Andrew Spangler, Head of Security and Compliance at Harness, on Building Trust in Security

0:00 Jon McLachlan

Welcome, everyone, to the Security Podcast of Silicon Valley. I am your host, Jon McLachlan, and I'm here today with a very special guest, Andrew Spangler, the head of security at Harness. Welcome to the show, Andrew.

0:13 Andrew Spangler

Thanks, Jon. Really glad to be here and looking forward to talking with you today.

0:17 Jon McLachlan

I'm super looking forward to it too. You bring to the table so much great experience. You launched your career at Mount Vernon School District as an educational technology specialist, back in the day. From there you became a system administrator, but then it looks like you got sucked into the security world here. You were a security consultant for Rapid7, and then after that, you were a senior security analyst at Puget Sound Energy. And then you worked at a very nice place that I'm sure most of our listeners are familiar with, the NCC Group. You were a senior security consultant there for a good chunk, a year or so and two months. Then Datadog pulled you in. You were a team lead of the information security and compliance group there at Datadog. And that's probably where you met Pierre, at the acquisition of his little startup, the [Sqreen] startup. Cool. And now you're at Harness. You're the head of security and compliance. Welcome to the show.

1:23 Andrew Spangler

Thanks, Jon. It's been quite a journey. Lots of good people along the way, including our mutual friend Pierre. Lots of good mentors and generous knowledge transferred from folks at each of those places that have brought me to this current role, where I still benefit from the expertise of my teams and the exposure that I get as a part of Harness.

1:43 Jon McLachlan

I really feel and vibe with the sense of humility. But I'm sure that you also put in some blood, sweat and tears along the way there.

1:53 Andrew Spangler

Plenty of that, for sure. Yeah, plenty of that. I think, like many things, or like many of our friends and colleagues, technology was always really interesting to me, even as a kid. My dad was a tech enthusiast from as far back as I can remember. And one of my first introductions to technology was an old warehouse computer with an 8086 processor and an amber screen and DOS manager. We even had a dot matrix printer. So the whole setup, and really got hooked on technology through video games, believe it or not. I think that's probably not [too] crazy.

2:30 Jon McLachlan

But I think it is a very common story of those dot matrix [printers] and that funny sound that they used to make.

2:36 Andrew Spangler

You go into, I think it was called Print Shop, and you could print out a little banner for your room or happy birthday sign for your sister, in my case, and have a lot of fun. And the interest only grew from there.

2:49 Jon McLachlan

That's really sweet. You printed something out for your sister.

2:53 Andrew Spangler

Oh, yeah. Sometimes I think the best use of technology is when you can use it to interact with other people, and maybe have an opportunity to, even in a small way, build something that you couldn't do yourself. I'm the farthest thing from an artist, but there's a lot of sharp edges that can be rounded by using technology, even back then. So, lots of fun memories back in the day.

3:15 Jon McLachlan

That's amazing. So was there anything specific about security that initially attracted you to that space?

3:23 Andrew Spangler

Yeah, so as you mentioned, I really got my first formal job in IT working as really a mobile help desk for a couple of different elementary schools in Washington State, up there in Mount Vernon. At the time, my future brother-in-law also was working at that school district, and he's both a security enthusiast and security engineer. And his interest and passion about that really grabbed my attention. And I think many of us in the field would echo the sentiment that it's just a cool space to be in. You get the behind-the-scenes visibility into what's going on with infrastructure and applications, and it really plays off that, I think, common interest that many folks in the field have, of wanting to understand how things work. Why does it work this way? And can I break it? Can I fix it? And let me take it apart and put it back together. And I think that was a big piece for me. And at the next job you mentioned, where I had the chance to do some systems administration, one of the big tasks that I had during my time there was to rebuild our multi-factor authentication system after the RSA Poison Ivy compromise, back in the late [2000s], or maybe early 2010, which kind of got me some practical hands-on experience with at least security technology.

4:48 Jon McLachlan

So you guys ripped out the RSA stuff and you put something else into play?

4:52 Andrew Spangler

In our case, we ripped out all the old RSA stuff and replaced it with the new RSA stuff. So there was a, hey, our root credentials have been compromised. We're going to go ahead and rotate those. We'll send you all new fobs, and we'll send you all new hardware. And part of my job was to seamlessly decommission the old setup and spin up, configure, and deploy all of the new keys. It was a smaller company, probably right around 200 tokens that I was able to walk through the process of reprovisioning. And in addition to that, my boss started to trust me with a little more firewall administration and kind of getting to see the broader edges of the security field. And that really was exciting work to me.

5:40 Jon McLachlan

Yeah, you said the magic word, trust. It's, I guess, the cornerstone of all things security, isn't it? It's not just something that exists between people, but between, like, our expectations of systems. I think it all comes back to trust at some very fundamental level here in the security world.

6:00 Andrew Spangler

Absolutely. Yeah. So, talking about that kind of first foray into security, not too long after, I had a friend of mine put me in touch with his cousin, who had just started at Rapid7 at the time, an unknown company to me. This was back pre-IPO, 2010, 2011. And the company was hiring for a security consultant, really, to work in the professional services team. So I was able to take the experience and knowledge that I had gathered at that point in systems engineering and systems administration, and apply some real practical security practices as a part of that work, going out and helping folks build vulnerability management programs and doing some sort of advisory work with our different customers. And to your point, being able to cultivate trust in such a small time-boxed window, with those one or two-week engagements, you really have a couple of hours to build rapport and trust with people, especially when you're coming in as an external person to advise them on some of the more sensitive processes that they have in our organization.

7:07 Jon McLachlan

Yep. As an outsider, sometimes that can be especially challenging. Do you have a favorite technique to help accelerate that journey towards reinforced trust?

7:19 Andrew Spangler

I think I've never really thought of it as a technique as much as what helps me feel comfortable, just to build relationship and build rapport, I think. Finding some common ground, common interest, whether it's something like video games or music or travel.

7:37 Jon McLachlan

Yeah. Camping.

7:38 Andrew Spangler

Exactly right. Camping, hiking out in the desert, all those kinds of things will give you a good opportunity to at least establish some common ground in a non-hostile way, I think. One of the things I was always concerned about as a consultant is that the client would have so much more knowledge about their systems and their environment and the intricacies of those things than I would, that I wouldn't be useful, or I wouldn't be helpful to them and would be in the way. And so part of my strategy was, I want to get to know these folks. And so I'd spend a little bit of time up front just having some casual conversations and getting to know what was interesting to them, which I felt like opened up, or maybe a better word is, the posture of the rooms that we were in, whether it was a server room or a big meeting room.

8:26 Jon McLachlan

Nice. No, I love this notion of being a little bit just less standoffish and more together, more connected.

8:34 Andrew Spangler

People are the interesting part of any job that I've held. And I think that there's always the tactical execution we have to be mindful of, but the richness of relationships and being able to make contributions to other people, and to receive from them as well, has been [far and away the highlight] of my career.

8:53 Jon McLachlan

Absolutely, I couldn't agree more. Did I screw up? Did I miss your education? I did miss your education. I was just wondering if you had gone to school for computer science or anything. And I'm looking at your LinkedIn here.

9:10 Andrew Spangler

I was just going to say, man, no, you didn't miss it, because there wasn't any. There was no formal education.

9:15 Jon McLachlan

Good for you. Oh, all respect to the world, man.

9:18 Andrew Spangler

Oh, man. And that's where I think a lot of those mentors, and you mentioned earlier the blood, sweat, and tears. I think I heard a quote one time that luck is the intersection of preparation and opportunity. And I think that's really been true, at least in my case. Right after high school, I moved to Los Angeles for about 18 months, and I attended an intensive program covering global history of philosophy, which I enjoyed immensely. It's amazing. Man, often I think back to those days, where my only responsibility was to read books and then talk about what I thought. Those were very good days. But after I finished that, I wasn't really sure what I wanted to do. I knew that I didn't want to make a commitment to an educational path, or a financial commitment to student loans, without at least some sort of confidence that I can build a life off of this education. And so I really started doing a bunch of different things. I worked at a few different small businesses. I was involved in some community events. And then, actually, along with the IT piece, I found that friends and family and small business owners in the town that I lived in needed help with their technology. And that was an easy way for me to make a few bucks, to meet some more people, and let me scratch that IT itch.

10:41 Jon McLachlan

What town was it?

10:44 Andrew Spangler

This was a little town up in northwestern Washington called [Sedro], when I was living up there. I think there were about 6,000 people. The tagline of the town is the gateway to the North Cascades. So it's really the last stop before you get into the beautiful wilderness of Mount Baker.

11:02 Jon McLachlan

Oh, that sounds amazing. No, that sounds really beautiful. And thank you for sharing, too. It's good. I think that everyone takes a different path, and no one arrives in this present moment and close to the same. And I think it's those differences that make life interesting, and make teams stronger than the sum of their individual parts, and really drive at the core of what it means to be a participant in the economy and the world and in a team.

11:30 Andrew Spangler

And so, it's good. Good for you. I think you're right on the money, man. It's one of my favorite things about our security field, is that it's new enough, I think, in this space. Really, technology in this iteration feels new every year, but I think the kind of historical discipline of security, as it's evolved over the last, at least for me, 15 plus years, has been a great avenue for folks with all kinds of backgrounds. Some of the best professionals I've worked with have had liberal arts backgrounds, or kind of no formal training. And certainly there's a lot of excellence from STEM and from the hard sciences, but I love the diversity in backgrounds and the different perspectives that we can bring to these unique problems that we're trying to solve.

12:18 Jon McLachlan

Certainly. You hit it right on the money. This is where creativity comes from, our differences. It's not our similarities. Our similarities [may] feel good, and it's important to find those similarities early on in the relationship to help build that trust, like we were talking about. But I believe 100% this is where creativity comes from, seeing the world just a little bit differently. In fact, there's a book out there called Seeing What Others Don't. It's a series of case studies around, like, where creativity has come from in the past, in past instances. And it's an interesting read. I'll put the details in the description, perhaps. But have you read that book, by chance?

12:59 Andrew Spangler

No, but I'm definitely adding that to my Goodreads list.

13:01 Jon McLachlan

Because you share a lot of these perspectives. It sounds like maybe you had it. Also, it sounds like 100% you've taken full advantage of all of your opportunities along the way and put in all those blood, sweat and tears through a long and interesting career through security. And now you're at Harness. And even though Harness is a quite successful startup, I'm sure many of our listeners maybe have never heard of it. So, would you like to share a few words about what Harness does, just at a high level, and the role security plays at Harness?

13:37 Andrew Spangler

Yeah, I'd be happy to. So, Harness is a software delivery platform. We do CI, CD, and a bunch of complementary and [standalone] modules that can be used, as I mentioned, either in conjunction with the platform itself or in a standalone fashion. Things like feature flag management, one of my favorite, security testing orchestration, helping you to get your [vuln scans] running as a part of your software pipelines, a whole suite of things. And one of the things that really grabbed my attention about Harness is not only a really high-caliber leadership team. Our founder, Jyoti Bansal, had also previously founded AppDynamics and a number of other ventures out there in the Bay. But then also the space itself. I think over the last, I don't know, seven or eight years of my career, I've had kind of a sneaking suspicion that a lot of the work I'd be doing, or I was doing at the time, would be automated in the future. And sure enough, now it is. And it's through, at least primarily, through platforms like Harness. And so that was definitely something I wanted to be a part of. I really like industries that build tools for people that build tools, infrastructure-level type of work. And I feel like software delivery is a modern iteration on that theme.

14:57 Jon McLachlan

It's a natural next step for all things automation, isn't it?

15:02 Andrew Spangler

Yeah. Yeah.

15:02 Jon McLachlan

Especially in this day and age, where there's all these layoffs happening, and the economy is not all sunshine and flowers like it used to be, and you have to do less with more. And I think I bumped into a sentiment every once in a while, which is, sometimes people are afraid of automation, not just from a risk perspective, but maybe from, like, almost like a job security point of view. But the way I've always seen it is, yeah, let's get everything automated. Let's please replace everything I do in a day with a script, so I can go off and think about and work on that next layer of problem and contribute at a much higher level than I was.

15:40 Andrew Spangler

Completely agree with you, Jon. That was, along with that sneaking suspicion, was also a looming sort of specter of uncertainty. Is the work that I feel like I'm good at going to be irrelevant in five years, in 10 years? And so that kind of job insecurity was definitely a factor for me as well. And I think what I've come to realize, both through just time in seat as well as exposure to cloud-native companies like Datadog and now at Harness, is it really does. It frees you up to work on more interesting problems. It's less drudgery, it's less spreadsheets, it's less manual deployments, and a lot more time back to focus on higher-order problems, or sort of strategy and the interesting work. Let's let the robots do the drudgery, and we can focus on what comes next.

16:34 Jon McLachlan

I love it. This mental picture just popped into my head when you were describing that future. And I would love to be an old man, a grumpy old man, that could turn to a young person at some point in the future and say, when I was your age, we had this thing called spreadsheets.

16:55 Andrew Spangler

May it be true. May it be true.

16:58 Jon McLachlan

Hey, don't give up. You've got to finish all the hard work that we started. You're at Harness and everything. You're in a perfect position to be able to help, but we can all contribute in some way or another. Anytime I find myself doing something more than twice, that came out wrong, every time I found myself doing something more than once, it's the indicator that this could be automated.

17:22 Andrew Spangler

That's really, yeah, definitely.

17:25 Jon McLachlan

My brain stops everything and it imagines how it could be automated. That's somewhat intrusive, but that's okay. Meditation helps.

17:34 Andrew Spangler

A little mindfulness in the mix.

17:36 Jon McLachlan

A little bit of mindfulness goes a long way, doesn't it?

17:40 Andrew Spangler

Yeah, it really does.

17:43 Jon McLachlan

Okay, so what's been your best day at Harness so far?

17:47 Andrew Spangler

That's a great question. There have been a lot of really good days. It's tough to pinpoint a best day. I think there may be a couple of standouts for me that really felt things started to click, and that we were on the right track, and we were doing the stuff of security. The first one's within the first, I don't know, maybe 60 days. I had inherited a small team of two engineers. We're a globally distributed, remote-first company, and although there are physical office locations, majority of the company, including my team now and at the time, is fully remote. And I had a couple of engineers that I was working with, and we had a report that one of our software engineers' laptops had been compromised by ransomware. Fortunately, no effect to our cloud environments or to anything in production, but still something that we wanted to prevent any further spread. And we treated it as an incident. And through that process of incident management and rapid response, I felt we built confidence in each other. Back to your great point about trust as a foundation of the work that we're doing. So the process and professionalism and expertise that I was able to witness and participate in and contribute as a part of that response effort was a great kind of first win, a great first best day at Harness. And going through sort of a minor crisis together really has a way of gelling a team. And that was the output from that. I think another highlight day for me, again, has been hiring. So, team and the people that I'm working with, people that I'm working for, has always been priority zero for me. And as we talked about earlier, an integral component to any success that I've had. I know a lot of people, and I'm sure you do too, who are very hard workers and give 110%, but you can do that in a vacuum if you're not surrounded by a good team. It's not wasted effort, but the result can be less than what you hope. And so big wins for me, being tasked to build out a security team from two, has been really rewarding, to bring on people that are competent and hardworking and catch the vision. And then maybe the last one that I was thinking of is the best worst day, when Log4Shell was announced and kind of hit the airways earlier this year. Again, for many of the same reasons, seeing the coordination and professionalism and the expertise across the company, not just security. Obviously engineering is involved, our customer success teams are involved, our legal teams are involved. And the calm and collected, yet urgency with which we responded to that evolving incident over several weeks, really was another great win. It felt we got through, we got through the storm. We're all in one piece, and now we're on the other side. That was a really good day.

20:40 Jon McLachlan

No, that's amazing. Okay, so what's incredible about your answers is two out of your three best days have been related, and have been where stuff has been hitting the fan. Perhaps we're both afflicted with the same, I'm not sure what to call it, mental disability, where no matter what's going on, we're going to see the good that's going to come out of it, and we're going to focus on that. And I just don't know any other way to view the world, or to view things that happen. It sounds like you maybe have a very similar perspective.

21:13 Andrew Spangler

Man, that's been a lifeline for me, Jon. I'm certainly not immune to pessimism. I think in many ways, as a security professional, you're kind of a professional pessimist by design.

21:25 Jon McLachlan

We are.

21:26 Andrew Spangler

We ask all of those tough questions. It's easy to see, at least, it becomes easier to see, what's wrong with the situation or with the technology or with some given task at hand. And I've found that, for me, looking not only at the moment, but also reflecting on the past, and then again into the future, has helped bring that perspective of, even though this feels a chaotic maelstrom, it's going to be okay. This is not the worst thing that's happened. And then that's up to me to see, or better see, the [wins], right? The points of light in those dark moments. And that's been an important part of getting through those tough times.

22:13 Jon McLachlan

Oh, I couldn't agree more. Like, seeing, keeping things in perspective. I couldn't imagine what it would be like to be writing, like, software that flies airplanes, or that controls, like, how much drug is administered during a chemotherapy session, or an x-ray that blasts you with x-ray radiation. Those critical systems have someone's life on the line. But for the most part, a CI/CD system or, I don't know, coin stuff. It's not, no one's going to die.

22:44 Andrew Spangler

I was just going to say, you make a really important, and I think a good point about perspective in our work as well, as a part of our tools that we have available to us to execute our work, to interact with people around us, that perspective of what we're doing. And certainly in the moment, things are very important, and not to minimize any of those things, but I think back to my time at Puget Sound Energy, which is the largest utility in western Washington State, serves all the big, relatively big cities in Washington. And part of my role there was [IT] and OT, operational technology, vulnerability management. And so I had a real privilege to go out into the field, going to generation facilities, whether it was hydroelectric or natural gas or geothermal, and then out to substations, and really getting a small perspective on the underpinnings of something that's easy to take for granted. And then when it's not available, we all notice it right away, and there's, to your point, the potential for catastrophic consequence. And so my respect for people who have dedicated their careers and their expertise to keeping the lights on, to keeping the drips in the hospitals moving, is just immense.

24:00 Jon McLachlan

Yeah, definitely. I'm of the same perspective too. It's almost like just serving in the military or something. It's just more on a cyber scale.

24:11 Andrew Spangler

Yeah. Yeah.

24:12 Jon McLachlan

So you had the privilege to see, get the inside scoop, maybe just a couple years old, of how secure the infrastructure is. I didn't realize that was a security position that you had.

24:27 Andrew Spangler

Yeah, that was a fascinating world to learn. It's not a natural path to go into operations technology as someone without that kind of formal engineering background. And I worked very closely with professional engineers on this security posture for components of the bulk electric system, and again benefited daily from the expertise of really great colleagues. So, yeah, fascinating work. One of the interesting things that really stood out to me was, as we'd go out to these facilities or have conversations with folks, I think of technology, even hardware, as almost ephemeral, right? Even these days, the phones that we use, the keyboards, the desktop computers, three to five years is a good lifespan, generally speaking. In the OT space, these systems are designed for 50 to 70 years. And so you're walking into a substation and they're saying, hey, we put this in in 1971, and it's still rolling strong, and no need to touch it. In fact, don't touch it. It's working fine as it is.

25:31 Jon McLachlan

Hey, if it's not broken.

25:33 Andrew Spangler

Exactly right.

25:33 Jon McLachlan

You know, it's funny you mentioned three to five years. I try to make my phones last about six, and then I just go off and I buy the best phone after six years. But by the end of that six years, I start to get those funny looks from my friends, and what's wrong with you? Maybe an upgrade from the thing that belongs to Smithsonian. And I'm like, maybe, yeah, eventually. One more year.

25:55 Andrew Spangler

There's only one camera on the back of that thing, Jon. Come on, man.

25:59 Jon McLachlan

I just upgraded. So here we go. It has the three now. Finally.

26:03 Andrew Spangler

Yeah.

26:03 Jon McLachlan

It's going to last for a long time. And I love this theme. I feel that it's come up multiple times here, and I'll just call it out. It sounds like you have a very strong growth mindset, where you're always learning, you're always curious, you want to understand how things work, and you're willing to pay that cost to better yourself.

26:24 Andrew Spangler

Yeah, absolutely. That was, I think, something, again, to go back to those early years, something instilled by my parents, by the people that I had the good fortune to be around as I was young. And then I think also just as a part of the personality that kind of evolved into who I am now, is very interested in how things work and why they work. I would guess that I was one of those kids that just kept asking why. I asked the question, and then there's seven, not seven whys, but there's 20 whys afterwards, and you're never satisfied until you get down to the bits and bytes. That's also been a really valuable part of my personal development and professional development over the years, the kind of internal drive to uncover what's next, what's the next page say. And I think that's a common theme I've found, at least in people that I've really resonated with in our community and in our industry, is that sort of shared sense of curiosity.

27:24 Jon McLachlan

It even connects back to your intense education where you were, and philosophy, connected to the bits and pieces. It's funny that you mentioned philosophy too, and that you did actually go down that path. I always, I often say that if we had lived in a world without computers or computer science, I probably would have been a philosopher.

27:45 Andrew Spangler

Seems like a great gig. What could be better than just thinking it up all the time?

27:49 Jon McLachlan

It's important. I think it's important to understand where meaning comes from. Ask those tough why questions. Ask them over and over again. Ask them until you get to the very core value system that you're dealing with. And then once you get to the core value system, maybe you could even have a playful sense of empathy with your own values, and compare and contrast, see how they're different, see how that leads to a different world perspective. And when you have a different world perspective, sometimes problems don't look like problems anymore. Sometimes they look like features. Funny how that works, isn't it?

28:23 Andrew Spangler

Yeah. Isn't it? Yeah, at the time, really focused and dedicated to learning and absorbing. Our curriculum was really, read 300 to 500 pages before 1 p.m., and then from 2 to 6, we're going to all sit in a room. There's about 15 of us. We're going to all sit in a room with a moderator who's going to lead a discussion in the Socratic method, kind of prompting you to examine your assumptions, and like you mentioned, boiling down the periphery to that core value system, and then continuing to ask those why questions. And I feel like that experience, plus some exposure to the world through travel, have really some of the things that I draw on on a regular basis when I'm kind of thinking through my life and career.

29:14 Jon McLachlan

Or are you in a computer system?

29:16 Andrew Spangler

Or even a computer system, or a video game, or a video game.

29:19 Jon McLachlan

Yeah, there we go. There's nothing wrong with having a little bit of fun [over]. Life is far too [an] important thing to be taken so seriously all the time, as well, isn't it?

29:27 Andrew Spangler

Exactly. Exactly.

29:29 Jon McLachlan

Okay. Okay. So what's been the worst day that you've had so far in your journey at Harness?

29:37 Andrew Spangler

Yeah, that's another tough one. I'm sure you've had the unique experience of having components of a best day and a worst day somehow [bring it] to the same 10 hours. Yeah.

29:49 Jon McLachlan

Story of my life.

29:54 Andrew Spangler

Yes. Those best days can be so fleeting. I think some of the challenges for me so far, you've had a couple of folks move on from the team into their kind of next adventure, and that's been tough on a number of levels, I think. There's a part of me that really values that relational connection. And so even if it's a good thing, especially when it's not, but even if it is a good thing, there's still some bittersweet flavor to that experience. And then, just practically, when you're building a small security team at a high-velocity startup, where, as you mentioned earlier, you got to do more with less, you really feel the impact of, all of a sudden, 40, 50 hours a week are just, now you got to figure out where's this going to go. And that was a real challenge. But sure, again, back to the importance of putting ourselves with good people, with diverse backgrounds, with unique perspectives and eagerness to, you know, curiosity and the eagerness to learn, is really the saving grace in those.

30:58 Jon McLachlan

So I started off as an engineer, and it shifted more into leadership roles. And I have to say, like, one of the most rewarding pieces of having gone through that shift is to help people achieve what they want to achieve and bring their careers to that next level. And whether or not that's within the same company or at a different company, I don't think really matters too much, because my loyalty is connected to people. And that's where I get my drive. And very oftentimes, it is. You can facilitate that type of growth within the same company, but when you can't, that doesn't mean that our job as leaders is to drop the ball. It's just, okay, this is going to be an interesting journey for you, and here's the options that I can think of in my network. And to watch these people, individuals who have that drive, that hunger, that curiosity, learn and grow themselves and become leaders themselves is quite rewarding, in ways that I had no idea until having gone through the experience myself.

32:01 Andrew Spangler

I would absolutely echo that sentiment. That's by far been my favorite part of transitioning, making that career transition into a leadership role. There's always the pressure of execution, and your own internal motivation to perform well and make life better for the team. But seeing people succeed, being able to encourage and, in some ways, provide mentorship and insights, [unblocked], and then see them grow and take on new responsibilities, take initiative, top highlight for me, absolutely, over the last five or six years.

32:39 Jon McLachlan

Okay, so in the spirit of people and building teams, what's your favorite interview question? And why?

32:45 Andrew Spangler

One of my favorite interview questions is to ask folks to tell me about a career highlight. I feel like, again, to close the loop, picking [up] the beginning of our conversation, where you meet somebody new for the first time and there's ambiguity, there's a little bit of trepidation, especially walking into an interview, where you don't know, are they going to be reasonable? Is this interviewer going to quiz me on things? Is this going to be a trivia session where I have to hopefully try to Google on the side? I don't want to do that. I really want to know, what do you think is a win? What has been a good win for you? And I feel like that gives candidates the opportunity to brag a little bit. It also puts them in a position where they can talk about something they're comfortable with, that they're proud of. And I feel like that tells me more about someone than most trivia questions, or asking for, sort of, linked lists or [...]. Yeah, exactly. Yeah, exactly right. So I really love to hear about what was the win for you, and then you can unpack it from there. But I think giving people the opportunity to highlight something that they're really proud of achieving is a good way to get to know someone's values, and, were they to join the team, maybe a good place to plug them in for a quick win during the first onboarding period.

34:05 Jon McLachlan

Yeah, and set them up for success. 100%. So, how about if we fast forward into the future just a little bit? I'll let you decide how much into the future you'd like to take this question. But if we look into the future, or fast forward into the future, what's one tool or service that you just wish someone would build already, that you think would make that future so much better, so much brighter, that maybe you haven't had the opportunity to build yourself, or it hasn't been a business priority yet for you and any of your places that you've been at? This is a leading question for the entrepreneurs that are listening to the podcast.

34:40 Andrew Spangler

Might be. I was going to say, I wish I had a good app to pitch right now.

34:44 Jon McLachlan

Oh, okay. All right. No, you could come back and say, Jon, ask me that question again. Here, I got an app now, like in the future. Anytime.

34:53 Andrew Spangler

Thanks, Jon. Thank you. I think, personally, personally, I would love for inexpensive easy button for nitro cold brew at home. I have been searching for a convenient way to make a nitro cold brew at home, and I have just not been able to find it. It's doable, but it's a real labor of love. And I would love to just, like, you have a dispenser in your fridge where you can get ice or water, I just want, like, another button that's nitro cold brew.

35:22 Jon McLachlan

A fridge that serves your nitro cold brew, and all you have to do is put the beans in at the very top, and it does the rest.

35:30 Andrew Spangler

That's right. If you're listening, Samsung, I would buy that.

35:32 Jon McLachlan

There you go. We got your first sale right there.

35:35 Andrew Spangler

From a professional standpoint, I would really love to see the continued integration of this kind of self-healing tools, or AI remediation, like Dependabot in GitHub, where, you know, hey, we detected there's [vulns] in these libraries, and actually even queued up a PR for you. You need to just review and approve. I'd love to see that get tied in with a lot of the good work that's being pioneered now around software bill [of] materials and this vulnerability exchange, and be able to move towards a future where we have as close to 100% confidence as possible that, again, the robots can do this work and free us up to be more focused on what comes next.

36:20 Jon McLachlan

Do you think we'll get to a world where the secure software development lifecycle could be 100% automated by something like Harness?

36:31 Andrew Spangler

I would love to see that future. I think we're, I know at Harness, we're running in that direction as fast as we can. I think there's lots of interesting challenges to overcome, but peering into the crystal ball, I think there's a future where we're at least close to that.

36:44 Jon McLachlan

Yeah. I think so too. I'm very optimistic about this, and I'm very grateful and humbled that there are people in this world, very smart people in this world, dedicated to this problem, especially there at Harness, thinking about it and moving not just that company forward. It's an open source project. There's lots of contributions that are going back. There's nothing obscure about it. Yeah, very transparent, and can really help a lot of people move more quickly.

37:15 Andrew Spangler

Great story. And I'm excited. I'm excited about the future. I think there's lots of opportunities in front of the industry, and it's cool to be one of the many people pushing on the cart to move things.

37:27 Jon McLachlan

Yeah, definitely. Absolutely. Would you like to leave our listeners with any words of wisdom? Perhaps advice for your younger self that you wish you had heard back in the day?

37:40 Andrew Spangler

Well, what a great question. I don't even want to give a number, because there's so many variants, but there are many jobs in the country and around the world. I think just the name security can come across intimidating to some folks. There's some historical baggage that the industry carries. I think in many companies, we're beginning to see some healing and some relief. And so, maybe the words of wisdom is, give security a try. Reach out to someone. Along with mentoring the team, one of the highlights for me has been when I get the opportunity to speak with people who are considering a career in security, or considering transitioning from a different role into a security-focused role. I think that's where we as an industry get stronger. I think that's where, to your point, a lot of our creativity and excitement comes from. And so my word of advice would be, give security a shot, and you might be surprised with how much you enjoy it.

38:39 Jon McLachlan

Amazing. Thank you so much, Andrew. It's been a real pleasure to have you on the show. Thoroughly enjoyed our discussions. Thank you. Thank you again. Thank you so much for your time today. And thank you to all of our listeners for tuning in to another episode of the Security Podcast in Silicon Valley.

38:54 Andrew Spangler

Thanks for having me on, Jon. This is great.