I got into cyber leadership the same way most people get into most management roles. I was good at something else. In my case, developing websites and web applications during the dot-com rush was an exciting and fun time. That work transitioned into more complex application development work, then project management work. After a few years, I was managing major IT systems, and then portfolios of systems and applications. Every step on this journey involved mistakes and then work to figure out approaches that were more successful.

I began my career in web management at the U.S. Department of Housing and Urban Development (HUD) and moved into project management. I ventured to the U.S. Department of Agriculture (USDA) where I founded a project management office and became an IT Program Manager. Next, in the White House, I leveraged my experience to provide oversight to IT projects across the Executive Branch and review and support agencies’ IT budget requests and management capabilities. I also served as a staffer in the Senate, advising on IT, acquisition, and cybersecurity policy. From there, I felt like I wanted to focus on cyber, and went to the Department of Homeland Security (DHS), where I worked on analytical approaches to risk management. After that, I have been applying these approaches back at USDA.

A typical day as a cyber leader starts off with the daily standup, in which each of the people on the development team share what they did the previous day, what they plan to accomplish today, and anything that may prevent them from achieving what they plan. My job is to try to do some of that downfield blocking and tackling if I can. Stakeholder management is a critical part of the work. The project is successful when the stakeholders feel like they are successful. The cyber leader must work with each stakeholder to understand what constitutes a win and what constitutes a loss for him or her. To do that the cyber leader must facilitate discussions between stakeholders and developers so that the criteria that makes each stakeholder a winner is well-understood. What does the system/application need to do to address this stakeholder’s needs? The work of achieving this understanding must continue until the stakeholder and developer both agree that they got it.

My first significant project was a complete disaster. It was a $10M reengineering project transitioning from a legacy mainframe system to a multilayered application. I followed the book but we ended up pulling the plug after spending $6M. I committed to never making these types of mistakes again. With the remaining $4M and the knowledge of the challenges, we began again. The project was structured differently, and it deployed with the remaining budget and is still being used to this day.

The work, as identified in most textbooks on cyber leadership, boils down to the triple constraints of cost, schedule and scope, or, how much money are you willing to spend, how much time do you have, and what do you want? None of these dimensions is independent of the other two and people want to think that a change can simply be absorbed into a project. The cyber leader must remind people, even when they are agreeing to a change, that there is always an impact to the other dimensions.