Skip to content

TechVibe Talks to PNC Bank CSO Deborah Guild

Interview by Jonathan Kersting

Podcasts

TechVibe Radio is back on air at ESPN 970 AM every Saturday at 8:00 a.m. from the Huntington Bank Studio.

It's not everyday that you get a chance to interview the Chief Security Officer of one of the world's largest banks!

That's why we are dedicating the entire show to PNC CSO Deborah Guild tomorrow (3/13) at 8 a.m. on TechVibe Radio on ESPN 970 AM!

?When it comes to every aspect of security, it is right under Deborah's purview. Learn more about the types of never-ending threats her team encounters, how they keep PNC customers safe and learn how she became fascinated with all things tech at an early age.

Transcription:

I am really pumped for today's tech vibe radio because we have a dynamite guest. How often do you get to talk to the chief security officer at PNC Bank talk about often enough not often enough, that is for sure. But I am really thrilled to have her with us because so much is going on in her world in her role. So why don't we just like bring her up front. And literally we have Debbie Guild here, who as we said before, is the chief security officer at PNC Bank, and we're dedicating an entire show. We got to deep segments to hang out with Debbie talk about her new role. I mean, there sponsibility she has the future of FinTech banking, like all types of fun stuff. So w Welcome to the show today. And thanks for taking the time to talk with us and being on TechVibe Radio.

I am so excited to be here. Thank you so much for having me. Absolutely.

So why don't we jump in? Let's just sort of set the stage a little bit and jump in and talk a little bit about yourself like what got you interested a little bit about your journey? Maybe like your first words when you were a baby?

Firewall? That's actually a joke here internally. No, I guess I'm a career technologist. I'm a tech girl. I started coding when I was 15 years old. My I played trombone since fifth grade. And in 10th grade, I asked my dad to let me quit because I was really not surprisingly bad at it. And the only class that was open in St. Augustine High School in that year, that was you know, halfway through the school year was a computer programming class. And I got involved in from the very first hello world. I never looked back. So So you also just got a big window into what my high school was like. So I went out a band geek playing trombone, a computer geek. I mean, it was, yeah, it was there was no problem for me it was it was that bad. But um, so we could go trombone. So do you play trombone today at all?

Oh, good. God. No, I would. You know, my sister. I was one of five kids. All of us had to play an instrument. That was my dad's thing. And my sister played the trumpet. She still plays out in North Lake Tahoe. She still plays the trumpet in a band. She's amazing and really, really good. But that's probably reason I quit because I realized how good it was when somebody had passion for what they did. Right. And I could be Yeah, I was actually first chair so I was technically good, because it was all road but I but there was no passion when the when the band director would said, Hey, ad lib, you know, she would you know, it was like Gabriel's horn, you know, or Chuck man, Joni, I'm dating myself. Love them. But with me, it was like I eke out like that jaws thing where it goes, bah, bah, oh, they got a good ad lib.

Um, so I kept coding all through high school. One of my older brother's friends was also in programming. So he had me coding his database screen. So I started doing user what we now call user experience coding. So I did all the menus and that kind of stuff and started to tinker around with Novell networks, install those and every sort of lawyer and Doctor networks. Again, this is I'm probably 19 got hired by the National Guard to put in their first computer system because they were headquartered in San Augustine. So I just kept doing it. When I when I finally graduated from high school, got hired on at at the National Guard, and, you know, kept programming for them, but I went to community college, because I yeah, yeah, yeah. So I love things like CCAC I think it's a great place to you know, like and grow and, you know, pennies on the dollar in terms of your education. And then I went to the University of North Florida at night. But by then I had gotten hired by what was Barnett bank. So I was hired in, it was a float. It's a regional bank, as part of the reason I bank at PNC, by the way, I'll get to that. But it was a regional bank. And I was hired as one of their engineers. And they were, they were bought by a nation's bank, and then nation's bank merged with Bank of America.

And 21 years later, I was one of Bank of America has five Chief Technology officers who literally worked from the ground up but went to school at night the whole time and, you know, graduated with no, no student loans or anything like that. And they, you know, it's all sort of tuition reimbursement. But I mean, I owe you know, a lot to you know, what, what computing what technology has done, I did have a little break in service to go out to intel on the west coast. So I moved from Florida to California work for Intel, the last iteration of the 486. And the first iteration of the Pentium, I was on that team. Oh, yeah, working for some great leaders like Pat Gelsinger. So he was, you know, 800 layers above me when I was at Intel, but was it was a fantastic little break in service. But I loved working for a tech company. But I realized that if we got really good at semiconductors, I could work for about three companies in the world. Right? If I got really good at applying technology to business problems, you know, I could work anywhere I wanted to. I mean, that's the beauty of technology is, is it's sort of a level playing ground, oddly enough from a diversity and inclusion perspective, because the computer doesn't care that you went to community college or Harvard, they could care less. And so it creates a wonderful level playing ground. And you know, it's ubiquitous to almost any business. And that I can think of right that's, that's sort of, you know, changing the world, whether it's NGOs, or, or corporates or whatever, but, but I've chosen to stay in the banking industry in a little bit surprised by that. But that's, that's my journey.

And so how long have you been at PNC?

I've been at PNC now going on eight years.

You are I you know, and part of it comes to my personality type, like I have a certain clock speed for sure. I I definitely, I have a high energy and like that, but I do feel most fulfilled when I'm delivering against a purpose. I I do enjoy working. I think that's, that's part of my personality trait. But yeah, so So from a security perspective, when I when I, what I had been doing is cyber fraud and physical security. So we call that a capital S security model. When you start stitching those together, you are able to defend a financial institution in a much more comprehensive manner. But now added to that I have enterprise technology, which is all of the data centers, the mainframe, the mid rating systems and network that connects them, the end user computing devices that everybody logs into every morning, all of the productivity software that they use in which is our fancy word for you know, things like you know, Word or Excel and, and things like that. And then also all of the authentication when you when you log in to either a PNC system as a customer or an employee, the biggest part of security is knowing who or what, because systems also log in, is that the other end of that of that transaction, if you will. So we have a whole digital identity program that really helps us make sure that we know who who's coming onto our systems and what they're authorized to do when they're on there. So authentication authorization is also in my remit.

And so given the world that we've just said, you know, still live in this almost year of COVID, and people working remotely, is that like, exacerbated some of the requirements in that space.

Oh, very much so. And the reason being is that whenever you have a sort of a seismic change like that, there's there's two things that happen one, you sort of changed the model for what you are looking for. So normally, we look for a lot of traffic coming in from business offices now that traffic is coming in from Well, you know, all over the place, right? And then whenever you make a shift like that the adversaries are the bad guys or whatever they they see those changes as opportunities to exploit those environments. So we saw Huge amount of activity relative to phishing emails and, you know, links and they they prey on the human condition they prey on people's compassion and so, so they'll put, you know, you know, in an email link for here's how you can donate to help, you know, with COVID or something like that click course you click on it downloads malware, you know, and then you know, you know what goes on with that. So we've seen, not within PNC, but within our environment, maybe our, you know, our, you know, third parties and, and our customers, we've seen a lot of people impacted by ransomware, etc, we have not seen that, you know, within our environment, we have a lot of amazing defenses, but that's what we're worried about.

That's what we're looking for. We have a we have the us some Attorney General for Western Pennsylvania. And they he actually was talking about the the surge of COVID related, you know, I want to say aberrations, but really serious infringements. And that was the beginning of COVID. So I can't imagine just in terms of just where you are at, well, we've been busy. And we wouldn't have survived without, you know, a really comprehensive security and technology framework in place, I mean, our ability to sort of turn on a dime. And, you know, within days have people you know, who here two, four had been in the office work from home and work from home, largely successfully. And in many instances, they're saying, Hey, I'm more productive now is a huge testament to you know, what it means to create a foundation that allows you to be nimble, in times of, you know, disruption. So, well, you also oversee physical security, is that right? That's true. Yes. Yeah. So that's been it's really interesting. I mean, if you think about let's just use, you know, an ATM theft as an example, that requires intervention from a physical security perspective, involvement of law enforcement, those types of things inside the ATM are checks, right? So that really makes sure that we have to make sure that anybody who had a check and that ATM is notified that their information you know, might be compromised. Also in that ATM is cash, you know, those types of things so, so our ability to then defend against maybe a, you know, a criminal ring or an entity that's now going around doing that depends on threat intelligence, and our ability to look at throwing threat intelligence across both the fraud cyber and physical spectrum allows us to have a much stronger program.

Well, how you know, it's always fascinating is how do you keep you know abreast of all this, how do you Yeah, yeah, how do you even dollar question on you that's like sleep at night the because the amount of threats and the responsibility on your shoulders is has to be just Hey, tense, but I tell you what, we're gonna take a quick break. We're gonna come back because we have a million more questions to ask you about this. But we need to all catch our breath for a second and take a quick a quick break as far as that goes. But my everybody we are talking to Debbie Guild, who is the chief security officer at PNC Bank. Way too much fun talking to you. This is just it's mesmerizing. The I'm like, Wow, this is so much fun. We're coming right back.

I promised here we are right back hanging out with Debbie Guild, the chief security officer at PNC Bank. And while we're on breakouts, thinking to myself my gosh man like You couldn't pay me all the money in the world to do her job because I get just the amount of attacks, the responsibilities. It's just like it's never ending in her position. And she has to be one of the smartest people we've ever talked to here on tech vibe, because she is just been so successful at her job. And it's just such an honor to talk to her and learn about her story, and how she does what she does. And we're going to break the brought this great question, How do you stay on top of things? And that's the point where I checked out and said, okay, out but I'm checking in, like, How do you stay on top of all the proliferation of all these, these entry points.

Um, you know, it's it's a team effort, our mission statement is together building trust, and we say together, because we have to do that sort of in concert with our customers, with our employees, with the communities that we serve. And with our shareholders and the next words building, it's because we're never done, you know, we're protecting against sort of the old as I mentioned, bank robberies, and as well as sort of your new credential validation attacks or, or distributed denial of service attacks, and, and then trust, which is the ultimate like, at the end of the day, you got to build trust, you know, that if you are in financial services, that's, I think the Gestalt in terms of brand differentiation. But we spent a lot of time with industry consortiums. So there is a whole group of you know, all of the, you know, sort of top 20 banks that are part of a information sharing Consortium. And when we see, you know, an attack, if you will, we've, you know, pick up the proverbial backbone, and we tell all the other banks, this is what we're seeing, and then they get to put up their defenses against that that same attack, they do the same for us. And that's a really important, you know, we sit on the same floor as the FBI, we have a public private relationship with them called the NC FTA. And we literally sit on the same floor with them. And so when when they see something that is actionable, they tell us about it, and we do it, but it wouldn't be possible without the team. I mean, we have, you know, several 1000 teammates who are 24/7/365, looking for threat intelligence, making sure that we're, you know, not only protecting PNC, but the US financial ecosystem.

It's great. Yeah, a lot of people don't realize that the ecosystem transcends companies. Yeah. Yeah. And the ncsea are good friends of ours, and they're not good. Yeah, their work is just incredible. And, yeah, so So tell us, you know, about cybersecurity, like, as a, as a profession as an opportunity. So, yeah, so so the first thing that I'll share and and you can look this up, we I think cyber ventures publishes some numbers on this, but there's sort of a global deficit of personnel trained personnel in the space, so. So you can pretty much guarantee yourself a job if you, you know, go through and establish proficiency in the cyber skill set. So that's one thing that I would say is, you know, it's, it's a, I think, a great career.

So what do what does that mean? Like, establish proficiency, so you have to, you know, you can't, you know, you have to understand things like the technical nuances, like, you know, using a firewall example, you have to understand that, you know, a firewall, in its in its most nascent and simple form is a big filter, right? So it, it keeps the good stuff in, and it keeps the bad stuff out, right. But there's a technical implementation that has to apply. So the firewall rules execute in a certain order, you have to be proficient and understanding how a firewall works to be able to administer a firewall as an example, right? These These aren't highly, you know, not to say that I don't have brilliant people on my team, because I do. But I think that if you apply yourself and you're curious, and you've got a thirst for learning, I think that you could, you know, have a wonderful career in cyber using that example. But there's a full spectrum of, of, of careers, there's administering access, if you think about that as being, you know, again, you know, who who do you need, who needs access to this application? Do they need it for their job? And how do you help make sure that you're granting that and reviewing that on a periodic basis to make sure that the, you know that they still require access? Those are, you know, wonderful entry level positions into a cyber career that you can grow through and then learn more throughout being in that environment. But I think it's a fabulous career for people who are, who are curious, who, quite frankly, who don't want to feel like they're in the same job every day, every day.

Every day you wake up, like what's gonna happen today.

Don't even sleep so you wouldn't be waking up anyway.

I'll just be more awake.

So could it be a job? It's also what is referred to like you can get a stackable skill set, right so that you can go maybe Take a course then you can add to it, then you can continue to add to it. And you can sort of take your career in a couple of different directions and SEIBERG

that that's exactly right. There There are, you know, even if you think about it, like a, you know, a curriculum from a, from a school perspective, you know, you can sit here and say, here are the five different disciplines that I want to gain proficiency in, you can start with one, and then to your point, you can start stacking on top of that, and then, you know, be seen as you know, a, you know, you know, an industry expert, and in the domain that you end up, you know, pursuing, you know, whether it's encryption kryptos are huge. You hear a lot about cryptocurrency, we use encryption to protect data at rest in use, and in motion. It's a fascinating field, and it's all math based. And, you know, it's it's one of those things that people say, I'm a math minor. Well, how do you apply that? Well, you can apply that real directly towards, you know, things like criminality and encryption.

So did your career ever deviate from security? Um, yeah,

when I, when I started, to be fair, you know, I'm, you know, 30 years into my career. So I started more on the infrastructure side of the house. And even when I started at PNC, I ran the data center elements where we, you know, created a metro sync pair of a standardized stack, basically created an internal cloud. So I spent about half my career if you will, on the infrastructure side of the house, another half on the software development side of the house. And then that last half, which I know is three house, but that's how much we all work in these fields, has been on the security and the change side of health. So yeah, I'm, I've been all over technology, there's probably no technology role that I haven't had the joy of, of sitting in which, by the way, I think makes me a really, I like people who spend time, even if they have to take horizontal roles in my will, because I think it makes them stronger. Like I can empathize a lot with my application development, you know, appears because I sat in their seat, I know what they're trying to do. I know how overworked they are, I know that they're trying to get their code to production and do it safely. And and so but I can empathize with them, because I've sat in that role.

So what do you think you do think you've cracked any glass ceilings? In? You know, your work? I mean, I think, you know, if you talk about your whole life, it seems like it's just been, you know, you've just taken a lot of great steps. You know, just we've moved ahead and taken a lot of great steps. But do you think you've shattered any, any ceilings?

I, you know, it's an interesting question, Audrey. And I, I, I'm so glad that it's somebody like you that's asking you this because of because you can actually help, you know, guide my answer, there was a period where I was probably too you know, just interested in getting my job done. And I didn't even realize there were ceilings, I honestly didn't appreciate that. I spend a lot of my time now though, doing a good bit of sort of reaching back and making sure that I'm you know, mentoring, you know, women and technology trying to attract, develop, retain women in technology. It's a huge part of who I am right now. But I would tell you in my career, again, for the largest part of it, I didn't even know that there were ceilings, I just, I just worked. And I so I think in large part, I was kind of lucky, if not just sort of, you know, a oblivious, if you will. Now, when when I when I think back on it, there were definitely points Audrey, where I navigated something that, you know, maybe somebody else wouldn't have, but I was just sort of, to kind of, you know, I don't know. I just sort of get on with it personality that I just didn't dwell on it. But when I hear the stories, I'm like, Oh, yeah, you know that that did happen to me. And and it breaks my heart that there are people out there now who don't have the right support around them to navigate that and I want to be part of that I want to be part of making sure that I create a safe place for people to continue to grow and to reach their potential. That's that's huge part of who I am right now. But I didn't set about I didn't set about my career saying I'm going to break glass ceilings. I didn't have that, you know, in my my family. I was the only female who didn't quit after she had her first baby. Like that was a thing. Like when I had my first I've got four sons. They're wonderful, amazing. Humans, productive members of society are about to be a god so one. But um, you know, when I had Daddy, you know, my grandfather called me up I said, Okay, well, you know what, you gotta quit now and I was like, Is that Is that a thing Am I supposed to and And my step grandmother was the only person who said, you know, Debbie, I worked. So she, you know, joined us later on, she was my step grandmother. And she said, um, and she said, I also worked really hard to give you choices. And she goes, so you can stay home, or you can go back to work, but you have that choice. And that was the only the only encouragement I got, and I chose to go back to work. But I decided, I don't know, I guess. And I don't know that I'm the poster child for anything other than you know, you know, trying to live your best life.

I mean, that. And that's really what you know, why ask those kinds of questions. It's not to say that there's one right way. But the thing that I'm most interested in is for people to do some self reflection share, so that maybe someone else can grasp that because mentoring is could be just a moment in time someone can just hear something and it can ship for them. Yeah. In in sight in cyber security, though, the opportunities, you've got to have a lot of vacancies, right. So can people go to website? And yeah, yeah, they can add on pnc.com and careers, they can go and they can start searching our positions. We're always out there. We're out on LinkedIn as well, with our open positions and and they can search for them. Where were we it's sort of a constant hiring. focus for us.

That's awesome. That's awesome. So what a treat Jonathan's to have you guys are awesome. with us. It's really great. We have to have more conversations with you. There's a lot to learn.

I barely scratched the surface, Audrey. It's like you guys didn't fall asleep.

We were like riveted because we just done I mean, you're you've talked about this awesome story where you've done some tremendous work and you're like, No, I wasn't think about breaking ceilings. I was just doing my job and just trying to do my best. And you're trying to give back and mentoring others and trying to get the next generation in there. There's the stories. We love talent here on tech vive and we need to have you back on to talk more about what you're up to and the work you're doing in Pittsburgh because there's a lot more behind me gild the movie got through today. That's for sure. So Debbie, thank you for being part of the show today, Audrey. You know, I get so sad when we got to wrap up the shootout.

Great. I'm glad we had the chance with her.

Absolutely. We'll be back next Saturday as we always are here on tech vibe radio on ESPN 970. And ever have a hankering for more tech vibe. Just go to your favorite podcast channel, go to Apple. Go to Google, you know, go to Spotify. And you can download 1000s and 1000s of interviews we've done over the years. This has been Jonathan Kersting. And this is Audrey Russo. And of course we're from the Pittsburgh tech council up at a PGH tech.org to learn more about us. Have a great weekend everybody. The Pittsburgh Technology Council has been helping our region's tech companies succeed since 1983. The Pittsburgh Technology Council helps its members meet new customers hire top talent, make headlines and have a strong voice in government. From startup to multinational. The PTC helps tech companies and advance manufacturers of all sizes. See how we can help your venture grow at PGH tech.org. That's PGH tech.org

Transcribed by https://otter.ai