#HearHerStory: Aanchal Gupta
Interview with Director of Security at Facebook
About Aanchal
Aanchal Gupta is Director of Security at Facebook. She leads a global team responsible for assessing and mitigating security risks across Facebook and its family of apps including WhatsApp, Instagram, and Oculus. Prior to joining Facebook, she was Chief Information Security Officer at Microsoft for Skype and Skype for Business. Before joining Microsoft, Aanchal led Yahoo’s Global Identity team, contributing to various authentication and authorization open standards such as OpenID and OAuth. Aanchal was named one of Business Insider’s “Most powerful female engineers of 2018”, and she serves on technical advisory boards for security startups, CloudKnox Security Inc. and ThreatWatch Inc. She is also on the advisory board of Udacity’s Cybersecurity Nanodegree. Aanchal is an active speaker at key industry and digital innovation events. She is passionate about building diverse teams and has served on the review board for the Grace Hopper and Black Hat conferences and recently chaired the Applied Security Engineering session topic at the OurSA Conference in 2018, which focused on featuring a diverse group of speakers. Follow her on Twitter and LinkedIn.
Maya Frai: Tell me a little bit about yourself. How did you get into technology and particularly engineering?
Aanchal Gupta: When I was growing up in India, my dad was an electrical engineer and I always liked how he tinkered with things. From a very early age, I wanted to be like him and quickly discovered my inquisitive nature since I loved figuring out how things worked. So, I started dreaming of pursuing engineering very early on and really my dad was my main role model that motivated me to become like him someday. When I was attending college in India and the time came for major selection — I instantly chose electrical engineering. But that was when my dad told me to go for computer science instead. I was like woah, what happened? All these years I was preparing for electrical engineering. But now when I look back, clearly he had the vision that I did not have. He had the vision that computer science was the future and would be quickly growing in the coming years and offer me flexibility in future job choices. So that’s what convinced me and looking back, he definitely helped me make the best decision. From this, I now know that having these coaches and mentors you can rely on is really important. And another thing that I have experienced and find very important is for parents to encourage more girls to go into STEM. Because a lot of the time, girls might get the feeling that they are not very good at math or science and that is the time when we need to encourage our girls the most to continue moving forward to try to excel in it.
MF: From that time to now, do you think that’s changed at all? Do you see more women going into STEM?
AG: There’s definitely still a lot more to be done, and when I look at the overall percentages that come out of published surveys, the numbers are still not good. There’s a lot more we can do because there’s a large talent pool out there and we are just not tapping into it. Even in cybersecurity, we will have so many job openings in the next 2 to 4 years and we can’t fill them unless we tap into this pool. It’s in our best interest that we get the largest representation of every gender, every background, religion — everything.
MF: In particular to Facebook and other Silicon Valley companies, what do you think of them trying to improve their diversity initiatives and cultivating an open work culture for diverse groups of people?
AG: I think Facebook does a good job, not just for women but for the community at large. At Facebook, we have something called the Powerful Women in Tech Series, where we have technical presentations and bring in women from across the industry to meet, network, and mingle with each other. And our role is not to bring them to Facebook, but to have them know each other and form a stronger community. We also recently did something for veterans. We brought in 33 veterans and did a cybersecurity training for them. They graduated from the program and two of them are now working at Facebook. So these things are also very inspiring to me that we are able to give back to the community. Another thing we do is offer cybersecurity programs at universities that do not have cybersecurity coursework and so we partner with them to offer students of all backgrounds the opportunity to learn about these topics. We now offer a credit program to eight universities.
MF: How do you think you’ve tried to support other women?
AG: So, I think as a woman, one trait that comes naturally to us is empathy. When someone shares something with you, our natural instinct is to listen and empathize with the person versus judging or ignoring the needs of the person. And within these instances and through leading such large teams, I have always tried to listen attentively to what they are sharing with me and can either coach them or help them with the problem itself.
MF: Is there a particular experience in your life where you truly felt part of a community of women?
AG: I have always been part of a women’s program at the companies I’ve worked for and I often lead some of the initiatives such as for the women in security and safety, we hold monthly lunches. We have a rule where whatever we discuss stays here and it ensures that people feel comfortable knowing that it is a safe space. It’s more about sharing what you feel and trying to get other people’s perspectives on problems or opportunities.
MF: What do you think is the most important skillset a woman needs to handle today’s workplace landscape?
AG: I think courage and confidence. As I said, empathy comes natural to us. For most women, it’s more about raising our hand and saying yes I can do it. We tend to be more of perfectionists. There was research done that says that when there’s a job opening, when a woman sees it they really look for a 100% match in the job description before they apply, versus when a man sees it they can see a 60% match and feel comfortable applying — which I think is the right attitude. Because when you’re on the job, you will both learn some and contribute some, 100% is not required.
MF: What experiences do you feel helped you get to where you are today?
AG: I have been lucky to have mentors and coaches throughout my career. By the way, I have definitely acted stereotypically before like not raising my hand or always looking for a 100% job match so it took time to get here. I’ll talk about a time when I was looking for a 100% match. So this was when I was still at Yahoo and I was an Engineering Director and was very happy with my job. One day, I got a call from Skype for a security lead role and I truthfully thought it was a mistake. I didn’t specialize in security and didn’t know why they were asking me to interview for this role. And, it so happened that the way the interview times were scheduled, I couldn’t decline in time so the only best thing I could do was to get on the call for the phone interview. And the first thing I told the hiring manager was “I’m not the right fit for this job, this is a mistake on the recruiter’s part. So, let’s not waste each other’s time.” But the hiring manager did not give up and so we talked. And I remember him saying that there was a team visiting from Europe and so he invited me to go meet them just for the sake of meeting them, no obligation necessary. So, I couldn’t decline and said yes, but I still did not think I would be fit for the role. To my surprise, I got the offer. But, I was still not convinced, I still thought the 100% match wasn’t there so I declined. But they did not give up. They asked me what is the one thing they could do for me to change my mind. I said “how about this, I want a meeting with the hiring manager face-to-face.” But at the time, the manager was based in London, and my internal hope was that he would not come to the U.S. to meet with me and the whole thing would go away. But, they told me that he would be coming the week after so they set up a meeting. And so I made sure to be very genuine and ask him “why me?” And the answer that I got will remain with me forever, he said: “Aanchal, you are worried about you not being a security expert and you’re thinking that we should bring in a security expert for this role. We have tested you technically on various security questions and you did fine. Why I want you to take on this role is that you have been an engineering leader throughout your career and we know in the security role, you will bring empathy and collaboration to the engineering teams — which a lot of the time is missing. We know that you will empathize with the team and know that they have priorities too and you will get stuff done.” And that convinced me and also taught me that building diverse teams is very important. When you bring people in from different backgrounds, you build a stronger team. And I then went on to be my hiring manager’s successor — something that I would have never even thought of. I realized that we really just need to trust ourselves more.
MF: Based on that experience with Skype, what advice would you give to other women facing that same situation or approaching a new role at a new company?
AG: There are two parts to the question: one is when you get to a new role, new in the sense that you don’t feel it is your forte and you are changing directions like how I changed from an engineering leader to a security leader. Yes, there were times when I definitely felt like “oh my god, these people are expecting me to do these things and I haven’t done this before don’t know if I’ll be able to do this.” But I did spend a ton of time doing my own reading to get on par with everyone else. So don’t feel bad doing the work you need to do to get yourself on par with where you need to be because everybody needs to do that, you’re not unique or special in that — men or women. And the second part is that when you start a new job, don’t focus on landing an impact right away and this advice again is for both men and women. Because a lot of the time, people start at a new job and have a 30–60–90 day plan and question what they should do because people are going to evaluate them based on certain things — don’t do that. Spend your initial 30 or 60 days learning what’s going on around you by talking to people and understanding what they have tried before and what worked and didn’t work. Ask yourself what is it that they want from you, why did they hire you and what is the special skill that they think you are bringing to the table? What are the skills you are lacking and need to hone in on? So there’s all this work you need to do before you can actually start making an impact.
MF: After Skype, you came to lead security at Facebook. How did you feel stepping into the role?
AG: You know, just the way you said that that I am responsible for security at Facebook is a very conscious reminder that I am responsible of helping more than 2 billion people feel safe on our platform — that’s a huge responsibility. And I don’t take it lightly, and it’s what drives me at the same time. So I am very focused on building diverse teams and as I mentioned, the team is more productive and successful by being diverse. And the challenge of keeping people safe on our platform is something that keeps me up at night, but also something that keeps me satisfied at my job.
MF: What inspires you here at Facebook? I know you said the people, the work, is there something else you feel keeps you going?
AG: One thing that is pretty unique to Facebook is our posters. I have not seen a company with such inspiring posters all over. There’s a specific one that I always remember which is “What would you do if you weren’t afraid?” So whenever I’m thinking if I should do something or not, I think about what I am afraid of at that moment and if I wasn’t afraid, what would I do? If I am not sure about doing something one way or another, I definitely think about this and ask “Am I choosing one part over the other because I’m afraid of something?” And if yes, what is it and should I be afraid of it?
MF: What empowers you to stay on as a leader at Facebook?
AG: When I look at the people around me, I see that they are some of the best cybersecurity people I have ever had the chance to work with. And not just because of their talent, but because of their passion and drive to do the right thing and that’s amazing. I feel really privileged to be leading these people. I think it’s the impact that we can have on the community in general that continuously empowers me to build a safe platform for everyone to use.
MF: How have you learned to deal with the challenges you face as a cybersecurity leader? How do you think you’ve learned to approach them?
AG: So two things. One thing I realized was after my interview with Skype, is that some learning happens unconsciously. At Yahoo, I was leading the identity team and you cannot lead identity without knowing security because identity is how you get people to access your services and you have to make it secure. So I learned a lot about security subconsciously by leading the team there — one of the reasons why I was able to answer the questions during the Skype interview without even knowing I had the answers. Then, I think I do spend a lot of time on conscious learning. By nature, I am a very inquisitive person so when someone says something, I have to look and read more about it to learn what I can, not because somebody has asked me to, but because when I am really curious about something, I need to learn about it.
MF: What advice do you have for women who might feel discriminated against when it comes to solving problems or working on a team?
AG: I think sometimes when you walk into a meeting and if you are the new person coming into that meeting, people might not even pay attention to you, but that has never discouraged me. And something I would tell others is to not be discouraged by that. Believe in yourself and have confidence that what you know is valuable and everything you’re bringing to the table is valuable. And speak your truth because that is more important than what others are thinking about you. Because when you do what is right, they will get on the same page as you so don’t internalize it, just be very truthful.
MF: Have you ever tried to negotiate a role to set up a path for you to get a leg-up? Do you have any advice for those who are trying to do the same?
AG: So, I would say that raising your hand is important. Because when people are looking for who is going to be the next person for a given role, they are looking for two things: first is, does the person have the skills? and second, does the person have the desire? These are two different things. Skills, maybe you can demonstrate with your work, something you will do anyway, consciously they will know that you have the skills. But, it’s the desire piece they won’t be sure about unless you raise your hand. And that’s where we often shortchange ourselves by not raising our hand. We say, do I have 100% match to this new role? If not, maybe I’m not ready yet. So raise your hand, if you’re a 60% match, raise your hand and 40% is what you will acquire as you do the job.
MF: How have you tried to advocate for yourself and for your ideas?
Before, I was at a startup and it wasn’t doing so well and so I started to look for another job. I got a call from Yahoo around 2000 and was super excited. Once I got the call, I was talking to my then hiring manager and he told me that they were looking for an Engineering Manager and I was just a Software Engineer at that point, so he said that I wasn’t a fit for the role. And so, I asked him “Can you still bring me onsite for an interview? Maybe not for this role but for something else. I can promise you if you bring me onsite, you won’t regret it.” And he was so taken aback by my statement that he said “sure, we’ll bring you onsite.” He didn’t have a position at the time for me to bring me onsite, but they brought me anyway and gave me an interview and sure enough, they gave me an offer for a software engineering position. And later on, the hiring manager then became my mentor and told me that the courage I had showed him before was what had landed me that job.
MF: What’s one question you often get asked about managing your career?
AG: One question I get asked a lot about is work-life balance. And most women are very concerned about how we can manage work-life balance with a career and a family. One thing I try to tell everyone is that if you try to look for work-life balance on a day-to-day basis, you probably won’t find it. There will be some days when you are needed at work and some days when you’re needed at home. You should be able to balance both and prioritize both as they come. Once you have that in your mind, you won’t be thinking every day that you need to do everything at once. You should be thinking about what you are prioritizing at a weekly cadence. Secondly, you really need support when you’re working. You need support from your life partner, and at one point, Sheryl said “One of the biggest career decisions you will make in your life is who you marry” and this is very true because if your partner is not supportive, it will be very hard. And of course, you have to support your partner as well. You have a shared responsibility. And I think if you have these two things, you can be very successful both at home and in your career.
MF: Who do you look up to for inspiration, in the industry or in cybersecurity?
AG: I have a lot of people who I look up to and one general advice I give to people is that instead of finding just one person, find different people because they will inspire you for different things. And it’s important that you become a very generous human to contribute more for society, rather just in one dimension. So, I look at my mom for certain things, I look at Sheryl for certain things, I even look at my son for certain things because they all bring different characters.
Be sure to follow Aanchal @nchlgpt and take a look at her writing on diversity in cybersecurity here.
This is our first of several features of inspiring women at Facebook, as part of the Let’s Hear It x Women@Facebook interview series. Stay updated on new interviews by joining the LHI newsletter here.
