you've done Bill, Twitter, Rubrik, there's some Walmart in there, some eBay, IBM,
Palo Alto, and now Upwind, which is one of the Cyberstarts darlings.
Like you your your background is you worked every company that everyone's heard of,
effectively, right?
Is there one in there?
Like, or is there two in there?
Specific roles where
V either the company or the situation or the role that you had taught you an astronomical
amount.
Is there a point there where you kind of accelerated?
Like is there certain places that were just amazing to be?
It's a really good question.
I think it's like you learn something in every job.
And I feel like I'm constantly learning.
The second I feel like I'm not, that's when I'm shifted.
But I think the most pivotal one for me was when I was at Walmart.com.
It was my second job out of college.
I had worked at Pacific Gas and Electric before that.
I had, I was almost about to leave cyber.
I because of the work I was doing and just the way that.
PGE wasn't like the right culture for me.
I had to self-learn everything I knew about cyber, but it was all textbook knowledge when
I was there.
And I went to Walmart.com.
Not only did I find my passion in cybersecurity, but I had the most amazing mentor, Jake,
that
that
literally took me under his wings for who knows what reason and taught me everything
technically about cyber.
And I got to get hands-on and just work with him hand in hand.
And he was kind of a legend in the cyberspace.
And
It changed my trajectory it it's what's kept me in cyber.
But my passion that I found was I had a developer background.
Like I was a computer science engineering graduate and working with developers back
then, and this I'm talking two decades back now.
this is at the start of PCI when developers were forced to learn the
OWASP top 10 as a requirement.
And I remember thinking, like, this is not the way you train a developer.
Being a developer myself, it's like if you want to win hearts and minds, you've got to get
into the head of
of developers, and that's my passion in cyber is how do you drive culture change by really
getting in the hearts and minds of folks, and that really became my passion, and is where
I learned everything I know about cyber.
That's interesting.
I've got a couple of things on that one.
Mentoring.
You mentioned a mentor.
I I've talked a lot in LinkedIn about people.
in my life we've been mentors and continue to be mentors to me, right?
And I think the most pivotal moments in our lives nothing to do with the roles
and the careers or the companies, but to do with the mentors who shape us more?
Is it is it people that shape us more than than opportunities do often?
I think so.
Like I feel like you go work for amazing leaders and you leave bad leaders.
It's generally not you can like find in I I find like different products and companies
interesting.
And I always advise college new grads and people like you don't need to chase the company
names just because they're amazing.
Chase the right people because if you're surrounded by the right type of folks that are
invested in you and are like are gonna create an environment where you can learn and make
mistakes and grow and
That's life changing for me.
Like I it was I mean, it was amazing that I was at Walmart, but it was not that it was
like the team that I I had around me that really grew me and I've been at amazing titles
where that's not necessarily the case and it really holds you back, you know.
And so I do think people, mentorship, community is what it's all about at the end of
the day.
day.
So in a single sentence what makes a good leader mentor versus a bad leader mentor?
Like what is the one
thing.
I sure there's loads, right?
But what is the one thing that defines good versus bad?
I think a good a good leader mentor is somebody who want wants to see growth in their
people.
and is not afraid of giving critical feedback and in all with the intent of
wanting to see that person do even better than them.
I think on the flip side, it's folks that are like just not connected
on the human side.
It's all about just the work and it's like not you're not invested in people.
work and it's like not you're not
invested in people.
You're just managing and that's not good but mentorship.
You're speaking my language.
I t I talk a lot some of my team listen to this and I talk a lot about the fact that we
build families, we don't build teams.
And I've always said that like my great successes in life are the people who I've hired at
like junior levels who are now CISOs and VPs.
Like that will be when someone says they have to leave 'cause they want my job
effectively, that's like the greatest possible accomplishment.
I think that's what leadership is, right?
It it's building people, it's not building processes and programs.
The other thing you talked about was was being technical and trying to like make culture
shift.
That's an interesting topic.
I see
I come from a technical background too, but from a different one.
I didn't build, I I broke stuff.
I came from a pen testing background.
But I think now more than ever it's super relevant to have a technical engineering
understanding.
I I I shared a post that you shared on LinkedIn last week, and this won't be relevant
whenever this goes out, it won't be last week.
But
About how AI is exposing bad leaders who are unable to change.
It's basically just making broken processes explode quicker.
Right.
And I think that speaks to people who the engineering mindset is outcome focused, whereas
I think the compliance kind of traditional consulting background is like process-focused
front forwards, whereas engineering is backwards or end backwards.
I don't know if you agree on that or what you think.
I think now it's it's a time where any C, so particularly in tech companies in SaaS, needs
to have.
a real competence in engineering to be able to move that culture 'cause otherwise the R
and D team just don't give a damn what you say.
I think you're right.
And I I think I've I've I talk about this like, you know, for a long time we're like as
leaders, you don't want to be too hands-on on the tech and because you kind of mm forest
versus trees and all that stuff.
I actually think we're at a really interesting time where becoming a builder is going to
be really important to be able to lead.
And I s I've been saying this again and again.
Why?
Because like the world's changing around us at a pace that we've never seen before, and
how you can leverage AI and agents and to do
do to get to good outcomes is gonna require a builder mindset.
And how are you gonna do that?
You've got to kind of understand it and build yourself to understand what good looks like
and bad looks like, and then be able to train your teams to go and like make that shift
and that transition, which I think like these those are very well positioned right now to
go drive the change that in companies that's needed across the board around AI.
And
But if you're just telling your team like, we're gonna cut X percent.
Like going love it is the right it.
And people are gonna things to drive efficiency that are not gonna move the needle and
things like that.
And so you can really like amplify this
function if you're not in that builder mindset.
The builder piece, I have mixed thoughts on this because people tell me that now is a time
where you can build without any technical competency at all.
Like agentic tech and AI means that now you anyone can be a builder, right?
I reserve my opinions laugh to speak, but like
What do you think about that?
Is this the time now when non-technical people could suddenly leap forward in technical
capabilities?
Or is it still required like if you're going to debug AI and agents, do you still need to
know what actually how the inner workings work?
Like, where do you stand on the fact is are are technical evolutions or progress now
available to everyone?
Or are we still really needing to have people with a technical solid like computer
engineering or computer science back?
You can build like anybody can build.
You're gonna build really stupid things if you don't
have a deep understanding of what you know, like you could go build things that already
exist and feel like, my God, this is amazing because you don't know.
And like I still think like, look, the technical background helps you build the right
things, it helps you ask the right questions, it helps you do it in the right ways and
like securely and all of that stuff, considering the complexities.
Because you can build surface level things.
And you know, it's funny because on the investor side too, people are asking, like, how
difficult is it really to build things?
And you can build some stuff, but they're building like we Jake, like coming from a
technical background, right?
Like we know how hard it is to build good things and the complexities that go into it.
And for that, I do think you need a you need
to understand you need to have the technical background or at least have like a product
management mindset too, like to understand like the details and what goes behind this to
then I guess let me put it simply.
You have to s you have to feed the system the right requirements still.
And that still requires knowledge.
least have like a product management mindset too like to understand like the details and
what goes behind this then I guess let me put it simply, you have to s you have to feed
the system with like requirements.
Yeah.
And that's what requires knowledge.
But that's that's more that's more of a mindset than a than a like a nuts and bolts,
right?
That's coming back to my outcome first.
You have to know like if I want like Z to be the result or Z, like I need to do these
things.
These things are best built in this way using these components, you can leverage these
technologies.
This is how I'd whiteboard it, because I think what there's still a place in the world for
whiteboards, even in AI.
Like that doesn't speak though to needing to like have a detailed coding experience.
Like, do I still need to be able to actually write Python?
Like, we know every time if you look at AI under the hood, it's just writing Python
constantly, right?
Like, do you still need a deep understanding of how that works?
Or is it enough to understand like the the overall process flow?
Are these product people more than they are our engineering people?
Think it depends.
Like I don't think it's that black and white.
And I don't think coders are gonna go away.
and I I do think having a good knowledge around coding, although, you know, before it was
like you still need to understand the code to debug what your AI has built and all that, I
think AI is doing a pretty good job we've seen of fixing issues without having like a
human involved.
So I still believe in like I I still lean even though I don't code today, Jake, like
I still lean on my knowledge from that quite a bit.
Yeah, but I'm the same.
Like I said, I can I don't go hands on keys, but I can still look at concepts and say if
you're gonna build that you're gonna need to do and C or else that's not gonna work,
right?
And and I think that's that's the core bit and it's a found it's foundational education
that I don't know if we will lose over time.
Now we're teaching kids probably at at university and colleges to code using Claude Code,
whatever else it might be, right?
That are they actually losing the foundational understanding of how to like begin the bit.
It's the same way as like we've now learned that because we can translate automatically in
an AirPod.
Like, do we still learn the fundamentals of language?
Or do I just know that like if I hear these noises, this is what it means?
So I I think there's a whole generation I I I ask thing for the security world at a CISOs,
like I worry what our future is because I look at it and go, Who's gonna replace me?
If if SOC tier one is now automated and GRC tier one is now automated and like AppSec tier
one is now automated and pen testing is being automated, like how is anyone gonna learn
the skill sets that we learned foundationally before we start a player on top of them?
Like where is the next generation of CISOs?
I don't that's the that my biggest concern right
It's it's it's gonna it's gonna be an interesting time.
I feel like our roles are gonna change too, right?
Like they already are.
I mean, CISO role has changed, like we were technical architects before, like kind of
behind the scenes now.
It's a very forefront role, it's a very business role, it's a communications influence
role.
And then I think like the there'll be a technical arm to it that's leading agents and
tooling and things like that, but it's gonna shift quite a bit.
It's a
It's a and I I don't know what our role I I don't have the answer to that, but I do think
about that a lot too.
It's like part of the reason I I like was like, okay, what is what is life after CISO and
who is gonna take on our roles and what is that going to look
like?
Yeah, let's come to that.
Let's start to journey that direction, right?
So one ch one one side of me says you don't need to worry because hopefully upward will
have a massive exit and you'll be banked for life.
So it won't matter anyway, right?
So let's talk about
that one.
So you went from doing try traditional security roles inside of non-security vendors
primarily.
Rubrik is kind of in between.
to going straight into like a security rocket ship, right?
And one that's am I right in assuming is probably quite high pressure?
Specific VCs carry a lot of pressure with them.
So
W tell me about that journey.
Tell me about why you joined up with what it's been like being this this new kind of chief
security, chief trust, whatever it looks like in that kind of new role.
And yeah, how it's been.
Because that that's you've been at big businesses, but probably not at the scale rate that
this one has been.
Totally.
It's so different.
And that's what excited me about it.
I mean, I've done the public company CISO job now several times.
And it's a really interesting role.
It's challenging and not in all the ways people would expect.
But like, you know, you're you're learning a lot of skills around presenting to the
board and there's a lot of maturity regulation, compliance requirements, and you're
juggling a lot, scaling and leading teams.
And then, so I'd done the CISO CIO thing for three years at Bill, and I'm like
sitting there.
about what's next.
I was actually gonna take another public company CISO job.
And I had this like weird feeling.
I wasn't ex like super excited.
I was almost like, I'm gonna just go do the same thing again.
And but I was about to sign in because I was ready for my next change.
And I and that's when Upwind, Amir reached out and he's like, Rinki, what about helping us
build at Upwind?
And I'm like, you're a series A company.
Like what am I gonna come and do there?
Like, you know, you guys are tiny.
And he's like, we're
gonna be raising our B.
We're we need to like strengthen our security in IT.
IT
and I just think we could bring the voice of the customer.
So it's been super interesting.
I ran I went I was running marketing, I'm just helping them build up the company and I'm
like this is how CISOs think and like this is how we need to shape the product in addition
to building out our IT and security capabilities and bringing that in as well.
So it's a totally different role and I'm loving it.
It's like literally working day in and day out with a founder and there's a lot to learn.
from a big company on how do you like work in a small company and
and yeah it's total change.
not to say that I mean I'll go back someday to a bigger company or whatever, but it's like
this is an amazing experience like how do companies run at this stage and how do you think
about security in IT in this context and and then just being part of a business that's
like hyper
growth is amazing.
Yeah, I I love the piece where like you pointed out like you do product and marketing
stuff.
That's one of the reasons I've spent now so long in vendors is I love the fact that my job
is like
Basically all the jobs.
Like I I am the l the logic for marketing.
I understand what the product should look like.
Like I have a good guide on the go to market strategy.
I think that's the exciting piece of working in vendors.
Yeah, I think I think that's the exciting piece.
How big is your team now?
My my team, my so I had a team of about like forty, what was it, forty or fifty people
when I had marketing as well.
I've got like a handful of folks in cyber now and IT, and we're continuing to grow that
globally as we start to strengthen capabilities internally.
And obviously we're st we're starting to look at different compliance regimes like FedRAMP and so forth, which is really forcing us to think about
architecturally how we start building the capabilities.
But we've got a handful of folks in cyber right now in IT.
Are you looking at FedRAMP 20x?
Yes.
Yeah we've just
about to finish our FedRAMP 20x at Anecdotes.
it's been one of the most interesting compliances I've ever had.
It is the one time where like someone actually started talking about Python and JSON and
like Postman calls and stuff.
Like in compliance
it's been different but in a positive way.
I'm a big fan of Pete Waterman and I think he's trying to change things in a positive way.
But he's just like it's like I always feel like I know if you ever watched Yellowstone the
series.
It's like trying to herd cattle, like they just don't want to go that direction.
They they refuse
to go the way you want to bring them.
It takes like multiple cowboys and I feel like there's just a whole load of people need to
all join.
to eventually move that giant federal muscle to understanding that it's actually better to
be continuous and to be tech based than it is to be like in SharePoint and PDFs.
But it's just gonna it's gonna take a while.
Anyway, I digress.
So and you you talked about kind of moving out of security before I took you into Upwind
in that role.
that means that one so I the one of the reasons I had you on and like I I I'm pretty open
about this.
So I actually invested in Lockstep, which is obviously your VC.
I gave you my my kids future money, right?
Why did you do that?
Like you have a crazy busy role, you've been through multiple companies, you are probably
independently financially pretty sound at this point.
Like why go and start a whole nother thing?
This was okay, this is I've been I love, love, loved working with founders.
And that's I that was the one good thing that came out of like draining even Pacific Gas
and Electric.
Like I in my very first job out of college, the people I was surrounded by loved
innovation and they like would constantly put new vendors and like companies nobody else
had heard of and they talked to them and I got exposed to that early on and I'm like I've
loved it since then.
Loved working with founders, giving the new guys a chance and all of that.
of that.
That ended up changing into like advising founders and really getting deep with them on
sometimes like how they go to market or their product, and how like we see it as
customers.
So I started advising.
That then turned into like angel investing, which I have no idea, honestly, what I was
doing.
yes, they're letting me put $5,000 in.
Amazing.
And then I then Lucas Moody, who's now the CISO at Astera Labs, him and I were like doing
this kind of on our own, and we were like,
Why don't we come together?
We've been we've known each other forever.
We're doing this on our own.
Would you like want to come together and do this together?
We came together and we started putting our money together.
We made like 30 or 40 angel investments into companies.
We were we made some good bets.
We were having a ton of fun doing it, but we're like draining our bank accounts.
And what it what would it take to start a fund?
And we did all the research and it felt like to me, if I was gonna do something.
Outside of being a CISO and a security practitioner, I'd still want to do cyber and I'd
want to do it on this side.
And so we started a VC firm, sort of a tiny little firm, just to see like, can we get into
the best of the best deals out there?
And we we proved it.
And the best part of it has been the community.
I really
wanted to find ways to give back in meaningful ways.
And I just felt like the way that VCs and vendors were taking from others, like I didn't
get why we're not the VIPs in the ecosystem when we're making everyone else rich.
And
And we're fueling the whole ecosystem.
And yet, like we're they like we go to these things and it's vendor pitch after vendor
pitch and steak dinner after steak dinner.
And I'm like, this is not what we need to do for the practitioner.
Like, how do we put them back in the center?
And I wanted to start that community that was like separate from the VC and like give
really give back, like and show what it is to give back.
And to me I could see myself like a few years from now doing that full time.
and just like having a bigger fund and be doing that full time.
And to me,
like it's
it's I'm so So I carve out time and I like spend my weekends thinking working with
founders and I love it.
You're worrying me that you're like dictating my future life to me.
Because I've kind of like I've done on that journey but a bit further back, I've done a
whole bunch of like we are like
Gosh, we are repeat offenders in the design partner world.
I think I speak to 10 founders plus a week.
I've Angel invested, I've VC invested.
Like I haven't started my own fund yet, but you're worrying me that like this is just
gonna be where it like snowballs too.
We speak the same language on community, I think, as well.
Interesting.
What do you think?
Do you think CISOs know what they're doing?
I asked because I'm gonna actually build a set of content for like I'm building a bigger
platform than just this podcast.
And part of that I'm gonna build some content out with probably yourself.
and Karl Mattson has already joined and agreed to do with me on like teaching people the
fundamentals of investing.
Cause like you, I started writing like ten to twenty thousand dollar checks to startups
that I just thought were cool and sexy without really knowing what the hell I was doing.
Right.
And the first time I dropped
money into Carl's fund, who was first for me, for Squared Circle, those don't know, I
was like, yeah, why not?
I trust you, I like you, I think this is great, let's do it, right?
I didn't really think anything about it.
and I think there is such a lack of education out there.
CISOs want to be involved in these communities, they want to be involved in VCs, they think
they're gonna make a fortune, they don't understand the time frames, they don't understand
the risk profile, they don't understand like how to actually understand these investments.
I feel like there's just such a lack of like knowledge in the industry.
I don't know if you if you agree or disagree, but like I feel like people just don't know
what they're doing.
It's why we started Lockstep.
And it's ex exactly why or the Foundry, the community.
It's they don't I we don't know what we're like, it's one thing to be like, I love these
founders, they're amazing.
But it's another to look at the financials and and understand whether or not it makes
sense to put your money in there to like if you're looking to grow your investments.
And there's a lot to look at, like the valuation of the company and like there's so much
to it and
and it's really it's p it gets really complicated.
when do you exit your position?
And there's so many things to it.
And I think like part of why we started foundry was how do we teach this?
How do we open the doors so that folks can ride the upside of the companies they're
helping make successful?
And what does it mean to be on a cap table versus not?
And all of that.
There's so much to it, right?
I agree with you.
Like in the beginning, I had no idea.
Like I said, like I just wanted to get well, cool.
I'm an investor now.
And it's like, okay, I made some dumb investment decisions just to get f like a few checks
in.
in.
Yeah.
Then I became smarter over time and
don't think we need to gatekeep the knowledge.
I think we should share it and get more people involved.
knowledge, I think we should share it.
It it it helps as well, right?
I found that like I've probably become a nightmare as an employee because I now know how
to negotiate my equity in a way that I didn't know before.
Like I understand how cap tables work, I now understand percentages versus option numbers,
like I understand vesting, but like I understand these things best than I used to, which
means
I now am much more able to negotiate at the point of every kind of transaction or every
yearly basis to say this is what I want from my next comp package and this is why.
Thank you so much for your time, for this first part of your time.
Thank you for joining.
Is there any single final thought you would like to share with people before I let you go?
Yeah, I you know, like I say this a lot.
I think we find like with our jobs, they're stressful.
And we don't make enough time to connect with people.
And at the end of the day, I think like every opportunity folks ask about like Rinki, how
did you land your first board position?
We didn't even talk about that, but I've been on three boards.
And like, how did you land your board position?
What how did that happen?
And like I can't stress like how important it is.
Like it I know it's like extra time that you carve out to go and do like.
like community events or networking dinners and sometimes nothing comes of it immediately.
Like it's so important build your community and your people and invest time in building
the network.
And I can't stress it enough.
The opportunities are not immediate, but like the things that come out of it over time are
like some of the most meaningful things in my career.
And I I just make time for networking and community.
I think it's so important.
I would only say Amen.
I've never applied for a job.
mainly because I've built my network in a way that I've either had a conversation, it was
open for me to say, do you want to hire me?
Or someone came and said, Do you want to work for us?
Right.
So I think that that is the truest statement and kind of proof of what you said.
Thank you very much for your time.
We look forward to having you back and talking more about investments and boards and
everything else in between.
But for today, I appreciate the time you spent with us.
So thank you.
I can't wait to be back.
Thanks,
James.
Speak to you soon.