58. From Compromised Identity to Cybersecurity with Vishal Amin

Brock Briggs  0:00  

Hello and welcome to the Scuttlebutt. I'm your host, Brock Briggs. And on the show, we speak to the world's most interesting veterans so that you can learn to make better decisions, think deeper and earn more money. Today you'll be hearing from Vishal Amin. Vishal is currently a GM at Microsoft overseeing their security compliance, identity management, and privacy for all US federal work, and a former Marine Corps F-18 Pilot. 

In this episode, you'll learn how to decide what to work on. If you're listening to this podcast, you'd likely have more opportunities than you have time. Vishal walks through an aviation mantra he uses to whittle down to what the most important thing is. You'll also learn how to avoid the need to validate your service. We've all been there looking for opportunities to over explain our past, particularly to non veterans in order to tell ourselves that our service means something.

And lastly, you'll hear Vishal’s recounting of being named on a public hit list by ISIS following operations he was involved in. He recounts how his personal identity being compromised changed his life and how he's channeling that energy into passion for protecting identities and cybersecurity. You can find all episodes of the Scuttlebutt podcast including show notes, edited transcripts and other resources to keep learning at scuttlebutt podcast.co.

Brock Briggs

I think one of the first things that I'm gonna need you to tell me about is this water polo. As I'm like doing my kind of due diligence on you, I'm like, looking back through your history. And I'm like, oh, man, this guy is pretty interesting. And then like, this thing, right at the very bottom is like water polo USA gold cap trials. And I'm like, oh, this is, I gotta find out about this. How did you get into water polo?

Vishal Amin  2:02  

I was really bad at sports growing up. 

Brock Briggs

Really?

Vishal Amin

I don't think I was the most athletic person. My best friend, Alex Samarez actually growing up, we were on a swim team together in middle school. And I was really bad at baseball. His dad was the coach. His dad actually used to have me lead off bat all the time because my on base percentage must have been so high because I was so scared to swing at the ball. And that was my extent of being good at baseball. I think with water polo, it was a little different. I've always been a water person. I loved the pool, I love swimming. And then when they put a ball in front of me and then being able to chase a ball in the pool, it took it to a whole different level. 

So I went to a water polo tryout or practice with Alex and I loved it. And I hated it at the same time. And I started playing and that was it. And I played for high school, during high school, from what I remember, it was two or three individuals on our team that were really, really good. You know, Olympic caliber individuals. And just very good. I grew up in a town in southern California where water polo was a thing. And there were some things that happened in school academically in my life that gave me the opportunity to move and force a change and going to school and doing better in my studies and life in general. And I was a Southern California water polo player. And I took advantage of the fact that there was no one in Texas that really played water polo. 

So I went to Texas. I played for a couple of water polo teams out there in high school and college team. And I used that opportunity to be the best water polo player in the region and got invited to the USA team gold trials and the camps at the senior levels of the sport. And sure enough, there were some folks from my high school there as well, asking me Vishal, how the hell did you get here? I said I had to leave the school and go somewhere where everyone sucked and I was the best person and I ended up here with you. And I ended up playing later and I really had a love for the sport. So water polo is one of those things in Southern California were just amazing. 

And I'm a better person a better swimmer, and obviously see all the surfboards in the background and I loved the sport and everything that it gave me and allowed me to do. So yeah, that's how I got into it and allowed me to go compete at some of the highest levels we have in the sport, which, you know, it's an amazing sport. I mean, if you watch it in the Olympics and some of the athletes there, they're just resilient and tough people. Yeah.

Brock Briggs  5:16  

I've never watched it in the Olympics. But I have a hard time. I think I'm like a decent average swimmer, I guess. But I can't imagine the strength that's required for that. Like that seems to be something that

Vishal Amin  5:31  

I played and I can't imagine, my son plays now. He just started trying it. And it's like watching him half drown twice a week when I go there. As a parent who's played it his whole life and watching, it's a whole different perspective. And I have to remind myself, man, that was tough. I remember that. That sucks. I don't wanna be him right now.

Brock Briggs  5:54  

What a cool experience, though. And I'm sure, like, an interesting thing that I'm sure a lot of people ask about. Like that, like I said, that just seemed like such a standout item amongst all of the other things that were

Vishal Amin  6:07  

I’d say, I lost a lot of good horses, you know. It's good, you know, but it's one of the things that comes up. It's a little known fact that 

Brock Briggs

Yeah

Vishal Amin 

Up once in a while.

Brock Briggs  6:17  

Were there any other interesting standout things about your childhood that were meaningful? You've mentioned elsewhere that I believe you're a first generation American. And I am always curious to ask how cultural influences had kind of like maybe shaped some of the early days for you?

Vishal Amin  6:38  

I think absolutely. All of us. Everyone in this world now has some type of tie for the most part, to let's call it diversity or ethnic diversity or some type of origin story. I am first generation, Chicago then moved to Los Angeles and then San Diego and then in the Marine Corps and did all kinds of things. But it definitely changes the way I look at life. I think, you know, the one thing about where I come from and who I am has a lot to do with the culture and I'm of Indian descent. So the culture and the aspect of what is actually important and what's not important, and what the meaning of family is as well, because nobody in my family actually served either, right? So I served in the military and nobody in my family served, which is, you know, the end state there was be a doctor or be a lawyer or an engineer or something like that.

Brock Briggs  7:40  

Kind of curious how the military kind of came into that as maybe a viable career path for you.

Vishal Amin  7:47  

I actually was being cold called by the recruiter when I was a junior in high school. And I rode my bike down to the recruiting station, it wasn't an army recruiting. It was a Marine recruiting station. And I didn't know the difference either at the moment and I walked into the recruiting station to get my name taken off the call list. And the scrawny guy who wanted to be a lawyer ended up walking out of that office with an enlistment to the United States Marine Corps because I had no backbone to say no to the recruiter. Luckily for me, I was 17. And they still needed parental consent. So I walked my bike home. I made my mother cry and questioned what I did and why I did it. 

And my father said, well, when you make a commitment to something, you do it. So a little bit of guilted into the Marine Corps, a lot of bit of making the biggest mistake of my life that turned out to be pretty good for me in joining the Marine Corps. So I would definitely say I like to share a lot that joining the Marine Corps was the best mistake I've ever made. So is absolutely that so I definitely did not join for service, for country, for, you know, may have been a little bit of benefits and prestige. I think the recruiter told me well, and I enlisted as a military policeman. I think he told me well, you wanna go into law. This is very close. You can be a military policeman and maybe become a lawyer. 

Brock Briggs

That's a stretch. 

Vishal Amin 

That was a stretch. I was the most gullible guy in the world, you know? So. Oh, man.

Brock Briggs  9:37  

Well, you’ve ended up working out all right. And you're obviously here today. So we've got that going for us.

Vishal Amin  9:44  

I will say I loved the feeling of it. Did I understand at the time, what I was getting into and what that would lead to? No, I thought maybe I'll do four, five, six years. I'll get out, maybe I'll stay in the reserves. Maybe I'll do something else. Also understand, I joined during Clinton, so there was no active, you know, war or any type of thing happening there. I think what happened over time, though, was you get that sense of service, you get that sense of commitment. And while I was going to school and my grades were declining, and realized that I wasn't gonna be a doctor and I wasn't gonna be a lawyer. I wasn’t gonna be a dentist or any of that. I realized I still loved what I did on the military service side. And I think that's the moment where I realized, I think that was that was the way to go. And it was probably right around the time of September 11. That was gonna be it. And you know, the sense of service and the camaraderie and how the nation came together at that time was probably a big piece. 

Brock Briggs 

Do you have any regrets? 

Vishal Amin  9:44  

No regrets. No regrets in anything I've done. I think you learn from what you do. I think I would have looked at life a little differently. I would have invested in things a little differently. I would have probably tried to go to school and learn a little more, a little faster. But I'm also the type of person that believes that everything happens for a reason and you'd learn from it. I was probably a lot lazier earlier on in my career than I feel I am now. And what I mean by that is, I probably didn't take advantage of some of the opportunities I have in front of me, maybe didn't realize they were there, right? 

That's education. That's maybe the benefits afforded to me through the service, maybe spend more time with my family and friends. And I think anything that I regret is mainly based around time, investing more time in others and people and things, right? It's never really about the decisions of what I personally did, but it always affected. You know, I think if I ever wanna rethink what I do, it's always about who I spend my time with and what I do with them. So

Brock Briggs  12:01  

I don't think that there's anybody, even like one term, folks but like, especially career folks. Everybody says the exact same thing. And I still haven't quite figured out if it really was even possible. Like it's always so easy in hindsight, yeah, I should have started going to school sooner. I should have started doing all these things and look back on some of those things. It's hard to like hold yourself accountable to at the same time because life is weird. In the service, if you're like deploying and you're like have like a high op tempo job. And I can't even imagine as like doing military police. I would imagine that you probably were standing at a lot of watch at the very beginning there. I don't know how much. I don't know how much time you would have had for school.

Vishal Amin  

Oh, man

Brock Briggs 

I know, correct me if I'm wrong, but

Vishal Amin  12:54  

I was getting a lot of posts, a lot of watch. I did a lot of things outside of military police work and eventually got into some of like, the Recon community and then flew off a teens later writer, you know. I think there's paces in my journey in my career where things stalled and you think you could do more. And it's when you find purpose. And when you find things to do, you start investing more and you go faster and faster and faster. It's like, the more I do, the more I feel engaged, the more I wanna do. I'm almost, I started outpacing what I can actually have capacity for.

Brock Briggs  13:29  

How do you think about deciding what's the thing that should be getting all of your attention?

Vishal Amin  13:35  

So I use an aviation mantra right now for my business, right? So right now in my role at Microsoft, I GMR security solutions business for Microsoft federal for our defense business. I use aviate, navigate, communicate, those are the three things. And what I mean by that is, number one, to do anything, the plane has to stay afloat, right? It has to stay flying. It can't be in a heads down, spiral, it can't be going sideways, it's got to be flying. The second thing is once it's established that we're not falling out of the sky, let's point to the direction in which we need to head. Let's navigate in whether that's to an airport, whether that's to wherever we need to go, let's point that direction. 

And lastly, and it's the last thing but also one of the most important is communicate, communicate with honesty and transparency. Make sure to make your intentions not just known, but share what those intentions were, as you've acted. Like it's always act, right? Always act first with the premise that you're doing it for the right reasons for the right thing. So when you say how do I prioritize my time? Well, first and foremost, I make sure that the basics are done. So for me now being out of the military, that's am I being a good father? Am I doing what I need to, to be a good husband? Am I dedicating my time to the places that are going to really drive who my legacy and how I wanna impact? What's the most important to me? Navigate at that point, well, if I'm doing that, then let me navigate to things I love. And that gives me the goosebumps. 

So for me, cybersecurity and empowering others to protect your data now and the outside world. That's, if I'm doing more around that and empowering others to do more good in what they're doing, like I dedicate time to that. I'm really passionate about the Travis Manion foundation. So I dedicate a lot of time to the Travis Manion foundation. I dedicate time to a lot of other nonprofits, if I relate to their mission. In my current role, if, you know, I dedicate a lot of time, if it's making impact in a way that's meaningful, that's driving not change but action. And if it gives me goosebumps, I dedicate time to that. And lastly, at that point, they don't communicate what I'm doing. For me, it can be kidding, what I'm doing before I do, it isn't always necessarily the goal. I know a lot of folks say hey, make your intentions known, validate what you do, and then go do it. I think if you start with the premise of, you're doing good for the right reasons, you're not really gonna make a bad choice because you are doing it for the right reasons in a morally sound way. So communicate why you've done it, what you're doing, what your intentions are at the end. 

And that's kind of how I navigate what I prioritize and how I prioritize my time. I try not to seek much validation, either simply because I really feel all people have good in them. And if you're doing it for the right reasons and you've got some great mentors and great community around you, then you know that validation really isn't needed, right? I just need to reaffirm to people why I'm doing things, maybe just to get them up to speed or things of that nature. But I don't feel like I need to justify my moral character and my actions most of the time. So if I feel like I'm validating a lot and I'm justifying what I'm doing, then I really need to assess in my mind where I'm spending my time and why I'm doing it, right? So

Brock Briggs  17:28  

I like that idea of living life free from the need to validate. How do you think that that and then also what you said about the kind of a goosebumps tests like am I doing things that like make me excited. I've never heard anybody talking about that. But that's right.

Vishal Amin  17:46  

The validation thing is really huge. I have a mentor, I'll share his name. His name is name's Jeff Hillman. And he's an entrepreneurial startup individual. He's in big tech now. He's done so many things, has had a bunch of exits. And his story is amazing. He didn't share a story with me until later. He was an avid golfer, a very tall individual, has grown up in many aspects of financial and social diversity right from the low end of the spectrum to the high end of the spectrum and still trying to make impact. And when I was getting out of the Marine Corps years ago, I could not find a job. 

It was nearly impossible for me to find a job. And you were looking at someone at that point with 20 years in the Marine Corps, could not find a job, wanted to move into tech, as your tech backgrounds, your tech experience, didn't know anything about cyber. All I knew was how to talk to people. And I didn't even know that. I just didn't know exactly what I was gonna do to put food on the table. So I started writing my resume and I started chatting with a lot of people and I started really validating my career. This is who I am. This is why I did it. I am a good person. I want to do more good for people. This is how I've done it in the past. And there was a big difference. I was speaking to him. He said, Vishal, there's a big difference between validating what you did and sharing why you did it. Because when you're validating it, you're on your heels. You feel like you're explaining to someone and you're justifying the decisions you made. 

When you're explaining it, you're sharing why you made those decisions, and the impact that they make and why they gave you those goosebumps, right? He said you served for X amount of years. Don't ever feel the need to validate your service and who you are to people that you speak to and that is the single and best advice I've ever received in my life. And probably you know, when most people say, hey, Vishal, I'm getting out of the Marine Corps. I'm transitioning out of the Marine Corps, what do I do? And what's the best advice you can give me and I said, don't ever feel like you need to validate yourself to anyone. Go invest in what you're passionate about. And do it. Because if you do that, you're able to justify what you're doing because you're passionate about it. 

There's no data or backing you need to be passionate. There's nobody, there's no police, that's gonna come around and say, you're not allowed to go into tech. You're not allowed to go into cybersecurity, you're not allowed to go into consulting, you're not, you know, you're gonna say I'm passionate about it. I love it. This is why I love it, right? You don't have to go back and justify all the different emails you've created over the last 20 years and all the data that you've brought in to validate why you wanna go into tech. I hire people at Microsoft now more so that because they're passionate about what they do rather than they're skilled for what we're hiring for. You can teach the skill, you can't teach the passion, right? And those same people that are passionate, those are the same ones that they don't feel like they need to validate, but they feel the need to share with you why they're passionate about things. And so yeah, that's probably one of the biggest lessons I've learned around validation that’s why I share that.

Brock Briggs  21:38  

I think it's almost something that's innate to who we are as people is we're naturally and from a very young age taught that we need to ask for permission for things we need, rather than just going and doing the thing. We need to like ask like, hey, can this be done? And like looking for, I know that I find myself constantly looking for data points that maybe suggests that something is even possible, rather than just like realizing, hey, like, this is what I wanna do. Who cares about any of that? It's just, it's tough.

Vishal Amin  22:17  

I mean, even in the aviation community, when we were flying the F-18 around and we're training for defensive maneuvers. There was always, if there's a surface air missile shot at you. It was never hey, Brock, there's a missile on the right hand side, break left or break right. You know, it was always break right. There was a missile on the right hand side, it was always action. And then sharing why we took that action later, right? So we didn't, you know, we never seek the validation and the assessment. We always, there was inherent trust in the actions that we made. And we took action. And then we shared why we did it after. 

And we didn't validate it because guess what? We already took the action and we were sharing why we had to do it. And I think in every when I look at how I probably take, how I look at validation and how we make decisions. I think about examples like that in my career and in my life where I've taken action and then where I've actually pedaled back and retroactively done something because I felt like I had to, you know, and those are two different paths. And they led me to two different outcomes every single time.

Brock Briggs  23:38  

Do you think that acting without like searching for the validation, whether it's more data or more information or permission, acting without those things is better when it's high stakes? I think that I find myself in a position and talking to people it's like they're, especially in the transition spaces, like they're scared. It's like there's this perceived idea that it's like kind of a high stakes thing. And usually in hindsight, it never is like almost nothing. 

Vishal Amin  24:15  

It’s never gonna have all the data when you transition out of the service. Most people, they lean on their physical and their tangible skill sets that they've been given, that they've learned, that they've invested in and it's like looking through a soda straw. You're never gonna see everything around you because in that pathway to transitioning out of the service. You know that you can be a PMP or you can get a PMP you can be a project manager. You know you may have a clearance. You can go get a job as a contractor. 

I think if you throw the sort of straw away and you say well, why do I wanna be a contractor? Why do I wanna be a project manager? Why do I wanna use my clearance? Why I'm doing this to get a job that pays X amount and wanna get paid X amount because I have a home, I have a mortgage, I have food that's put on the table. I do that because I have a family to support. Well, the intent here is you want to support your family. And now the X Factor is what do I do that helps me do that? And can I do something that I love that allows me to do that at the same time. And I think you do have to act without the data, especially when you get out of the service. 

But you have to be able to pivot. There's a woman at Microsoft, her name is Aja Brown, she’s a self-proclaimed pivot clean of Microsoft. And she pivots when she feels like she's not passionate about something. And every single time she pivots, it's into an unknown, but it's into something she's passionate about, it's always paid off for,and I'm not telling people to leave their job after a day or after a week or a month. But I'm saying is sometimes you do have to make decisions based off of your gut and your emotion and all of that, and you learn from that, and then you pivot from there, right? You're never gonna have all the data to do what you need to do. 

But there is also the other side of that coin, where if you're making decisions outside of just career transition, like in the cybersecurity world, when you're making decisions on how you're defending a network or how you're defending your end user, how you're defending that human, we need that underlying data to deviate from to make assumptions off up to run machine learning algorithms off of, right? So data and all of that is very important. But on top of that data, you're still making a decision, you're still jumping off of a cliff, right? You still have to take a chance. You know, there's no certainty on the other side of it. So I think your question is fair, but there's also two sides of it, right? I think you do need the data but not to make the decision to help, you know, maybe to influence the type of decision you make or where you're going. 

And especially with individuals, getting into the private public sector after a life of service or after a few years of service to the country through a military department. There has to be somewhere you start from. And, you know, that's hard conversation to have. But I think if you just take a chance and start talking to people and networking, you'll find where to pivot from and deviate from, you know, 80% I think the last study was 80% of all veterans leave their first job within the first two years there.

Brock Briggs  27:42  

That's a lot. That is a lot.

Vishal Amin  27:45  

Yeah, I think it was a lower amount as well, I think it was like 40 or 50% within the first year.

Brock Briggs  27:50  

Yeah, that doesn't surprise me. And because there's I don't know, all of a sudden, like one day, you have a job and you're getting a paycheck and then the next day, you gotta put food on the table. You know, regardless whether you do 20 or not, you're gonna, you gotta figure something out. And I don't know that there's the necessarily amount of thought that's going into that like earlier on and kind of getting that kind of navigate thing that you were talking about earlier. Like, let's get pointed in the right direction at least.

Vishal Amin  28:21  

Not everyone's as lucky as some folks, right? For me, I mean, I didn't do anything related to cybersecurity when I was in and the incident that happened to me on November 21st, 2015, when my data was compromised and I was placed on an Islamic state kill list, right? Forced me to think about data, data sovereignty, the value of technology and how it impacts the human outside of just email and the internet. And it made me think about the importance of data and cybersecurity in a different light. And that drove me to want to pursue a career in cyber and utilize a diverse mindset of how I thought and saying, you know what? With how I'm thinking about this, I think there's a different way we can solve this issue. 

And I think there's a different way that we can influence how we protect people and what they do and how they impact the world and national security. So I had this clear vision that I wanna end up here, but this is where I'm starting from. A lot of folks don't have that life changing type of place to start from, right? And they have to figure it out in their first couple of years. And then even for me, I changed my first job within the first two years. I changed my second role within two years after that, and even here at Microsoft, I've changed roles a few times, never in a negative way but always in a way in pivoting and investing more and more in my career. And I'll share that, I think, that's no different from any other veteran, not all of us have that. I would say that luxury to be passionate about something. 

Now what I share with people, though is do what you have to do, transition out, get a job, put food on the table, do something. But find that thing that's itching at you to reinvest in, right? Is it to start a podcast? Is it to go be a professional dog walker on the side? Is it to go play intramural sports? Like go invest in something, right? You don't have to just focus in on having a project manager job at a contracting company because you have a top secret clearance. You could have a love for music and you can go apply for a job at Fender and be a project manager there and their supply chain and go look at all these guitars coming out and have a passion for that. And being around that type of environment. There's all types of things people could do. Just find a way to tap into that passion a little bit, especially when you're going through that.

Brock Briggs  31:01  

Would you mind recounting the story of your kind of entry into cybersecurity. I have a quote for me here: In the push of a button, a simple human event compromise the single most important piece of me, my identity. This story is crazy. And I can't believe that I hadn't heard it before. But I think hearing it from you will be apt for our discussion now.

Vishal Amin  31:27  

Sure, you know, I mentioned it a second ago, very briefly. The story actually starts, you know, as we started this conversation, I was an enlisted person in the Marine Corps. I commissioned I did a whole bunch of things that as a Marine and in my career, I was part of I was fortunate to be part of a couple of organizations and units and we got to operate all over the world and do things like recovery of of aircraft and personnel for the air controlling operations, flying missions in the Middle East and even in the South Pacific and doing work out there. It was in 2015, I was deployed overseas. And a couple of the operations that we’re part of had gotten some national news and national attention because of our involvement with some journalists and other organizations that we were assisting. 

Later in that deployment, I was able to do other things like go back to the Pacific, go work with heads of state there. And then I came home from that deployment. And my son was born while I was gone. And I met him for the first time when I came out. I remember that day it was amazing. I was sick as a dog, I got off the plane, I was so sick. I've gotten food poisoning a couple days prior. And I came home and everything was normal and getting ready for a tour, another tour of duty and March came around just right around the corner. And it was the day before my daughter's birthday. And my grandfather had passed away that morning as well. So we were at his bedside there and then we went to we're in Anaheim area in Orange County in California. 

And we're driving on the 91 freeway and I had a friend of mine, paying me via text and call and said hey, Vishal, are you okay? And I said, well, of course I'm okay. I'm you know, I haven't even heard from you since flight school. How are you? He said, so well. I just saw the news, wanted to make sure that you were safe. And you were okay. And I said, what are you talking about? And he said, well, you should probably look it up. And while I was doing that my wife was in the car and she was looking at it. And she was scrolling on her phone and on her phone, she saw a big black flag with the ISIS logo. There was 100 pictures underneath that with the names, phone numbers, addresses, all their personal information. It was all over the internet. It was all over social media, all over CNN, all of our Fox News. And on the message, on the list, it said here's the top 100 people that have operated against us over the last year, go to their homes and do harm, go kill them and their families. 

And here's all the information you need. So it was a call for all of the ISIS sympathizers and the lone wolves to come and do wrong and kill our families and me and all the other individuals on that list and we were all spread out in all the different states. I was escorted home that day by law enforcement. We are protected and escalate, as stands by the Joint Terrorism Task Force four years after that. But imagine that was the compromise of my personal identifiable information and my data that was housed as part of a mission set, that was compromised. Because of the way we managed and handled it. And it wasn't the Department of Defense, it was a individual within Department of Defense that mismanaged the data that made it accessible when they shouldn't have. 

And in that 60 seconds, right? My life had changed from a successful military career to what was the most important thing with the safety of my family, right? For the next, foreseeable future. Imagine parking your vehicle down the road, turning on your car every morning before you put your kids in it. I've said that many times, looking out your window and seeing a car outside parked there every day, changing the routes on how you drive, living a normal life was different. And we made the conscious decision to get out later. I made the conscious decision to share the story go public with the story as well. And not for profit, not to do any of that. But it was a combination of connecting technology to the human and for me, it was about making a difference. 

And that's as basic as that was and it was a super scary moment of our lives. And our goal was just to get hold again. And that brought me into the world of cybersecurity. But that didn't bring me to where I am now. I think understanding how we think about data, how we think about cybersecurity, how where we are vulnerable now, right? The endpoints is what we call them, the computers, the IoT systems, your automation in your home, you know, your phone, everything that you do. These are all points of weakness. These are all points of vulnerability, but at the end of the day, it's coming back to the person, right? And it's a human that becomes vulnerable. So how do we connect all this technology to the people and protect the people by protecting the technology. And I went through iterations of my career to find that and find the balance of private sector and revenue and where that sits and where we're investing in technology to get closer to the person and the warfighter and the mission. 

And that really changed the way I thought about where I wanted to invest my time and my life's work. Yet balance, how do I measure success in my career post military to make an influence for good, not just work for a big technology company that builds amazing things and sit at home and work from your garage? But in everything you do, how do you make an impact to effect that? What happened to me doesn't happen ever again anyone else. And that essentially was a transition into cybersecurity. Now, instilling that same type of when I tell that story and making a difference, you know, similar to how I look at the Travis Manion Foundation and for the nonprofit's I do work with, in addition to what happened to me and the impact that other people make in their lives and their careers and their missions. 

Like that gave me goosebumps, just like when we work with nonprofits to do good. That gives them goosebumps. And the challenge now is when we build teams and when I get to build teams and hire folks and those people get to hire folks. Are we hiring people to make more money? Are we hiring people to give them a chance? Or are we hiring people that are getting the same goosebumps that we got when we joined the business? And that's the gist of it, right? 

Brock Briggs  39:15  

That is like such it's hard to even like get my arms around the feelings that you must have been kind of going through. What was kind of the fallout of I'm imagining you like getting a call from your command at some point like what is the kind of like end state of obviously you're kind of talking about this like lead up of this internal change of like priorities and things getting out. What was like the physical change that was required of you and like, you know, where you'd like having to move states like

Vishal Amin  39:55  

There's a lot behind it and I won't get into too much detail but physically relocating. You know, the monetary loss behind losing a home because you can't live in it anymore because it's targeted by terrorist organization. You know, how you pay your rent, how you buy a car, how you protect your identity, when you go register for things, how you stand, you know, standing up a trust and doing these basic things in life physically changed the way we operated on a day to day basis. I moved four to five times that year. We had to reshuffle our finances, we had to work when we didn't have to take extra jobs, do different things. Because of the nature of what happened, right? Who was gonna be accountable for that happening. 

And at that time, there was no one held accountable because of its impacts in the private sector arena through my let's call it “public sector service”. I think we still struggled through those battles now. But we can identify how to fix those things now as well. And physically a lot had to change, your mindset had to change, you come to realization in terms of how you look at life had to change. You know, reassessing. One of the things you asked when we first started this, as you said, is there anything you take back? I would take that day back in a heartbeat, you know, I would. What happened allows me to do what I do now and make an impact and be passionate about what I do. And it allowed me to find that a lot faster than I would have. 

But I also recognize that I don't, I would never want anyone including my family to have to go through that day again. What puts those things into perspective, though, Brock is other things. There's other things in life that give you goosebumps and to that, you know, later that year, a close friend of mine, Tom Serene, died in an F-18 crash coming back from the Middle East and on his way home. And I was his Keiko, so knocking on the door. One of his family members there was one of the hardest if not the hardest thing I've ever done in my career. A year later, someone that sat in the front seat from me at the Vikings, who I flew with many times, another close friend of us in our family, Sterling. He died in F-18 crash. I bring those instances up because their life events. And they caused me to find purpose. So as much as I have to change, right? Those lives changed as well. 

So I think and what we're speaking about right now, every single one of us has a life event that changes the way we do things. For me the ISIS kill list thing was one of them. But Sterling Todd, those are others. So it allowed me to find purpose earlier and to your point earlier, I mean, I probably would, that's the one thing I would change is we would obviously change all of those three things that just spoke about. But for me personally, I would have probably managed my data differently or found a way to manage it differently or ask some questions around that so that these types of things don't happen.

Brock Briggs  43:26  

I have one more question about that event. And then we can kind of move on. You said that at the time, that there wasn't any kind of accountability for, you know, it sounded like that this may have been one individual's responsibility. What was the follow up and like the outcome of that?

Vishal Amin  43:46  

There were multiple kill lists released after that. And the way you look at cybersecurity now, I can share actually, we just released a digital defense report at Microsoft last week or a couple of weeks ago. We look at over 43 trillion signals a day on Microsoft, right? We didn't even have that type of data back then. And when you look at an attacker, they never attack from the same vector. They just like in any attack, right? Once you want to attack someone, you're looking at different vectors to attack, look at different ways to get in there. 

So when that happened to me, we started seeing more and more of these types of attacks on our industry in the Department of Defense. And it allowed the Department of Defense to start hardening their environments to start looking at cybersecurity differently. What came out of that sole individual that allowed that to happen was a great example. For them to understand that it's not just that one individuals fault but one organization's fault. But this threat is starting to happen more and more. And I think it was that moment, you know, after that was the OPM breach and other breaches and things of that nature that started showing this shift in where we're going as industry and being able to navigate out of that. And I think there's been increased investments. 

And I know there's been increased investments from that day forward within the Department of Defense to better protect the identity, the data sovereignty of the warfighter, and those who serve now that being digitally secure is equally if not just as important as being physically secure, because at a certain point in the example of me, both of those, right? Met each other, right? Being digitally secure and physically secure were equally as important. And they came to fruition for me on March 21st of 2015. So I think that is an example of why we need to look at this industry in cybersecurity, for example, as one of those differentiating factors of how do we protect ourselves physically, how to protect yourself digitally, and that goes into IoT and operational technology and protecting critical infrastructure and protecting people in different levels. 

For me, 2015 was the start of that, right? So it was pretty wasn't a thing. And since 2015, over the last, I'm a Marine. So it took me a little bit of time to do Math, seven years, right? We've seen, you know, billions and billions of dollars move into this industry for us to be able to better protect and enable people. I mean, look at us, right? Years ago, we wouldn't be doing a podcast or something like this on a platform. You know and cybersecurity and all of that is even more prevalent now. Because we have to be able to protect the way we innovate and the way we communicate. So I think a lot has come from that, especially around the defense sector.

Brock Briggs  47:06  

That was one of the notes that I had just kind of preparing for this interview thinking about, I'm not sure if there was like a single point in time when, like the switch flipped on for cybersecurity and understanding how large of an industry that is. 

Vishal Amin  47:26  

There was. There was a single point in time. So when I looked at cybersecurity, when I first got out, I thought it was as simple as just protecting data. And maybe a firewall is what I knew such cybersecurity as there's a big company called Palo Alto Networks. There's another big company called Cisco, there's all these big cybersecurity companies or security companies that did all this work. And when I realized at a certain point, I think it was about a year and a half into my technology career, that it wasn't about the technology and cybersecurity being this product, that it was more about the bad actor might the “flip switch”. At that point, it was, wait a minute. A product isn't gonna help us here. Just the cloud isn't gonna help us, the technology isn't gonna help us. We have to go start thinking like the bad guy instead of the good guy. 

And when I started thinking like that, for me, it was how do we scale our defenses through technology to better protect each other? And that's when I actually started thinking about cloud security and things that I do now. And a lot what I'm enabled to do at Microsoft, do the work that we do here. And there's all the other companies do such a great job as well. It's really a security family. As we compete, we also work together. But that's where this whole private public sector partnership comes into place. A lot of people say, well, we need to partner with private sector so we can innovate more. For me, private public sector partnership allows us to better protect each other utilizing things that we're doing in the private sector and scaling them into the public sector to affect the warfighter. 

So for me, the switch flipped, when I started looking at product and how people purchase things and where they invested money and still weren't able to protect themselves. For me that happened after it wasn't even that experience. It was when I was actually working with the cybersecurity companies and seeing what they were selling into market and what they were trying to enable and what they were trying to do and having empathy for the end user and saying, hey, this is what we're doing yet. It's not solving the problem. For me, it was 180 degree different view at that point.

Brock Briggs  49:56  

You talked about a change in the overall strike of cybersecurity companies from more protection based to focused on thinking and acting as like bad actors. Was there a change or a different application of technology that allowed that type of business to occur and gave room for all of these large cybersecurity companies? I'm not super deep into the tech scene. So anything that you can kind of like, make that simple to understand from like a tech perspective, I think would be helpful.

Vishal Amin  50:34  

Sure, I think we used to believe that if you found a safe house and you locked yourself into that safe house and you put a bunch of guards around that safe house, that whatever was in that safe house was secure. And you can build this fortress around the moats and everything around it to make whatever was in that safe house secure. So everything else you're building your security around it. And I think that's how I used to look at security as let's secure what's the most important thing by nature or by the nature of building around it. How I look at Cloud, for example, is enterprise technology. The Google, the AWS, the Oracle, the Microsoft's of the world, is being able to have this infrastructure, this platform, we're able to change one thing and affect many at the same time or give the ability to affect many at the same time. 

So when we're building things in the Cloud, instead of building security, around the Cloud, we build security within it. So when you look at the safe house example, let's say we're protecting a person that's in the safe house, instead of protecting that person. I look at security as training that person enabling that person in terms of self defense and to be able to defend by nature, instead of having bodyguards right? I think in the nature of this is do you build a moat? Do you have bodyguards? Or do you teach that person jujitsu? And do you teach that person self defense, right? So in the world of cybersecurity and technology, it's about enabling security by default in everything we do, not just securing the assets that we're trying to secure.

And that's how I look at it, it probably confused people more but in everything we do, we want security to be part of it, not to protect that person, but to enable them to do what they want to do securely, right? I shouldn't have to take the most important asset we have and put it in this locked room and say, okay, now when we need you, we need to go open all these doors and escort you out and be able to get you to do your job, and then we gotta go put you back in there. I wanna be able to have you out in the open and train you to be secure and train you to how to self defend and train you to do all that. So you can go do what you need to do when you need to do it. And be self aware of when you need to defend against yourself and give you that armor and that ammunition now rather than later, right? And build around you. So

Brock Briggs  53:29  

I have a quote from you that I think is pretty apt to given this statement that you just kind of made about the change in how security is being delivered. So security is no longer a product or a workload nor is it a service, it's how people prioritize and utilize assets available to enable organizations to achieve more.

Vishal Amin  53:47  

Yeah, that's a lot simpler for me to explain is when we started looking at security as Microsoft as an Azure product, as somebody that protects workloads and identities and computers, we're looking at it as products. When I look at people that are actually protecting the warfighters and protecting people, they've got these security operations centers that are made up of products that are made up of services, but it's the human looking at, you know, these files, these data points and doing the assessment and evaluating the risk. And that's the way they're doing it. That's security, right? The actions that the human is taking, that is security, right? In its essence. 

And we need to enable them with the tools, the services, the products, and surround them with what they need to do that security work. The security work is can't be replicated, it's done by humans. Even when we build our security products here at Microsoft, it's not to solve 100% of the problem. It's to solve 90% of it so that the humans can take care of the 10% the most important, the most relevant, you know, issues that are in front of them, right? And the computers and the products and services can take care of all of the other stuff, right? So security is absolutely not a product. It's not a service that you buy. It's the way that people actually assess what they're doing, right? And measure that against risk and measure that against mission.

Brock Briggs  55:19  

You said that something interesting that seems kind of contrary to where I perceive like the world to be going. You're talking about, hey, we wanna make sure that this 90% is secure and really emphasize the interaction of the individual and the first people behind that. And that's playing into this backdrop of we've got things that are, like replicable without any need for any more physical labor, we have code, we have Cloud, we have all of these things that do not require us. How do you think the role of humans will continue to play into cybersecurity in the next 10, 15, 20 years?

Vishal Amin  56:02  

We've got millions of jobs. I think 4 or 5 million jobs that are gonna be open and unfilled in the cybersecurity industry by 2025, I think was the last report. It's not that humans are not needed. There's more and more signals, right? I mentioned the 43 trillion signals a day we see at Microsoft. Last year was only, I think, 20 so, 21 or 22 trillion signals a day we saw. It does mean more and more data and more telemetry for us to cipher through to go look at, right? So we have to be able to build automation and AI and machine learning into our processes so that the people can continue to do their jobs. If I give someone more and more data and more and more signals, they're just at capacity already. There's always gonna be a need for these people, there's always gonna be a need for more individuals that focus on cybersecurity. 

And I think skilling is one of the biggest aspects of that. The reason that we have this gap in jobs is we have to be able to skill people at the level that they're at to bring them into the cybersecurity industry. The cybersecurity skills gap is just gonna get larger and larger and larger because cybersecurity is becoming, if not already, one of the greatest aspects of nation state attacks of conflict out there internationally. Look at the war in Ukraine, you look at some of our current conflicts, you look at operational technology and how critical infrastructure is affected by cybersecurity. There's gonna be more and more attacks, more and more threats to what you and I feel are important. Not to mention, the criticalities of water, air, power, right? Those types of critical infrastructure missions are already affected by cybersecurity, not to mention other things that are gonna be important to us in the future. 

So yeah, we need more and more people in this industry. And I think what we have to do as a cybersecurity company at Microsoft is find ways to bring people in and align them to our innovation, right? And align them to our mission moving forward and scale them appropriately so that they can come in here and build and protect and do all those things. So this is I don't think this is gonna be a robot eat robot world, right? I think we're always gonna need people in here to make those decisions. Even when you're speaking about drones and you're speaking about autonomous vehicles, behind those autonomous vehicles behind the decisions that we're making, there is still a person back there doing it, right? We're just automating some of those tasks to reduce risk. And I think that's how I look at cybersecurity as well.

Brock Briggs  59:03  

What do you think are the relevant skills, degrees, certifications, things that people ought to be thinking about and looking to make considering maybe a career in cybersecurity or even not necessarily specifically, cybersecurity, but maybe an adjacent field. You talked about how cybersecurity is gonna be part of all these other things. It's not just a product.

Vishal Amin  59:27  

Yeah, I love this question. I'm a political science major from a state school that didn't get into cybersecurity until probably six, seven years ago, right? What we need people to do is we need people to come into this industry from the diverse backgrounds. We don't need another. Though we do need another engineer and we need the folks that know IT and digital infrastructure and physical infrastructure. We also need the doctors, we need the lawyers, we need the undergrads, we need the athletes, we need the veterans, we need folks from third world countries, we need folks of different races and just diversity in every single facet, right? We need folks that don't love cybersecurity that look at it critically, folks that think it's an enabler, folks that think it's a distractor. We need diversity. 

And that's what we need in this industry. If you look at what we're doing in cyber in a different realm and a different way than the current person looks at it, that's what we need. Because when I spoke about it earlier, when we start thinking about threat actors and we start thinking about nation state actors, that's how they're looking at attacking us in different ways, different facets, different avenues. If protecting others and enabling others and securing others is something that keeps you up at night that you're passionate about. And you have a diverse background, or if you don't if you have an IT background. That's the heart of it, right? Is this something that you can stand behind that you're invested in, that you're passionate about? 

We just hired somebody on one of our teams. And he doesn't have a cybersecurity background. He's a veteran of I think it was 14 years. And he was a government employee. He didn't retire from the service. And a couple of years ago, he approached us and he said, I'm not a cyber person, I'm not a tech person. But cybersecurity is affecting the way I'm doing my job. I'm being asked to investigate a lot of cybersecurity things, digital crimes. They're affecting the way of life of the people I'm working with at this government agency. And he was an athlete in college. He was an athlete. He still does a couple things in that realm. He's said I'm just really passionate about this. I think this is the next big thing. And it gets me excited getting out of bed, thinking that what I do right now is defending against that next nation state actor, from Russia, from China, from Iran from some of these nation states, out of the 20 some odd nation sees that we recognize. 

And I said, well, if you're really passionate about it, you know, go take, go after your CISSP, go after this Microsoft certification, go learn a little bit about Cloud. And then give me your perspective on your background and what technology is and how you look at it. And when we interviewed him, all my technical folks said this person is probably not the best fit because they're not technically savvy. They think this acronym means this. They think Cloud is XYZ. And then I had some folks on the other side of our business that were more people, individuals. And so this person actually can walk into a room and have instant credibility. Because they're a salt of the earth type of person. They understand the customer, they understand the government, they understand what's really a priority in their mind. And they're simplifying all this technology stuff. 

And now I share that story with people because I say this person wasn't a technology person. And he was brought on to our business. And he's doing amazing because he's asking questions that we don't usually ask. He's addressing problems differently. It's because he came from a diverse background. So to answer your question, there's many certifications you can take in any and all certifications on the technical realm. They're important. Yeah, you know, get your SEC plus, go understand some of these languages like AQL, go take certifications at these Cloud companies. We have the AZ-500. We have the AZ-900. We have the SC-900. We have those AZ-900 at Microsoft and take those certifications. 

But the differentiator is relate that certification to your unique perspective on industry, on your background and who you are and bring that conversation to the table and that's what's gonna get you a job in cyber. Those are the types of people we're looking for, people that think differently, that act differently, that can challenge how we look at things now.

Brock Briggs  1:04:36  

Speaking to your position, kind of overseeing all federal and looking at that more holistically rather than just cybersecurity. Specifically, what do you think is the biggest challenge facing you and your team today?

Vishal Amin  1:04:53  

For me, so I look over the entire security compliance identity business for all Microsoft federal defense and the largest challenge we have today is or the largest challenge I have, in my own mind is how do you retain these amazing, talented people, not just retain them, but empower them to be able to get out of bed every morning and be excited about what they're doing without being burnt out. And that is a challenge I will always have. And I'll continue to have because I'm very critical about the work that we're doing. There's so much to do. There's never a day of, hey, I have only one meeting today or two meetings today or three engagements today. I think in our industry now, we're back to back to back side to side to side all day long. And being able to force them out of role and move the nozzle and move maybe their workflow into, hey, today, let's focus on something that you're passionate about. 

Let's spend some time outside of the cyber world. I think, getting people to take time off to work a little less and direct their time to something that they love, not just take time off, but go volunteer, go get those goosebumps somewhere else, you know, outside of cyber, that's the biggest challenge. It's the folks that burn out that stand that start looking through that soda straw, and that straw gets smaller and smaller and smaller. Those are the ones I fear. We won't be able to empower if that soda straw gets close, right? The goal is to open up the aperture every day more and more and more. So that is the biggest challenge. I feel we have not just in my role here at Microsoft, but as an industry in general.

Brock Briggs  1:06:57  

What have you found, I'm gonna take that like another step further, if you don't mind. What have you found is effective or not effective for carrying out what you just said that you are trying to do?

Vishal Amin  1:07:12  

I think what's not effective is strictly pivoting people and saying go invest your time in something you love. To get maybe your mind right or to refill your bucket and then come back. That's not necessarily effective, though it may work, it's not effective. I think you have to be able, what's been effective though, is to empower them to tie something like that back to the business. And what that effectively means is if you can tie in a purpose, a passion back to the business and back to those leaders and have them invested in that as well. So that they say, hey, we're only gonna volunteer for or I'm gonna invest some time in our team to volunteer for 48 hours this month. 

And this is the box we're gonna volunteer in and then give them, give your teams the room to go do that. And then bring them back and incorporate that into the business rhythm, right? What that really does is that's building a culture. And I think that's what makes it effective just by saying go invest time in something, go, you know, you love dog walking, so go walk your dog, and every meeting you have all day every day, and you're gonna be a happy person. That doesn't work very well because now all of a sudden, our sense of maybe dedication to our jobs and to our work and what we have to do and our professionalism may decrease a little bit. But by empowering them to do that and then asking them, hey, maybe once a month, we do maybe once a month, you know, we do a nonprofit for every something that everyone's tied to here. So all of us go do it together, all of us go do that here. 

And then we come back, we talked about why it's important to us. And then we move to the next person. You're tying it back to the culture, learning about each other, learning about other people. So it's not just you investing in what you're passionate about every day, every month, but you're learning about what other people are passionate about, what makes them tick. So it's a thing, it's a cycle, right? You're learning about others, you're understanding what makes them tick, you're understanding what makes you tick. You're bringing that back to the business, you're bringing that back to the people and you're building that culture, right? So the first part doesn't work. But if you tie it back to the culture of your business, that's when you start seeing the success and the retainment and that sense of culture that people love.

Brock Briggs  1:09:37  

The people and the companies that are differentiating themselves now are doing so in a way that encourages people to work on their side projects. I was just listening to an interview the other day with the founder of Andriller and he's talking about how they have like they give their employees and allowance to like work on their side projects and stuff. Like they are like, relentless about empowering them to like, have that thing that's like, kind of related to work, but like kind of not. And to like kind of keep that fire up so that they're not just hitting burnout and quit basically.

Vishal Amin  1:10:18  

The best organizations ever. We just finished a hackathon. We have a global hackathon at Microsoft, which allows you to create a project and work on it and use and people from all over the world at Microsoft can join and get in on that project. If it's to solve community hunger in the veteran space in a county in Texas. You can create a hackathon project to go work on that and find ways to mitigate that and power that community, right? So you're right. It’s not just the best companies that allow organizations or their people or organizations to do it. I would push back a little bit. It's not the company, it's the people, right? It's the CEOs, specifically, like you mentioned, that not just allow their employees to do it, but they do it themselves. They invest time in it. And they're the ones who actually go in there and take the time to go do the work and be part of those projects, right? Also getting their hands dirty.

Brock Briggs  1:11:26  

Yeah, I like that. It's the people. I love that emphasis. Vishal, I have two more questions for you one of them. I'll start with this. What is the question that I should have asked you today, but didn't?

Vishal Amin  1:11:41  

The one thing that you, there wasn't anything that you didn't ask? I think today, I think we spoke about a lot. The one thing that I would add, though, what work am I passionate outside of cyber and outside of the military community that I invest time in now? And I spoke to that a little bit, but what is it that keeps me going? And I think the answer to that for me, stems around my work with the Travis Manion Foundation. And involving myself with organizations that have a mission that serve even a non tangible purpose, like strengthening the character of an entire community. If you ask me what gets me out of bed in the morning, it's not just protecting the data and the people through the means of cyber. 

But it's building a legacy that instills character and kindness and just doing good, right? For the people around me, like my kids and my family. And I think that's at the end of the day, right? That's what gets me out of bed. That's what I want to do day in and day out is give back to those types of communities. And you get hundreds of people calling you every day, whether it's for a job, whether it's for an opportunity, whether it's for mentorship, all of us do, you do, I do. And it's hard to connect with every single person. But I'll tell you, if when someone connects with you at that personal level because they are invested in the same things you are, they're passionate about those same things and they can emotionally connect with that level. 

There's that sense of connection there. And that's what I look for. When I connect with people, I look for that connection. And that's what drives me outside of Microsoft and outside of cybersecurity, it’s the ability to just do good for others, has nothing to do with being a veteran, has nothing to do with cyber, has to do with the feeling you get when you're empowering others and I think that's the one thing I would add. In everything we spoke about today, that's probably the most important thing.

Brock Briggs  1:14:05  

That may dovetail into my second question. So I might have ruined the second part of it. But my final question for you is what can we learn from you that we can implement today?

Vishal Amin  1:14:20  

Act, don't react. I think that's the one thing you can learn, not just from me. I've learned from my mentors and my sponsors and the people around me is act, don't feel like you have to react, don't react to you exiting the military, don't react to the bad news. Act on it, right? Act from it, use that data and those points to that platform to jump off of, right? Believe in yourself when you do that. So very simply act, that five words I tie it back to the Travis Manion Foundation and I think this will be good is Travis spoke five words: If not me, then who? If I don't do it, someone less willing, less able will have to. Before he gave his life, saving his Marines from a sniper and those are the five words that drive the Travis Manion Foundation. Those are also five words that I share with my team and lead with. And the core of those five words are take action, right? It's up to you to take that action and make a difference. If you don't, someone else will. And they may not be as passionate. They may not be as driven. They may not have the resources you have. So if not me, then who, right?

Brock Briggs  1:15:46  

Awesome. I love that. I have had a lot of big time supporters and fans of The Travis Manion Foundation. They do a lot of great work. And that may kind of feed into this next thing. It's not really so much a question but a request. How can me and the listeners be useful to you? Is it going and supporting the Travis Manion Foundation or otherwise?

Vishal Amin  1:16:14  

I think the one thing most listeners can do is watch these podcasts in their entirety and or listen to them on 2x speed. It doesn't matter what you're done. When you're done, physically write down one thing that you're gonna act on and go put a note in your calendar for next week. And ask yourself if you did it. And if you did it, put something else down and act on it, right? I think that's the one thing I can share and for the transition veterans on this call, right? Just follow the industry, follow the people, look at their actions, look at what they do, look what they speak about. For the seasoned veterans and the folks that listen to make a difference, go invest in something that you're passionate about. 

But after you listen to this, instead of saying, hey, go invest in the Travis Manion Foundation, go tell people about how great a career in cybersecurity is. These are all things that are gonna stick in our back of our head. Get a piece of paper out, get something out, write it down and say I'm gonna connect with three people by next week. Line line line and go out, go do it. And ask yourself, what did I gain from that? What did I not gain from that? What am I gonna do with that, right? So you know, I'll leave it at that is do something like that on the back of that and that's how I think this community and you, Brock can help evangelize that message.

Brock Briggs  1:17:50  

I love that. That's definitely something doable. Vishal, I really appreciate your time today. Thank you so much for sharing with me.

Vishal Amin  1:17:57  

Awesome. No, thanks for having me. This has been so much fun.