Started, developed, facilitated, and scaled up a training program for the cloud security and incident response teams. I branded this as “Security Mountaineering” and offered different pathways up the mountain, including:
- DevSecOps Fundamentals: 2 hours every other week - Learn the importance of & how to use git, linting, unit testing, and behavior testing in an interactive training format.
- GoLang: 2 hours every other week - Learn GoLang! Taught by Sabree Blackmon.
- AWS Security: 4 hours weekly - Learn AWS security through interactive training series. Included walkthroughs of flaws.cloud, Rhino Security Labs challenges, and custom in-house challenges.
Facilitated trainings from external providers:
- AWS Security Jam Sessions: 4 hours, quarterly - Time to attack the cloud! Fully student-driven hands-on training attacking real AWS infrastructure. This is a paid AWS Professional Services product offering that I worked to facilitate and drive participation in.
- Cloud Security Incident Response Simulations: - Surprise Basis - Somewhere between a Red Team Operation and a tabletop exercise, this included having AWS ProServ create realistic attacks in our infrastructure with the support of selected cloud security team members, allowing SOC and investigators the chance to practice response in the real environment with our tools in a safe and controlled manner.
Measurement and Checkins
We need to know that our efforts are being well-spent, that we’re focusing on the right things, and understand teams' needs. Naturally, I:
- Gathered attendance and weekly survey data weekly to measure participation and get data on what’s working & what’s not
- Stayed in close contact with the managers/leads of the teams to ensure that the syllabi aligned with their needs and that they were seeing the fruits of the investment
- Provided weekly reporting of summary data to the Executive sponsoring the program
Outcomes
Incident response metrics improved dramatically, colleagues felt more engaged & empowered, confidence in capabilities increased, and positive culture change came out of this. The culture change is particularly touching - bringing an academic approach to the day-to-day has created an atmosphere in which there is more striving for excellence and collaboration to find the best solutions. This contributes very well to our shift into SRE mindset and blameless culture in which an academic and pragmatic approach is essential to bettering the company overall.