How I Became A CISO: Quinn Shamblin, Boston University

The man now leading security for a major university first got the security bug when dealing in government secrets about nuclear power.

If you had a broken toy that needed fixing when you were a kid, Quinn Shamblin was the neighborhood boy to take it to. Even as a child, Shamblin was the guy who liked to know weird, unusual stuff, and the go-to guy for taking things apart and putting things together.
Infosec is the first career I really latched onto that uses all those old things that were drivers for me as a kid, says Shamblin, now the executive director and information security officer at Boston University (which does not use C- titles like CISO).
He did not, however, set out for a career in infosec. He was a physics major, and after school was recruited to teach Naval forces about nuclear power.
It was then, while dealing with so much classified information, that he became interested in security.
He pursued that new fascination by going to work for Proctor & Gamble. At P&G, it wasnt just the intellectual property confidentiality that was important, it was availability. They required 99.997% uptime, says Shamblin. Eleven minutes would cost the company $200,000.
Also at P&G, he met the manager who would be a professional mentor for the rest of his career.
You need to have people believe in you, says Shamblin. Someone has to look at your work and say, yeah, wow, theres value here.
For Shamblin, that person was Kevin McLaughlin, a former felony investigator for the Army, who shared some of the same attitudes Shamblin had developed through his tenure in the military.
The two worked well together, so when McLaughlin left the company to go create a new information security department at the University of Cincinati, he invited Shamblin to join that new team.
It was McLaughlin again who recommended Shamblin for the job at Boston University in 2010, while declining the offer to take that job himself.
Shamblin is continuing the tradition by playing the role of mentor himself. Instead of hiring people whove done precisely the same job elsewhere, he hires people with promise and trains them up.
I want people to get better and better at their job, he says, and I want them, at some point, to leave. Shamblin believes that hes preparing his employees for great careers wherever they decide to go, and in a broader sense, improving the industry by investing in these people.
Although most companies hire CISOs from outside the organization, Shamblin wants his successor to be someone he trained, and deliberately prepared to take over.
Most of the lessons hes passing on to those future CISOs have little to do with technology, and everything to do with business sense and communication skills.
As a CISO, its more important to understand risk and the business than to understand technology, he says. Understand that if I do X I wont
have
a business.
Shamblin says that a CISO needs to sound like a CFO. He or she must appreciate the balance of risk and reward, and must be able to comprehend a financial analysis. He did earn an MBA himself while working at the University of Cincinati, but there is something else he gives more credit for his success than his degrees.
I can talk, he says. Im genuinely interested in [people] and they can see it.
One key piece of advice he gives to all aspiring CISOs is to improve their communication skills, both written and face-to-face. He urges them to get formal training on this, because the difference between a well-written email or document and a poorly written one is huge -- but without training you might not see the difference.
If he werent an information security pro, Shamblin says he would pursue another career in emergency response -- and isnt that what a lot of infosecurity is all about?
This is part three of Dark Readings How To Become a CISO series. Read parts
one
and
two
now. Come back next Monday for the next CISO origin story, which is set in a law school.

Last News
▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How I Became A CISO: Quinn Shamblin, Boston University