Cybersecurity Leadership: Why People Matter More Than Technology

Opening

[00:01] Aaron Crow: Thank you for joining me for another episode of the PrOTect IT All Podcast, where I get the opportunity and the privilege to sit across from people, even virtually from different continents, who have experiences like my guest today. Why don't you introduce yourself, tell the audience who you are, a little bit about you, and where you're at in the world. As we talked a little bit before recording, we're in two different places, which is exciting that technology enables us to have this conversation and record it.

[00:41] Swapnil Kachave: Thank you so much. This is really exciting. I really enjoy this kind of conversation, where we don't talk much about the human side of cybersecurity and careers. I am right now sitting in India, the place called Pune.

I am a cybersecurity operations manager with approximately 15 years of experience building and scaling security operations center programs across enterprise clients in automotive, healthcare, manufacturing, finance, and many other verticals. I hold a postgraduate degree in Cybersecurity and Data Science from IIM Nagpur that I just completed a couple of months ago. It complements deep practitioner expertise with strategic and analytical leadership capability. I usually work with MDR partnerships, helping produce KPIs and SLAs for different clients and translating complex security operations into board-level risk narratives.

I hold CISA, CISM, CRISC, and CEH certifications, plus several platform-engineer certifications. Right now I am working with Optiv Security as a manager. My responsibility is end-to-end security operations management for many clients at the same time. We work out of a fusion center model with clients across verticals like oil and gas, automotive, and healthcare. I have twelve-plus direct reports, and I work closely with different platform-engineering teams.

---

All Business Is a People Business

[03:09] Aaron Crow: That's awesome. It just goes to show how there are so many different avenues and factors in cybersecurity. One of the things I love that you brought out is the people aspect, and how much we do through teams. I talk about this all the time: all business is people business. It doesn't matter if you're the janitor or the CEO. You have a team, you have people who work for you, people who work above you, peers next to you, clients you have to work with and through, subcontractors. All of these things, we have to work together.

You've got certifications and degrees, other people have certifications and degrees and experiences. All of those things show we deserve to be in the room. But once we're in the room, we have to put those titles aside and ask, what is the goal we're working towards? That's the piece so many people forget. I still have to work with people no matter what their titles are.

And we don't focus on those softer skills. In your degree, they probably didn't talk about the people side of cybersecurity. They talk about technology, maybe process, but the people aspect is not something they really teach. So how are you doing that in the real world, working with people, being successful in a stressful environment where bad things can be happening?

[05:31] Swapnil: Yeah, you touched a very valid point. Though we are surrounded by different stacks of tools, what is very important to me is the people you are working closely with, because they help you through thick and thin. Cybersecurity is a challenging world.

One example I can give: alert fatigue. When your SOC team works with a newly onboarded client, the very first challenge is alert fatigue. You don't want your analysts to be exhausted with thousands and thousands of alerts. Working with people, you have to take care of them. Not only that, you have to draw a path for their career as well.

I've seen people start their career as analysts. They are not sure where they should go. It is your duty to guide them as per their interest. If they don't have any idea, you have to guide them. Sometimes you set an example. Sometimes you guide them to another person. There are a lot of different things you can do around the people, but yes, this is really important. Understanding the folks around you.

---

Career Trajectory: Drinking From the Fire Hose

[07:28] Aaron Crow: That career trajectory as well. Working in a SOC, you have a lot of folks coming in at different experience levels. There are a lot of tools, things coming in and out, different environments, different clients. How do you work through whether you're in an entry-level analyst job? How do you learn all this? The analogy we use in the States is drinking from a fire hose. There's a lot coming at you. How do you do it personally, and how do you teach your team to deal with it, to know what to focus on and not get overwhelmed?

[08:28] Swapnil: Let's start from the beginning when I started my career. Honestly, it was not a grand plan. I graduated from an engineering college in 2010 from a very reputed institute in Pune. My first role was essentially plugging in cables, configuring desktops, troubleshooting Outlook. Not very glamorous stuff. But I was curious. I always wanted to understand why things broke, not just how to fix them. That curiosity is what pulled me toward security naturally.

My first real security exposure came at ZS Associates, where I was doing endpoint security with Carbon Black, antivirus management. I remember the first time I caught an actual threat on an endpoint and escalated it. That feeling, that I just stopped something bad from happening, was addictive. I never looked back.

This was around 2013. There was no proper cybersecurity team. It was called desktop security management. Teams used to do a mix of everything: DLP tools, mobile tools like Good, Carbon Black, working closely with users on every email. So every person's career progress depends on whether they are going in the right direction. I had a friend who admired a person on the Linux team. He projected his career that way and now he's really successful in DevSecOps, sitting in Germany. It all depends on your interest.

[12:21] Aaron Crow: It's so funny. I'm way older than you, but my career was very similar. I started in the late nineties, hence the old technology behind me. That Macintosh Classic and Atari 2600 were both mine when they were new. I started in desktop administration, configuring desktops with token-ring networks and three-foot-tall towers. I enjoyed the troubleshooting. I enjoyed fixing drivers to make sure the image would work. Then I upgraded the network from token-ring to ethernet. That transitioned me into network administration, which technically was security because we were locking down environments. We didn't even call it that. We were just segmenting environments so the students in one lab couldn't get into the other lab.

My career grew because of things that I was interested in. If you look at my resume, it would look like it hops all over the place. Desktop, server, domain admin, exchange, application monitoring, security. But all those things led to me having this foundation. Now thirty years in, when something comes up, I understand how Windows works, where the drivers sit, the libraries, how networking works all the way down to routing and switching and firewalls.

It's not always you go to college, you get a degree, you go get this one job. Usually you start in a place and then you find the thing you're excited about and you dive into it. The ability to be nimble and willing to suck at something. To be okay learning and falling. Babies fall a bunch before they walk consistently.

---

The Leadership Mindset Shift

[16:14] Swapnil: Absolutely. The transition happens in layers. Most people don't realize it's happening until they look back. When I was at IBM, I was doing L1 splunk monitoring, phishing analysis, incident discussions, very execution-focused. Then I was at Tetra Pak. Suddenly I was designing security, not just doing it. I was building use cases. I was writing playbooks, helping my team write playbooks. I was aligning with the SOC maturity roadmap. We built the security operations center from scratch.

That shift from executor to architect is where leadership actually begins. And the hardest part is not the technology. It's accepting that your job is no longer to be the smartest person in the room solving the problem. Your job is to create the conditions where your team can solve the problem better than you ever could have done alone.

That mindset shift took me years. Honestly. Not a month or a year. Years. I held on to the technical work for too long because it felt safe. Letting go and trusting your team is the real growth.

[18:04] Aaron Crow: A hundred percent. As a leader, giving people the room to fail, to try things. You don't have to be the expert. You don't have to be the smartest person in the room. It's okay to make mistakes. I have three kids and my oldest is seventeen. He's going on interviews for his summer job. I'm trying to help him walk through what questions to ask the people interviewing him, because yes, they're interviewing him, but he's also interviewing them. We forget about that.

Even on the team, if I'm a SOC analyst at level one, I don't expect to be a level one for my entire career. So where do I want to go? Those are the teams I should work with. Hey, can I take you to lunch and figure out what I need to do to get from where I'm at to where you are. What experiences, what technologies, what certifications.

[19:39] Swapnil: So many people are at their mid-career professional stage wondering whether to go deeper into technology or move into a leadership role. Don't treat it as an either-or choice, especially in cybersecurity. The best security leaders I've met are people who have actually felt the pain of an incident at two in the morning. Who have manually chased the threat actor through the logs. Who understand what an analyst goes through on a twelve-hour shift. That technical empathy is irreplaceable. You can't lead a SOC team credibly if you have never lived their reality.

But equally, if you only stay technical and never develop your communication or your stakeholder management, your ability to translate a security incident into a business risk, your ceiling is going to be lower. CISOs and executives won't speak the IOC language or the TTP language. They speak in business impact, in risk appetite, in investment priority. Board members will ask, how is this going to impact my business. They are mindful of business or money.

My advice: go deep technically, however deep you can. But then deliberately build the leadership layer on top. Don't abandon the technical foundation and stand on it. That's really important.

---

Why You Get Into Cyber

[22:04] Aaron Crow: I get a lot of younger folks asking, hey, I'm wanting to get into cyber. I always ask, why. Many of them say, I hear a lot about it, you can make a lot of money in it. All of those things can be true, but they're not enough to drive you to be successful in this career or any career. You shouldn't go be a doctor just to make money. If you don't enjoy it and you're not passionate, it's going to fade.

I don't care if you understand how to configure a firewall. I can teach you how to configure a firewall. But do you have that troubleshooting skill set? A questioning attitude? Are you a team player? When I do interviews, I rarely do a technical interview. I check the personality side. Would they be a good fit on the team? I can teach somebody how to configure a firewall more easily than I can teach them how to communicate and be a team player. Those things are difficult to adjust later in life.

---

The IIM Nagpur Decision

[24:50] Swapnil: I'm a big fan of Hollywood movies and Indian movies. There's a movie called *3 Idiots*. One character is an unconventional leader who challenges rote learning and prioritizes practical knowledge over grades. He secretly studies for the sheer love of engineering. People nowadays just follow other people. People follow cybersecurity because other people are following it, just for the money. Right now people are following AI because the money is there. They should prioritize practical knowledge.

You have to build your foundations really well. I made a bold decision in the middle of my career. I went back to school at IIM Nagpur. IIMs are very prestigious in India, one of the top institutions. It came from a moment of honest self-reflection. I was a successful manager. I was doing well operationally. My teams were performing. Clients were happy. I was getting recognized. But I started sitting in executive conversations and realizing I could see the security problem clearly, but I was struggling to frame it in business language that made decision-makers act.

That program in cybersecurity and data science was exactly the bridge I needed. It was not about learning new tools. It was about learning how to think at a strategic level. Understanding data science in the context of security opened my mind to AI-driven threat detection, predictive analytics, risk modeling. And there is something about being back in an academic environment surrounded by people challenging your assumptions that keeps you intellectually sharp.

I felt very nostalgic going back to school after almost a decade. I enjoyed the process. The campus immersion program for a week, I was super happy for those five days. People came from across the globe. Someone from banking, someone from pharma, someone from a regulatory body, someone from the army, someone from the air force, all working with cybersecurity. It was the best decision I made for my career.

---

Constant Learning, Constant Building

[28:31] Aaron Crow: In my belief, we should all be constant learners. Whether that means going back to college, getting a degree, or just training and learning and building. The things behind me, they're not just props. I'm building things for certain reasons. Some are for a lab to do training, OT cybersecurity. Some I'm building to use with clients. Some are demos. I have GitLab and GitHub libraries of websites and tools that make my job easier. All of those things make me look at problems from a different lens.

If you're not building with AI or thinking about AI in some capacity, you're behind the ball. Everyone is using AI for certain things. But if you're not thinking how can I use this in my job, how can I use this to be more efficient, how can my company use this, how can we productize this, you're missing it. I can prototype a product using AI very quickly. Build a website. Build a capability. Is it ready for prime time? No. But I can prove the concept. Then I can turn the requirements over and we can build the real thing.

---

AI in the SOC: What Changes, What Doesn't

[31:34] Swapnil: AI is very powerful. It's genuinely transforming the SOC and I'm really excited about it. But I'm also clear-eyed about the risks. The exciting part: analysts are drowning in thousands of alerts daily. AI-driven triage and intelligent prioritization give analysts their cognitive bandwidth back. I have seen teams go from reactive chaos to proactive threat hunting simply because the AI handled the noise.

What keeps me up at night is over-reliance without understanding. When a junior analyst starts trusting an AI recommendation without questioning why that recommendation was made, that is dangerous. AI systems can be fooled. Not every AI is transparent. They can be biased. I don't fully trust AI with information because I can train that AI. Bad actors can also probe how to evade AI-based detections. If your team has lost the muscle memory of manual investigation, you are exposed.

AI should amplify your team. It should not replace their judgment. The human approach is really important, not only now but in the future as well. People say AI is going to replace people. That's tough. Organizations will need people to blame. If an AI model makes a mistake, nobody is going to blame the AI. We need somebody to shoulder that responsibility.

[34:21] Aaron Crow: Trust but verify. And to double down on what you said, you need to be building things that are outside your wheelhouse. But you don't just send them to production. You don't tell AI "write me a book" and just publish it. You need somebody to validate what you created, whether it's a product, a service, a script that validates things. You need a senior person who has done this before to review the output and say, yeah, that makes sense. Or wait, this is wrong. There's a bad assumption there. The math isn't right.

That doesn't mean you don't create things. It means you need somebody to bounce these things off of. That's why AI is so exciting. You can create something, then ask it to review it. Does this make sense? Used to be you'd draw something on a whiteboard and talk theory. Now you can iterate with AI until you get it to what's in your mind, then present it to peers. A picture's worth a thousand words. Imagine trying to describe what you want an application to do versus building the first version and walking people through the screens.

---

What Concerns Me, What Excites Me

[36:56] Aaron Crow: One question I always ask: what's one thing that's concerning over the horizon and one thing that's exciting?

[37:33] Swapnil: What concerns me is not a technology, not a tool, not a TTP, not a threat actor. It's the widening gap between how fast the threat landscape is evolving and how slowly human awareness is keeping up. I don't just mean end users clicking phishing links. That's an old problem. I mean something deeper. Organizations are making billion-dollar technology decisions, adopting AI, moving to the cloud, deploying automation, without a proportional investment in the human layer that governs all of it. You're racing to deploy agentic AI systems, MCP integrations, autonomous workflows to tackle thousands of problems. Somewhere in that race, the question of who is going to be accountable when this goes wrong is getting lost.

The attack surface is expanding faster than most security teams can even map it, let alone defend it. A junior analyst today is being asked to monitor environments of a complex city that didn't exist five years ago. Multi-cloud. OT. IT. Convergence. Non-human identities. And in many orgs, those analysts are still working with the same headcount, the same playbooks, the same burnout culture.

We talk about technology debt. Nobody is talking about people debt in security operations. And on top of that, we are trying to reduce people debt with the help of AI. My single biggest concern is we are building faster than we are securing. We are automating faster than we are understanding.

[39:58] Aaron Crow: Very true. When we're building, we should be considering this as an MVP and we need to go through the normal lifecycle of DevSecOps before throwing it into production and hoping it's good. These are tools. I see AI replacing Excel in many cases. You don't need a spreadsheet. I can just build a custom interactive pricing thing. But on the flip side, AI sucks at math. Excel always gets one times a million times two million right. AI is not always correct. It looks good, but in the background it might have messed up step two: the addition or the multiplication. Unless you're validating those steps, everything looks pretty and looks right but the numbers don't tie out.

That's where QA-QC comes in. I can give the same prompt to three different AIs and get three different responses. That's expected. As humans, we ask questions and stay in the ballpark. AI, if it doesn't know, sometimes just makes stuff up. It doesn't tell you it did. Especially as applications grow and we talk about vibe-coding, there may be ghosts in the system you can't find. We can't shy away from these tools. We do due diligence and understand the risks.

[43:05] Swapnil: What excites me most: AI is going to keep transforming. But the trend is going to shift from AI to quantum in a couple of years, down the line five years. The world will move from AI to quantum. It's a good time to start working with quantum as well. AI cannot help you because that requires math. You have to really be great at math to work alongside quantum.

AI is also exciting in another way. The democratization of security intelligence through AI. A well-trained AI co-pilot can sit next to a two-year analyst and say, hey, this lateral-movement pattern looks similar to a known APT technique. Here's the context. Here's what to look for next. We are essentially compressing years of experience into accessible intelligence for people who are earlier in their journey. That excites me enormously, because the next generation of security professionals doesn't have to struggle the way our generation did.

---

Degree vs Practical Knowledge

[46:46] Swapnil: I don't think a degree is going to be the most important thing. Practical knowledge is what matters. A degree can get you to the door. Practical knowledge will help you cross that door.

[47:15] Aaron Crow: Absolutely. I tell my kids the same thing. Degrees don't mean what they used to. I'm not saying you shouldn't get one, but be really mindful of why and which degree. If you want to be an entrepreneur, don't go get a business degree. Go work for a business or start one. My seventeen-year-old son works at a jujitsu academy. They're teaching him the back office: managing memberships, dealing with customer complaints, finding new customers, scheduling, putting people in classes. Those are real-world experiences you can't get from a book. A book teaches the theory, not the why.

With math, calculus is the first step. The rest of the two pages of math after that is algebra, addition, multiplication, subtraction. Only the first step is calculus. You just have to understand which formula to put it into. Then you're doing algebra, which is eighth grade. It all builds on each other.

---

Closing

[49:11] Aaron Crow: This has been a great conversation. How do people get hold of you? What's your call to action?

[49:34] Swapnil: I've already shared my LinkedIn profile. I'm not a salesman. I'm just a pure techie in a technology role. I would love to connect with people from different industries, specifically in cybersecurity. I'd love to talk to people about what's happening and what they're doing. Happy to connect.

[50:05] Aaron Crow: Everyone, look in the show notes. The LinkedIn will be there. Definitely reach out. Thank you so much for taking the time. I know it's evening for you, early morning for me. I appreciate you rescheduling from last week. Sometimes these things take rescheduling. I had a family thing come up. I appreciate your flexibility. It's really hard to manage this, because I don't do this for a living. I work at Arcova, I'm a consultant. So I do this on the side. I find time between meetings, early morning, evenings, lunch. But it's important to me. I enjoy it. I learn every time I talk with someone. If the audience gets one nugget from these things, I think it's successful. Thank you again. If you're ever in the States, come hit me up. If I'm ever in India, I will absolutely come knock on your door.

[51:16] Swapnil: Thank you. It was really nice. Thanks.

---

*End of episode. Total duration approximately 51 minutes.*

Transcript lightly edited for readability.