BrakeSec Education Podcast

Nickolas Means talks about Security, Devops velocity, blameless orgs, and conferences infosec should attend

Mar 4, 2023

Nickolas Means, VP of Engineering at SYM, discusses topics such as building a blameless culture during incidents, building a compliance program without impacting engineering velocity, cross-training dev and security teams, the challenges of shifting left in software development, the relationship between programming languages and security conferences, crafting secure applications, and the launch of sim, a platform for managing access to production systems.

01:14:50

Creator website

Episode guests

Nickolas Means

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Building a blameless culture fosters collaboration between security and development teams, ensuring a proactive approach to addressing security concerns.

Automating security processes and integrating tooling into the development pipeline improves efficiency and reduces friction between security and development teams.

Cross-training and shared understanding between security and development teams breaks down silos and enables proactive identification and mitigation of security risks throughout the software development process.

Deep dives

Working towards a Blameless Culture

The podcast discusses the importance of building a blameless culture in organizations. It emphasizes the significance of having security professionals work collaboratively with development teams to address security concerns from the early stages of product development. It highlights the need for security professionals to understand the software development life cycle and the business pressures faced by developers, fostering a culture of collaboration and understanding.

Introduction

2min

Building a Blameless Culture and Handling Incidents

16min

Importance of SOC 2 Type 2 Certification and Security Testing

18min

Shifting Left and the Challenges of Security in Software Development

18min

The Relationship Between Programming Languages and Security Conferences

2min

Crafting Secure Applications

16min

Discussion on the launch of sim and its benefits for engineers and security personnel

2min

Discussion on Job Market, Communication Preferences, and Self-Care

2min

Guest info

Name and Title:

Nickolas Means, VP of Engineering at SYM

Email/Social Media Contact:

@nmeans on Twitter, @nmeans@ruby.social on Mastodon

Time Zone (if other than Pacific):

Central (Austin, TX)

Show Topic Summary / Intro

We welcome Nickolas Means to the stream. Nick is the VP of Engineering at Sym, the adaptive access tool built for developers. He's been an engineering leader for more than a decade, focused on helping teams build velocity through trust and autonomy. He's also a regular speaker at conferences around the world, teaching more

effective software development practices through stories of real-world engineering triumphs and failures.

He’s also the co-host of “Managing Up” a podcast with Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams.

Questions and potential sub-topics (5 minimum):

'blameless environment' during an incident. We can discuss working an incident and if a 'blameless' environment the exception or the rule (stories from the trenches are always welcome)

Building a compliance program without tanking your engineering velocity... I'd like to speak about that in terms of overall security (product security, scanning, license checks, and more)

Is there a playbook to building more efficient dev and security teams? Can cross training dev in basic security, or security in sprint planning processes make a better experience for all?

Will we ever solve ‘shifting left’? What does Shifting Left really mean to engineering teams, or is that a term security people created to try and speak ‘dev/eng’?

‘Managing Up’... security is often asked to do a lot. Be STO when you don’t manage the resources, timeline, etc. When teams are small, you’re either in the operational/tactical, when management wants a ‘tactical/strategic’ view. What can the overall business do to create a good working relationship out of the gate? “Make a dashboard” is all well and good, except when your org lacks maturity across the board. What are some realistic expectations management should have when the company is small? (I will provide additional context during the stream)

Additional information / pertinent Links (would you like to know more?):

https://managingup.show/ - Managing Up Podcast “Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams.“

https://symops.com/ - Adaptive access management tools built for engineers

https://www.ted.com/talks/brene_brown_the_power_of_vulnerability?language=en

https://www.terraform.io/

https://news.stanford.edu/2022/12/05/explains-recent-tech-layoffs-worried/

Show Points of Contact:

Amanda Berlin: @infosystir @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec

Youtube: https://youtube.com/c/BDSPodcast