Wim Remes

Transcript is automatically generated and may contain errors.

[00:00:00] Chris: Hello, and welcome to the imposter syndrome network podcast, where everyone belongs, especially those of you who think you might not. My name is Chris Grundemann and I'm here with my co-host Zoe rose. 

[00:00:18] Zoe: Hey. 

[00:00:19] Chris: This is the Wim Remes episode. And I think, uh, you're really gonna enjoy it. Wim is the managing director Damovo Security Services for EMEA

[00:00:32] Chris: Wim uh, hello, how are you? Good. How are you guys doing 

[00:00:35] Chris: very well. Thanks for being on the show. Do you want to, uh, introduce yourself to the folks? 

[00:00:40] Wim: I I normally go with, uh, I'm, uh, Wim Remes and I stop there, but I guess that's not sufficient for the show. So I'm a security professional based out of Belgium.

[00:00:49] Wim: I've worked as security consultants for more than 20 years and generally in IT for, uh, over 25 now. So, I guess that means I'm, uh, old mm-hmm well, I think one of one of the topics that, uh, immediately leads to, uh, conversation is that I've never chosen between going into management or taking a technical role.

[00:01:10] Wim: So while my career really started in a technical role, at a certain point, somebody told me I was meant to choose between an executive part or an, uh, individual contributor technical part. And I vow that I would never make that choice. So I, I do lead the security team for, uh, Damovo in EMEA but at the same time, I'm still doing engagements and working with customers on different technicals as well.

[00:01:34] Chris: Oh, awesome. That's really cool. I think there's probably quite a few people listening who will be thrilled to hear that you don't have to make that choice, at least not completely binary. Ha have you gotten, I'm assuming maybe you've gotten some pushback along that, you know, through the years, different companies or different organizations had a problem with you kind of trying to stay technical as well as managing people or has it been easy for you to do that?

[00:01:54] Wim: For me, it's always been easy. Um, well, I wouldn't say always I think there was a point where I was really regarded as a technical profile, but as people were drawn to me, and I think also due to my engagement with ISC squared, where I've been on the board for six years, people kind of recognize that I was both things and I didn't wanna compromise on, on either of them.

[00:02:18] Wim: And then they just went with the flow and gave me the freedom. Find my path and find my balance in those two things that I love very much. 

[00:02:26] Chris: Yeah. And I noticed that even on your Twitter profile, you kind of list information security and people person are, are two of the kind of headers there. And I think that plays into what you're saying now, right?

[00:02:35] Chris: With, you know, wanting to do management as well as dive into security. I think, you know, some folks who have a cursory knowledge of information security, and those of us who work in it, may think that being a people person and being in InfoSec is a bit of a dichotomy. And you're obviously walking right down the middle of that line there.

[00:02:50] Chris: What do you think about that? I mean, is InfoSec full of weirdos or are we, uh, are we easy to manage? 

[00:02:55] Wim: InfoSec is definitely full of weirdos, but they're all very nice weirdos. Obviously there there's probably some exceptions, uh, but I don't come across those very much. So in general, I can say InfoSec is full of nice weirdos.

[00:03:08] Wim: Now, the word people person, I, I didn't even remember that I put out in my, uh, uh, Twitter profile but there's a lot of people that say, especially project manager and old school manager that say they are people persons, but in the end they go back to the numbers and they don't know how to do situational management.

[00:03:27] Wim: Like really understanding a person. And finding out how their success can be your success. Right. I spend a lot of time, maybe a little bit too much, like really, really caring for people. And I think that's maybe in InfoSec or in, in a community, I think it's actually very prevalent. I think it goes very well together.

[00:03:49] Wim: The humongous responsibility that a security person has and in, in general security people care for the world, right. They want to make a better world. And that also means caring for people.

[00:04:01] Zoe: I think that's a really good point. I've just recently started looking into that situational leadership management style.

[00:04:07] Zoe: So that piqued my interest that you do a lot in that, because I think when it comes to managing people and only paying attention to the outcomes, you forget that being effective has to have that fluctuation of highly effective on this day. Maybe not as effective the next day. You have to have that balance.

[00:04:25] Zoe: So that, I think for me, that's, um, really, really important is dealing with security, but also dealing with the people behind that. I did have a question about how you found your path that way. Like, uh, was it, you got into security because you liked the security or was it you got security cuz you wanted to solve problems or maybe you wanted people.

[00:04:47] Zoe: I'm not sure. 

[00:04:48] Wim: That's a very good question. And the almost answer is. I really don't know but I can track back how I ended up being the security guy. I was, um, like a windows, uh, network system engineer, um, back in yearly, two thousands. And I ended up, uh, on an engagement with a client that had a bunch of firewalls and switches antivirus, but nobody was managing it.

[00:05:10] Wim: So I automated the shit out of, uh, the, the windows and networking stuff. So I can put more time in the thing that, that I found interesting. And that's how I ended up. I was a consultant back then, uh, and the company I was working for didn't do any security services and I ended up being the security person there and then developing.

[00:05:29] Wim: The security business, uh, for them, uh, basically going into penetration testing, developing, uh, managed firewall services, all that jazz. That's how I know I ended up in, uh, security, but I think I told a story, uh, recently. So somebody else as well, very early in my career, I understood that in IT and especially in security, I would always make enough money.

[00:05:51] Wim: Right. I mean, not loads of money, but I knew that I would make an income that, uh, could sustain a family. At that point. I focused on having fun and learning new stuff, and that basically made me choose my parts. If I wasn't having a lot of fun or not learning a lot in a, in a certain role, I would switch to another company or another role within that company.

[00:06:15] Zoe: That's a good point is, um, a lot of times people complain about, well, you're only motivated financially, but the key thing for me as a, as a mom is, well, yeah, of course I'm motivated financially. I need to support my family, but also finding the enjoyment on top of that is quite key. So it was almost more of a natural kind of progression. Previously, um, other people we've spoken to, they've said, they've come into situations where they realized. Quite quickly, oh, this is not an area I want to go down. So it was maybe a not as fun experience or a mistake had happened that kind of helped direct their career. Do you have sort of similar situations for yours?

[00:06:54] Wim: My life is not full with, uh, regrets, so I, I don't look on, on anything as a mistake, right? The way I look at things is that I made the right decision based on the information that I had at that moment. And maybe two, three years later, that choice may not have been the best one with what I know two years later, but I didn't have that information.

[00:07:14] Wim: So it definitely, wasn't a mistake. There are probably some things that I, uh, would've done differently. But I think overall I've been pretty lucky with the, with the mistakes I've made. 

[00:07:27] Chris: Yeah. That makes sense. And I, I like that idea of kind of following what's fun and what's interesting. And what makes you learn?

[00:07:32] Chris: That's definitely something that I've leaned back on or, or found as a kind of a rock when I was in tough situations is, you know, if I'm learning something, then this is worth it. Right? And then when that question becomes, no, I'm not learning and I'm not having fun. Well then to your point, right, maybe it's time to, to move on and find something else.

[00:07:50] Wim: Exactly. And, uh, you probably had some managers that talked to you that said you have to look at all the opportunities that we're giving, right? 

[00:07:58] Chris: Sure. Yeah. 

[00:07:58] Wim: You probably met some of those managers. Uh, and some people have said that to you, but the, the reality is that opportunity is basically a, a river full of fish.

[00:08:07] Wim: Right. And you're standing next to the river and somebody put you next to the river, but you're still taking the fish out of the river. It's you that is taking that opportunity, right? And that's why I think everybody's very much in charge of their paths to take opportunity or at a certain point. Uh, for instance, when I became a father of twins, I had a, a period in my career where I decided not to take opportunity and focus on what was important then.

[00:08:37] Chris: Yeah, absolutely. 

[00:08:38] Wim: Just before the recording, we were having some, uh, back and forth, and I thought about my favorite poem and it, it always comes back and it came back today as well. Now I probably have to, uh, quote the, the part of the poem that I, um, mentioned if that's fit for the podcast. 

[00:08:57] Chris: Yeah, sure. 

[00:08:57] Wim: Yeah.

[00:08:58] Wim: Um, I dunno if you know the poem Invictus?

[00:09:01] Chris: The word sounds familiar, but I don't know. Yeah. Why don't you lay it on us?

[00:09:04] Wim: It's well, it's, it's also a movie about Nelson Mandella's life that it's a poem by William Ernest Henley and the last paragraph goes, 

[00:09:14] Wim: It matters not how straight the gates, how charged with punishments the scroll. I'm the master of my fate and the captain of my soul. 

[00:09:22] Wim: Which for me like means everything. It doesn't matter how bad things are, are getting. I'm always in charge of my next choice, right? Whether that's professionally, personally, financially, mentally, anything. 

[00:09:38] Zoe: That's a really good point. Actually, the way I was raised, it was looking at mistakes as a bad thing.

[00:09:44] Zoe: And throughout my career, I always ended up in those situations where I realized, oh, that was probably a mistake. But that point you made about actually, that was, I made that decision based on the information I had at the time. And so almost forgiving myself for making that mistake was a really hard lesson I had to learn, but I like the, the captain of your own soul or the choosing your own direction and acknowledging those.

[00:10:08] Zoe: Learning experiences along the way actually are helping you in the end, especially when it comes to security. 

[00:10:14] Chris: Yeah. It ties together, right? I mean, that idea of, if you know that you're gonna be able to forgive yourself for making a mistake, it allows you to be a much more bold captain, I think, or to be much more, you know, taking that responsibility on without the fear a little, I mean, there's always gonna be some fear there, I guess, but you really can kind of charge ahead and, and make your own decisions because you know, you're doing the best you can with what you have today.

[00:10:34] Wim: Exactly. 

[00:10:35] Wim: Yeah. 

[00:10:35] Chris: Awesome. So speaking of that, you've been doing this now for, like you said, 20, 25 years. We won't try to date you too closely, but along an illustrious career, for sure. Including, as you said, right. Six years on the board at ISC squared, which is, you know, anybody who's around InfoSec at all kind of knows of at least the CISSP certification.

[00:10:52] Chris: And some of the things that, that ISC square does. So I wonder at this point, right. Are there times where you ever feel like you don't belong? Does it, does imposter syndrome creep up on, on Wim from time to time? Or are you past that? 

[00:11:05] Wim: Constantly. Uh, still now, since you mentioned, uh, is square the first time I really belonged or I felt I really belonged in, uh, security or I felt like a security professional was when I got my CISSP back in 2006.

[00:11:22] Wim: That sounds very dumb. And it's also the one reason why I still hold onto the certification. It's also why I was so eager to engage with the organization back in 2012. But I was always working with people that were highly educated. They had master degrees, doctoral degrees in IT computer science. Uh, and I was always the, the little uneducated guy that knew a thing or two about security.

[00:11:48] Wim: And when I got my, uh, CISSP for me, that was back in the day, that was confirmation that I, I was finally a security professional. I was, uh, on equal footing with the other people. Other than that throughout my career, there is this community and Twitter or InfoSec Twitter, right. Where we all including me are trying to belong.

[00:12:09] Wim: But that's not real life. If you are working with customers on a daily basis, they are not on Twitter. They don't go to security conferences. And that is the majority of security professionals are not on Twitter. Right? So whatever you feel you have accomplished by a number of followers or presentations you've done at DEFCON or B-Sides or whatever.

[00:12:29] Wim: It doesn't mean Jack. When you face customers and you have to prove yourself. On the work for obviously there are lucky people that become evangelists and advocates and go into marketing basically, and they can make that their life. But that is a subset of people. If you are somebody that is working in an operational team at an organization, or you are a consultant, you have to prove yourself every day.

[00:12:53] Chris: Yeah. And, and I think that ties into another, I guess, quote, I saw on your Twitter profile, which I don't know how to say it, but I think it's Ubukhulu Abubangwa. Something along those lines. 

[00:13:04] Wim: Yes, I, I have it as a tattoo as well. Uh so, yes, I often put stuff on my body that I think is important for me. It's, uh, it's a Xhosa saying, uh, Xhosa is south African language and it means greatness is not achieved by demanding it, which again, I think people have told me before that I'm more profile of a servant leader and it just means leading by putting hard working.

[00:13:30] Wim: I strongly feel that in a reputation is never earned or, or it's always earned. Right. It's not given even if you feel, or people say that you made it, you're still having to put in the work to prove that every day. 

[00:13:43] Chris: Yeah. So that all relates to me. I mean, I think what I hear you saying right, is this idea that kind of fortune favors the bold, and you've gotta kind of put yourself forward and make those decisions, take those opportunities out, but you've gotta keep doing it and telling people about it.

[00:13:55] Chris: Isn't enough. You gotta really just keep putting the work in. Yeah. 

[00:13:58] Zoe: Yeah. And that point about the Twitter followers is I think sometimes getting into the industry, you kind of get lost in the, well, this person has a big following and they look so successful. I'll never be that, or I'll never actually get to that point.

[00:14:14] Zoe: And I have no idea how they get it because they only see the successes and they see the social media view of their life. They don't see the failures or the hard work. From kind of understanding your profile and your focus on actually the realistic parts of security and the people and how important they are.

[00:14:31] Zoe: I imagine you do quite a bit of mentoring and potentially you have some advice on people looking to get to where you are, or maybe start their journey on getting to where you are and what would you kind of point them in the direction of. 

[00:14:46] Wim: I definitely wouldn't recommend them, uh, going where I am. just because I still work like 12 to 16 hour days across multiple time zones, mostly because I choose to right.

[00:14:57] Wim: It's not that I expect other people to do the same thing as me, but I think if I look back at my career, I cannot pin down one single mentor that, uh, I've worked with throughout, uh, 20 years. And I feel that with, uh, people that, that I mentor as well, there is an end stage to a mentorship because basically the, the knowledge is transferred and you can still remain friends, but there is no real mentor, uh, relationship anymore.

[00:15:26] Wim: When we think about mentorship, there is two things I find very important. The person that is the mentee. Right. Needs to take the initiative. It's not the mentor that can spoon in the knowledge and give IDs. What I usually do is it gives certain pointers, gives certain things to read, to play with, to develop a certain skill set.

[00:15:48] Wim: And that can be very technical use burb to go to this application and see what you can find. Or when we talk about more like soft skills, try to sell me this kind of Coke, right? Convince me why, why this kind of Coke is important, but in the end, it's the mentee that needs to ask the questions that the mentor is responding to and not the other way around.

[00:16:13] Wim: I think it's more a pull relationship from the mentee than it's a push relationship from the mentor. 

[00:16:18] Chris: That resonates for me, for sure. I, I know I definitely screwed that up at least at once, probably multiple times, but at least once where I, I, I found this gentleman who, you know, I really looked up to and had done some really cool things and was, was putting out some really smart work.

[00:16:31] Chris: And I went up to him and asked him, Hey, wait, will you, will you mentor me? And he's like, sure. And then I kind of waited for the, for the mentoring to start and it never did. And definitely understand that that was my failing, not his, but I, I just didn't know. Right. That how, how to be a mentee. And I, I think that's really important what you're talking about that, uh, this is an active kind of pull relationship that's needed there to make it work.

[00:16:51] Wim: Yeah. And what, what I find super awesome about the security community, if there is a topic that you want to learn more about, and you know that somebody's an expert in it, you can easily reach out to that person and they will always make time for you. I've never had a person tell me no buzz off or whatever.

[00:17:09] Wim: There's always time to share knowledge. 

[00:17:12] Chris: Yeah. And I think that's important too, right? Is that this, you know, mentoring can happen. It can be a one time thing where you've asked this question and get an answer, or it can be an ongoing relationship that maybe last weeks, months, or, or even years. 

[00:17:23] Zoe: And I think it also from my experience, cuz I do mentoring, but I do also think it's very important to receive mentoring, which I have throughout my career.

[00:17:33] Zoe: But one thing that I've tried to look at is people that maybe I wouldn't typically look at, like maybe they're in a different career or maybe they have a different expertise because you can get mentored on. I mean, I wanna be maybe I wanna be the most technical person ever, but I also need that soft skill.

[00:17:51] Zoe: Because actually that's more difficult in my opinion, uh, to develop. So finding people that they're not going to give you the mentoring of all of the technical things, but maybe they'll give you the professional development. I think that doesn't sound as sexy as learning all the high end technical stuff, but I think it's also just as important.

[00:18:09] Wim: Yes. And that, that reminds me of something that I've always looked back to. As one of the, maybe smarter choices I made, I was working for a, a quite big oil company, uh, a US based oil company that had an office in, uh, in Belgium. I was, uh, working as their first line help desk person. And my colleagues always jumped when it was a VP or some manager that had a problem, but never when it was a secretary or somebody in HR or, uh, or whatever.

[00:18:37] Wim: And I all treated them equally. Right. And my, my base philosophy there was that I can learn as much from that VP that is sitting in that corner office with six windows or that person in HR that's, uh, somewhere in the basement. And I always spend time with people to learn what drives them, learn how they work and see how I can use my skills to make their work life better.

[00:19:03] Wim: That's something you always have to take into account. No matter who you come across or you who you get to spend time with a side note, that time is probably the most valuable thing that we have. Uh, and whoever decides that their time is worth or, or you are worth spending their, their time with is something that we should value, right.

[00:19:23] Wim: But every person that we come across, uh, we can learn from whether that's some random you, you see in a shopping suite and happen to have a conversation. Just a few weeks ago, I was in Ireland and as it goes in, in Dublin, it was like 2:00 AM. And I came across a person that, uh, turned out to be a, a harpist from, uh, from Spain.

[00:19:45] Wim: And we maybe spent, uh, half an hour together, but I learned a load from, from her. And that's what you just should do. I'm probably the least social person. Everybody thinks I'm a social butterfly, but I'm actually very much an introvert, but I made it a task for myself to, to engage with people and actually spend that energy to, to learn from people.

[00:20:05] Wim: Because anybody you, you are allowed to spend time with, you can take lesson or two from. 

[00:20:10] Chris: Is that related to, I've heard you say that kindness scales. It seems to me that those two things might be related, right. That, you know, by giving this kindness, you almost receive this education in return. Whereas if you walk into it with unkindness, then you're probably not gonna learn from that person no matter who they are or what they know.

[00:20:26] Wim: Yes. So now I have to, um, do proper attribution, uh, kinda scales is something that was set on Twitter if I'm not mistaken by, uh, Dan Kaminski who sadly passed, uh, last year. And he was like a rock star in our community. Right. But at heart, if you were like one on one with him, he was also the kindest person. And he strongly believed that if people put their heart into what they're doing, um, that kindness would improve things on a global scale.

[00:20:58] Wim: So if everybody was a little bit more kind and put their heart into one or two projects, obviously you're life and your priorities are what they are, and nobody's expected to sacrifice their life for public good. Uh, but if you can even spend like half an hour in a soup kitchen or developing some open source code that, uh, can assist journalists or threatened populations do that.

[00:21:20] Wim: And the world would be a better place, which is what I think we all try to achieve. 

[00:21:25] Zoe: I think that really goes to security in itself. I mean, our goal is to protect, you know, our goal is to make things more secure, but I think one thing that was missing when I started my career was that focus on the user experience and the relationship building, because.

[00:21:46] Zoe: Traditionally security tended to be quite a scary thing where you'd have to admit you did something wrong, maybe clicked on a link and go to the not so nice person. And they yell at you for a bit and then they resolve it and then you go away. But I think over the years, I like to think that's changed.

[00:22:03] Zoe: And I, I think what you're saying here is that that's really kind of the key to success, or at least I, in my career, I, I viewed that as well as being that kind person. So people feel safe to talk to you. And actually want to listen to what you are saying as well. 

[00:22:19] Wim: Yeah. You're basically that Southwest, um, air hostess, uh, making a funny speech about, uh, how to stay, save on the plane, but that 24 7 as a job.

[00:22:31] Wim: I also think back on, uh, conversation I had with, uh, Aaron Leverett. Who's a, who's a good friend of mine and probably one of the smartest people I've ever come across. And he compared the cybersecurity community culture to the circus culture. He was very involved. He's a, he's a magician. He even as a published magic tricks, he's, he's just amazing.

[00:22:51] Wim: And I spent way not enough time with him, but what he mentioned was that if in a circus, right, there is a team working on the trapeze and there is a new person joining. They have every incentive to teach everything they know to that new person, because if they don't and they hold information back, then that person might die or they, that person might lead to somebody else getting hurt.

[00:23:13] Wim: Right. And in that sense, it's very similar to information security, the more knowledge and information we share across each other, the better we all get. And obviously now in business, we all have to work with NDAs and there are, uh, a lot of things that hold us back, but we all have our back channels and signal groups and telegram groups where we freely share knowledge with peers and people that we trust.

[00:23:35] Wim: Right. That's something that we need to continue doing. If we stop doing that, then security will collapse as a, as a tree. It's only by sharing knowledge, uh, not, not only among peers, but also with people that are new to the industry. There will always be enough work. There's more than 4 million people short in cybersecurity.

[00:23:57] Wim: I am not threatened by a new person when I give knowledge to them.

[00:24:02] Zoe: I can't remember who it was said, but somebody, uh, a while ago I remember them, maybe it was at a conference or something. And they said sharing knowledge raises the bar of security across the industry. And that's like, what's important is raising the bar across.

[00:24:17] Zoe: To stop malicious actors and to stop even accidental. I think that that point of, you know, if you are hoarding knowledge you in my, in my mind, you become, uh, liability you're, you're not successful. Hoarding knowledge makes you a risk to the organization actually. 

[00:24:34] Wim: And a single point of failure, 

[00:24:36] Zoe: hundred percent.

[00:24:37] Zoe: Yeah, nice. I like that. 

[00:24:39] Wim: But that, that goes within an organization that goes within, uh, your local info community that goes globally. And there, there will always be forces that try Tottle that information, but information wants to be free. Right. So that's the basic point to start from. And we can only commit to, to sharing as much as we can.

[00:25:00] Chris: Awesome. Well, we appreciate you sharing all of your knowledge, uh, or maybe not all of your knowledge, but some of your knowledge with us here today. I think that's all the time we have. Is there anything else that, uh, we should point folks to? I mean, obviously we've talked about Twitter a little bit. We can link to your Twitter profile, maybe your LinkedIn profile.

[00:25:17] Chris: So folks can reach out if they do want some point in time mentoring maybe. But what other projects are you working on? Where else should folks look to see kinda what you've done? What you've written? What, I don't know, where, where you've talked, anything that would be worth, uh, folks looking up. 

[00:25:29] Wim: People can always reach out to me on Twitter.

[00:25:31] Wim: Uh, my DMS are open, so doesn't need to be like a following relationship to reach out to me. There's a lot of things in the information security business that, uh, frustrate me. One of those for instance, is, uh, anything around third party verification. I believe we, we can do much, much better at. Again, in the same, in the same vein, the way the tools are built right now are within that subjective, uh, relationship.

[00:25:55] Wim: Right? The big company does a verification on a small company while I believe if you're a big company and you want to do business with a smaller company that maybe cannot, uh, or doesn't have all the knowledge and resources to. Implement the security, the way you want it, you need to be able to support them and pull them up rather than push them down and telling them because you're, you don't, uh, have your ISO certification.

[00:26:18] Wim: I, I will not do business with you. Right. I'm thinking a lot about. How we can do those things better. There's not like a single project that I can point in as that's what I'm working on right now. 

[00:26:29] Chris: Okay. Yeah. I like that, uh, general theme though,

[00:26:34] Chris: that is it for this week's imposter syndrome network podcast. Uh, Wim thanks again for sharing your story with us and with the network. We'll share those links in the show notes. And we'll maybe have to have you back on to talk a little bit more about some of these things, cuz obviously we barely scratch the surface, I think of your career and, and some of the things you've done and some of the areas that, uh, you're an expert in see you all next week.