WASTE NO POTENTIAL - EPISODE 7
Lead From Behind.
Honing his anti-hacking skills in the dark underbelly of the IT room, Sabino Marquez became a leader no one was expecting.
Lead From Behind.
James Bond has nothing on Sabino Marquez. The latter is stealth. Covert. Marquez works in the shadows. And he intimately understands the minds of the world’s most potentially dangerous criminals: hackers. Bond may be able to ride a motorbike through a wall of flames, but can he penetrate a network firewall to steal a list of client names? Didn’t think so.
In the encrypted world of data security, Sabino Marquez is a big deal. Corporations of all sizes depend on people like him to trust their information is kept safe. But what makes Marquez stand out isn’t the fact that he’s seen all sides, positive and nefarious, of data security, but that he recognized the potential value of the oft-misunderstood IT department. His discovery had his sales team giddy with excitement. Suddenly, someone from the depths of the IT room was tossing a grappling hook and scaling a new wall of business revenue. It is the ultimate example of leading from behind.
On this episode, we are also joined by Tractionite Joy Asakawa, Regional VP of Retail Consumer Goods, who also approaches leadership from a unique perspective. For Asakawa, leading is just as much about supporting as it is guiding. A leader is only one part of a much larger whole.
This episode, Lead from Behind, deconstructs the concept of leadership to expose the fact that a good leader isn’t always the person in the spotlight — the one pulling the strings is often hiding in the shadows.
Listen to Lead from Behind — it’s a spine-tingling cliffhanger you won’t soon forget!
- 8:11 - 14:42 "Sabino Marquez, from an unlikely hustle to an FBI consultant.”
- 15:50 - 18:48 “Joy Asakawa on leading from behind."
- 23:12 - 27:24 “Sabino on spotting a big problem, that leads to big innovation.".
[00:00:04] Alexandra Samuel: We're outside an office tower in downtown Vancouver. A would-be intruder is standing on the street corner, casing out the building. He knows there's a lot at stake if he can pull off this job.
[00:00:17] Sabino Marquez: So, I'm on the street. And I know that I'm out there on the street. There's a security guard inside. And I know that there is a camera watching me. And I need to get into this building without a key fob. So, you just walk right behind somebody in the turnstile. And if you walk like you belong there, then you won't be challenged. So, dress the part.
[00:00:37] Alexandra Samuel: Now he's in the lobby, and he spots his mark. It's a person who works on the floor he's trying to invade.
[00:00:43] Sabino Marquez: Then, you want to get into the elevator with these people and get off on their floor. I was able to get to the floor.
[00:00:50] Alexandra Samuel: Now he's outside the door of the office he wants to get into. He could pick the lock, but instead, he has another idea.
[00:00:57] Sabino Marquez: So instead, what I did was I did the classic person looking at their phone by the elevator. So, I start by looking at the phone until someone opened the door. And then I walked in the door.
[00:01:09] Alexandra Samuel: So, he scans the room.
[00:01:10] Sabino Marquez: We're looking for clues as to where the IT department is and where the servers are. And now you're at the door of IT, which has a key fob. If this alarm is tripped, you know, an IT person is gonna come, so you can't just pick this door. So how do you get in this door? So, I'm only going to tell you, I was able to get in the door through social engineering.
[00:01:30] Alexandra Samuel: He's in! He's focused on his target – rows and rows of company servers.
[00:01:36] Sabino Marquez: Now that I'm in the room, I'm staring at two rows of six cages with 20 servers apiece. All of them locked with an actual lock. And there, you can pick the lock. You can do so because no one is going to find you because now you're in the IT room. And unless you put in motion sensors, you're not going to know anyone's in there.
[00:01:57] Alexandra Samuel: But, like any good heist movie, there's a catch. The intruder’s name is Sabino Marquez: Marquez, and the job he's pulling off is on his own company. It's a classic penetration test: the way security pros try to get a sense of what their vulnerabilities look like from the outside. And that's Sabino — a security leader at a firm that deals with lots of sensitive client data. It was his job to make sure that when clients stored their data in the company's systems, that data wasn't going to go anywhere.
[00:02:28] Sabino Marquez: We had customers that made a physical security audit a condition of buying. So, the salespeople would come to me because I solved their problem, and they're like, “Sabino, what do we got for this?” And I'm like: I pulled a physical security audit checklist from my old banking days, back when I used to rob physical banks, you know, of all the things that you check when – when you rob banks. And I said we're gonna run this checklist against, you know, this facility.
Inside and out. You know, everything from picking locks, to trying to jimmy windows, which included climbing things on the outside of buildings for crying out loud, in order to ensure 100% of windows or 100% of doors, that all the alarms that went off were actually responded to. All that stuff had to go in. Again, it was all about the salespeople, they couldn't close the deal.
[00:03:15] Alexandra Samuel: Now, Sabino is no shrinking violet. But he's a great example of how you don't have to hog the spotlight to be a leader. In fact, it's often more effective to stand in the shadows. To lead from behind. And sometimes that means using those shadows to pull off a heist.
[00:03:41] Alexandra Samuel: I'm Alexandra Samuel: and this is Waste No Potential brought to you by Traction on Demand. Okay, I want you to picture a leader. I usually picture politicians, CEOs, people leading big social movements. You know, the kind of folks who can take a situation and guide us beyond what we thought was possible. But, think about what leadership really means. It's about inspiring people to see new possibilities, to dig deeper and give more of themselves, to bring folks together so they accomplish as a group what they could never do individually.
Well, we tend to picture that kind of leadership as coming from a podium or from the C suite. But there is nothing about that definition of leadership that says you have to be the top dog or famous or even visible at all. In fact, inspiring people to see new possibilities – to go above and beyond – well, it's often driven by those behind the scenes. The leaders who have the biggest impact might be people we never even hear of. So that's what we're looking at today. What it means to lead from behind. To set aside ego, the hunger for recognition, and instead focus on making change happen. And the person I'm talking to is someone who has personally changed how I think about leadership and inspired me to loosen my grip on the ego gratification side of things.
Sabino Marquez is a true security leader who I got to know when we worked at the same company. And the first thing I ever heard about him was that crazy story of how he broke into the building. That's what leading from behind is all about. Doing what needs to be done, even if it literally means breaking in from the outside.
[00:05:38] Sabino Marquez: I will tell you if you don't put it online. But wait! This podcast is going on the Internet!
[00:05:44] Alexandra Samuel: We spoke with him during his final weeks as the Chief Security Officer at a company called Allocadia.
[00:05:50] Sabino Marquez: Alllocadia is a software company that delivers their software as a subscription over a secure modern web browser.
[00:05:58] Alexandra Samuel: Allocadia Software is all about helping marketers measure the exact impact of their marketing campaigns and the return on their marketing dollars.
[00:06:07] Sabino Marquez: Let's pretend that I'm like a big hotshot global brand CMO and I just read that Nike has something like a $500 million a year marketing budget for North America. And I have to turn that $500 million into $15 billion of revenue. Before Allocadia, it's difficult to prove that a dollar spent here became seven dollars over there, and then you can attribute, you know, where that went to. But with Allocadia, you can actually tell the future.
[00:06:33] Alexandra Samuel: As the Chief Security Officer, the CSO, of Allocadia, it's Sabino’s job to protect those enterprises from things like hackers who could steal that huge value. Or how Sabino likes to put it: future money. Security is a big job. But the truth for him is, throughout his career, he always felt it was undervalued. He was okay staying out of the spotlight himself. When you're breaking into buildings as part of your work, staying under the radar is the name of the game. But he was less okay with his colleagues and customers relegating security to the sidelines.
[00:07:11] Sabino Marquez: I was I was miserable for a long time because I was waiting for external validation of the practice. “Why doesn't anybody recognize what I'm doing?” I would say. “Does no one see the value?” And no they didn’t, right? You can scream until you’re the blue in the face.
[00:07:28] Alexandra Samuel: Sabino’s story of wading into the waters of IT and security began a long time ago. It was back in the days when computers were something only nerds were interested in. But eventually the tone shifted. The public started to see PCs less like George Orwell's Big Brother, and more like something you might have in your living room. For Sabino, his fascination came from an unlikely path. And an unlikely hustle. You were not exactly raised from a baby to defend marketing data. Tell us a little bit about where you grew up and what you thought your life was going to look like when you were a kid.
[00:08:09] Sabino Marquez: I arrived in the United States when I was five years old, from Argentina. My parents left that country and came to Miami where I landed. My mother didn't know what the world was like when we came to Miami because she came from a small town in Argentina, where you can let six-year-olds leave the house and wander the streets and they'll come home at night. Okay, this is where she's from.
We come to Miami in the early 80s, during the Miami Vice era. Cocaine, shootouts in the streets. It's fantastic. My mother lets me out, “Oh, go, go, go ride your bike, Sabino.” You know? I go out, I ride my bike, I end up at a bank, and I saw that they had this American Express pamphlet – and you could get credit with it. And I'm like… credit. That's a lot of candy from Woolworths next door. So, I filled out the pamphlet, and I walked up to a teller, and I handed it in. And they thought I was so cute, they gave me five bucks. Score! And I went and I got my candy that way. That didn't work after a while because they stopped giving me money. So, I'm like, “I need another way to get money!” So, it turns out that everybody in Miami who has a house usually has some type of monstrous fruit tree in their backyard.
And everybody fantasizes about having fruit trees, but you don't really want fruit trees, especially mango trees, which produce you know, several thousand high-powered bombs that fall off the tree and then attract all manner of horror to your backyard. So, I thought that I could do two things at once. I could save my neighbours the hassle of the “Mango Apocalypse” by stealing the mangoes from their trees and then selling them back to them door to door, which is what I did. And when I was eight years old, there was a movie theatre a block from my house.
So, I went and saw War Games with Matthew Broderick. And here was this movie about this kid that was a bit, you know, introverted, a bit geeky, a bit nerdy. You know, I related. That was dialing into computer servers to steal video games, and then he accidentally launches World War Three, and at the end of the movie, you know, saves the planet, and gets the girl. And I'm like, “Yes! That – that is, that's what I want to be when I grow up. I want to be Matthew Broderick in War Games when I grow up.” And then the next year, my father brought home from a thrift store a Commodore 64. With the cassette tape drive, that's stored 600 bytes, or kilobytes and, and I started to learn how to program.
My father would bring me magazines that had code, and you would type in the code into your Commodore, and then you would record it to your cassette tape, and then you could play games. You could play Pong, or you know, like very primitive style game programming. And then I learned you could dial into BBS’ and then and then the BBS world eventually led me to the computer science departments of universities where actual hacker kids are hanging out, back in those days. And I learned how to do what they did in War Games: dial into places and steal video games. I'm nine, right? I'm nine years old. I'm like, “This is fantastic! What else can you do?”
[00:11:08] Alexandra Samuel: Sabino was spending his early years doing odd jobs with hackers. People who weren't afraid to break the law in their pursuit of information, or even just out of sheer curiosity about what they could accomplish. Then one day, he realized this life choice wasn't going to lead places he wanted to go.
[00:11:28] Sabino Marquez: Well, when you hang out with people like this, eventually one of them is going to bring you a gig that you may not want to participate in, you know? But you may be around when they happen. So, I saw a lot of things as a ten, eleven, twelve-year-old, of computer crimes executed right in front of me.
[00:11:48] Alexandra Samuel: That's when Sabino started thinking about the difference between what the security world calls the Red Team and the Blue Team. When you see tech companies run capture the flag games as a security practice, it's the Red Team that runs the attack and tries to get past all the security measures. It's the Blue Team that does the job of defending security. So, that's how people label hackers and security defenders.
[00:12:13] Sabino Marquez: I grew up on the Red Team. I started to see in the news, a lot of the crews that I would work with starting to get busted by the FBI. And I'm like, “Whoa, the FBI is in on this?” And, so, I'm like, maybe now's a good time to stop doing this stuff that I'm doing, you know. And so you have to decide what you want to do at that point. And at that point, I kind of broke off and did not participate in any further activities as such.
So back in the mid-90s, I was doing IT work as my legit work. I went to go work with a company. They were a small boutique company out of Miami. Now we're gonna get into some nitty-gritty. So, like, if you're a bank, and you have to be 100% sure that you're not getting robbed, that means that you have to have all of your systems not only monitored, you know, and sending alerts to people, but actual people responding within five minutes or less, in order to see whether there are crimes in progress, right? We’ll be your ADT, basically, but for bank robbers.
When I was working for the company that defended banks from bank robbers…banks, as you can understand, are a critical pillar of American strength and stability. The FBI, at the time, had a joint Civilian Agency Task Force, called InfraGard. And the purpose of this organization was that people like me can't get hired by the FBI. If I want to show up on their doorstep, I say, “Hi, FBI. I repent all of my sins, I promise to be a good boy, and I want to be hired.” They can't hire me for 100 reasons because people like me can't work for them.
But the knowledge that I have about the way things work is very useful to agents who are trying to help us stay safe. It could include calling you in to provide an opinion, a conversation about what we think is happening, it could be, “Hey, didn’t you used to run with crew X? You know, do you know anybody around?” You know, like those types of questions. And it felt really, really good. It felt really, really good helping the agents. Because there are hackers that steal video games, and there are hackers that hack Heart-Lung machines. There are hackers that launch missiles.
There are hackers that steal the encryption keys of US Army bases, you know what I mean? Like, that's the type of crime that I am 100% behind and I will help stop. And that's, that's kind of why I crossed over into the Blue side and stayed there.
[00:14:48] Alexandra Samuel: You're listening to Waste No Potential, a new podcast about incredible stories of spotting untapped potential. This show is brought to you by the good folks at Traction on Demand. And I'm your host Alexandra Samuel. If you're enjoying the podcast, don't forget to follow us wherever you're listening from. You can also find us at tractionondemand.com forward slash podcast.
[00:15:14] Alexandra Samuel: Sabino was so deep in the background by necessity as part of his work, that it's hard to see the glimmer of what we look for in a leader, at least as long as we keep thinking of leadership as stepping into the spotlight. But you don't need to be in the spotlight to be a powerful and effective leader. Here's someone else who can show us a different model. Joy Asakawa from Traction on Demand. She's the Regional Vice President of Retail Consumer Goods, and she spends a lot of time leading her team. Most of the time, she isn't doing it from centre stage. Are you somebody who enjoys being in the spotlight? Like, are you happy getting up in front of 400 people and giving a speech?
[00:15:58] Joy Asakawa: Not particularly, no. And thankfully, I haven't had to do that. Like, honestly when I think about every win that I had, and it's so interesting because we have on our Slack channel, it's called a Traction Closed One Channel. So, every time a deal closes, it will showcase what deal we closed and the details of it. And of course, the name that gets highlighted is the salesperson. And the reality is, of course, they are the ones that are there driving the whole thing.
But it's unbelievable. I mean, I'm not kidding you, Alex, sometimes there's 50 people involved, and every single person is so instrumental. And without that one person, none of that would have happened, right? We always used to talk about, like, not being in front of you, not being behind you, but being beside you. And it's so true. So, becoming a parent during the pandemic, I got into leadership actually during my pregnancy, which was really exciting. You know, during that time, I was able to, you know, formally build the team that I had at that time. Obviously, when you're new to any sort of environment, you know, there's a lot of absorbing, handholding. And I think just seeing these people, and the folks that I had brought in a few years ago, really take that to a whole different level, with their own flavour, you know, and just thriving in their own respective ways. That's probably the best version that I can give you or example in terms of like, yeah…
[00:17:28] Alexandra Samuel: The only thing I want to pick up on there, because it was interesting to me, and you just sort of like bounced off of it. But you said something about how becoming a parent in the pandemic had changed your thinking on all of this, or was an example…
[00:17:40] Joy Asakawa: I think, at first, as a parent, you feel as though… I've had more experience than you, I'm physically bigger than you, I can talk, you can't talk yet. And I think automatically, we assume that we should dictate and control everything. And of course, listen, I'm still gonna be a helicopter mom, I'm not negating that. But I think, I've learned from my child right out of the gates, that they have their own opinion, that they have their own likes and dislikes, I need to respect the space. We’re equals, right? They have their own way of doing things. And so, I’ve brought that into my life outside of just parenthood.
That people, you know, are resilient, and that people, for the most part, have great intentions. And you just need to give them that space to learn and to do it. And just to continually let them know that you're going to be there, right? Even if it doesn't – the outcome is not what both of you had anticipated. And so, I think that's been a pretty incredible journey for me personally.
[00:18:49] Alexandra Samuel: Joy says she's learned a lot about leading from behind from being a new parent. When you're raising a little human, you try to model certain behaviours that you hope they’ll soak up and carry forward. But you can't make them be the person you have in your head. You kind of have to just stand back and let your kid unfold.
You know, like, support them in becoming the person that they want to be. And the same goes for leading from behind at work. Sometimes the best way to lead your colleagues is not by running out front, but by standing behind someone else. Standing beside someone else. Or a whole bunch of someones and helping them do their best work. That's what Sabino saw on his own journey. From his entrepreneurial determination as a kid, becoming a mischievous hacker, and eventually flipping to the Blue Side to help banks and the FBI.
But he was coming to a point where he'd have to take the next step and shape himself into a leader. He made a move to Vancouver, Canada. Vancouver gets the nickname Silicon Valley North because of all the successful tech companies that started here. Companies like Slack, Hootsuite, and, yeah, Traction on Demand. When Sabino got his first gig doing security for a software company here, he quickly realized his place wouldn't look like the shiny tech offices you see in TV shows or job ads.
[00:20:18] Sabino Marquez: This was a West Coast software company. With everything that that implies. Funding, a waterfront office, free beer, you know, the whole schlemiel. The IT department was sexy in this company, or at least they thought they were sexy. And so, they were given nice offices with nice computers, clean air, and we were only beaten twice a week with reeds. I mean, we didn't get anything nice. We got a desk to work on, we got a window, and we were allowed to come and go without having to ask permission. Because it was a high-tech company running at full speed with a bunch of people who run that type of company.
[00:20:56] Alexandra Samuel: If the state of his office weren't already an indicator, Sabino could see security would have to fight for every dollar spent protecting customer data. Execs were used to thinking about security as one of those unfortunate costs of doing business. Something you have to spend money on. Like lawyers or accountants, even if it seems annoying.
Being lumped in with all those functionaries was a long way from hanging with the Red Team or busting online crime with the FBI. While being tucked away in his humble security department, he began to have a revelation. He noticed that the folks in the corner offices, the business leaders, the salespeople, well, they had one particular pain point while trying to close deals with potential clients.
[00:21:46] Sabino Marquez: Salespeople were having trouble closing big deals with global enterprise customers, because they just couldn't get the trust. But there was nobody focused on trust as a product. And that was my first revelation, you know. My second one was that up until about, let's say 15 years ago, every leader, every corporate leader, every grand Titan of industry that I've ever seen, I used to say, “Oh, look at these big shots. They get all the money, and they don't do any work.
They all blah, blah, blah all day, just talking, talking, talking, never doing it. I bet you these guys have never done a hack. These guys have never written a report.” I realized that human beings are hard-wired for story as the prime method of communication. And that if you're not telling stories, you're not going to communicate to more than just one person at a time, you have to have a story. And so, what I decided what was missing was that there was no security story to tell.
[00:22:47] Alexandra Samuel: That is Sabino’s moment. He wanted to take security out of the backroom. To move it from the cost column to something that could actually help the business make money. A way to make it easier to sell the company's product. All he needed was the right story. And it fell into his lap.
[00:23:08] Sabino Marquez: One of my favourite stories is when Verizon was buying Yahoo. In the middle of the negotiations, Verizon had put $5 billion on the table and said I'm gonna buy Yahoo for $5 billion. And in the middle of their negotiations, that enormous Yahoo hack, the huge breach, occurred. Billions and billions of records were leaked by Yahoo's poor security practice.
Yahoo, as it turns out, did not really invest in security. And they collected unbelievable amounts of highly sensitive personal information of regular human beings, who are not your customers, by the way, so you don't really have a duty to them. And when that happened, Verizon was like, “Whoa, we're not paying $5 billion for this.” And then a discount was taken of $1 billion. 20 percent. 20% of the deal was directly tied to security duties. And that was a huge lightbulb for me.
I'm like, wait a minute. So, you mean to tell me that if you don't do security right, that when it comes time to sell the company or merger or wherever you do, they're gonna come and look at my security and determine whether or not it's good enough, and if it's not, they're going to ask for discounts? Oh, no, no, no. Not on my watch. Once I realized that there was a direct connection between a well-run and communicated assurance program and enterprise account executives being able to close more deals faster and having more sales time per quarter because it's not being lost in due diligence in the deal cycle, I realized that I could put a value on that.
[00:24:36] Alexandra Samuel: So, Sabino went back to his trusty computer. He began gathering data on how important security was to clients. The amount of time salespeople could save with his idea. Even the amount of revenue that could be gained. Then, with all his data in hand, he left his office and braved the terrain of the business executive.
[00:25:02] Sabino Marquez: I visibly supported the revenue strategy and reported my metrics in revenue metrics.
[00:25:08] Alexandra Samuel: Business ideas coming from the security guy? It was a tough sell.
[00:25:13] Sabino Marquez: Nobody — nobody — cares about security. The first resistance came in general from the operations organization. Because what, what do you mean, you're running a revenue practice? I thought we hired you to do this security compliance stuff, right?
[00:25:32] Alexandra Samuel: But, there at the boardroom table, his CFO decided to take a chance on his idea.
[00:25:39] Sabino Marquez: She said, “You know what, I don't understand what you're doing. But I can see the value in this innovation.”
[00:25:45] Alexandra Samuel: Now, was his opportunity to lead. He started working with other disciplines in the office.
[00:25:53] Sabino Marquez: I was left to penetrate deeper into customer success. I started to identify the customer success department’s cadence – when they would go in touch with customers and service customers – and I would jump in with them, and I would make friends with their security people, and their auditor, and their attorneys, and their vendor managers, and their compliance people.
And I would establish relationships the way that salespeople establish relationships. And I would say, “Guys, you can come to me at any time, here's my penetration test. Here's my sock too. Here's every policy I've ever written.” This sales story requires evidence of 100% for everything you say. Because you're trying to gain and prove confidence and trust.
[00:26:32] Alexandra Samuel: And the moment arrived. Would Sabino’s idea seal the deal? Would he and his alliance between sales, customer success and security hold?
[00:26:44] Sabino Marquez: We were able to target and win every single compliance-locked market that the revenue people wanted to target. Financial institutions, every major bank in the world bought us. Consumer packaged goods, huge. Every, every public company, tech company… not a single one. I've had the world's biggest security companies write me letters, “We've never seen such good security in such a small shop.” They appreciate it. They make decisions on purchasing based off it. It's a revenue practice. At a human level, it felt like I had reached the first summit in a multistage climb, is what it felt like.
[00:27:21] Alexandra Samuel: That's the thing about leading from behind. It's a marathon, not a sprint. When you're in the corner office calling the shots, you can drive the whole organization towards your vision and make things happen relatively quickly. Even if there's no guarantee you're driving in the right direction. When you're leading from behind, it can take longer. It might require persistence.
It might take a lot of experimentation, patience, trial and error, before you figure out how to tell your story in a way that gets the rest of the organization on board. But when you do find that path, well, that's where the magic happens. Nobody is saying yes to you because you're the boss. They're saying yes, and getting behind your vision, because you've come up with something that is genuinely powerful. Genuinely exciting.
[00:28:16] Joy Asakawa: So, hearing Sabino’s story, I think that is a common story that a lot of people experience in their career. I think leading from behind at Traction means that you will always have support from literally anybody from the business. It doesn't even have to be from your direct team. I think it means that people will give you the space to go and venture off on yourself. And, even if you fail, you will not be punished for it. In fact, they'll probably praise you, and we'll want to further, you know, dig into that and find out what we learned and use that as a stepping stone for our next venture in that similar space
[00:28:56] Alexandra Samuel: That's the shift Sabino made.
[00:28:58] Sabino Marquez: When I made the switch of…I'm not going to wait anymore for people to recognize me. I'm going to set the criteria that I am expecting to meet with this practice, and then when I need it, I'm going to feel self-satisfied. And when I took that approach, I said, “I'm just going to focus on my practice. I'm going to focus on my measurements and my metrics and my success metrics.” And when I succeed, the halo effect of my success is that all these beneficial business activities occur. And then I start to get recognition from the people who were affected by my focus on the practice, rather than my focus on the job.
[00:29:34] Alexandra Samuel: Sabino didn't need a corner office, a podium, or a spotlight to make an impact because real leadership can come from anywhere. Even, or maybe especially, from behind.
[00:29:54] Alexandra Samuel: Today, my guests were Sabino Marquez, former Chief Security Officer for Allocadia, and Joy Asakawa from Traction on Demand. I'm Alexandra Samuel, and this is Waste No Potential brought to you by Traction on Demand with production support from Jar Audio. Follow us on Spotify, Apple Podcasts, or wherever you get your shows. Until then, thanks for listening