Security Engineering Soft Skills: Communication

Full Disclosure: Karan and Raaghav are security engineers at Google and Dropbox respectively and the following are their own opinions.

The previous posts discussed the technical aspects of the security engineer interview. In this post, I collaborated with my close friend Raaghav to discuss different aspects of an important soft skill – communication.

It is a well-known fact that communication is a key skill for professionals in any domain, and not just within security. Furthermore, with the current pandemic situation and the shift to working from home, there has been a significant increase in the usage of specific modes of communication such as chat and video calls, which brings along a unique set of challenges. It is important to evolve your communication style to adapt to these changes. This served as an impetus for us to revisit the key aspects of effective communication.

Identifying Stakeholders

The first step is to identify who you have to communicate with and as easy as that sounds, it is important enough to state as a major area. This is best explained with some examples:

• You are handling a security incident and you need to communicate its status to relevant parties. Generally, the team/points of contact responsible for fixing the root cause of the incident are obvious stakeholders. However also thinking about others who potentially need to be involved or are affected by the incident works in your favor e.g. executives who will make decisions based on the outcomes of the incident, the relevant legal teams if it concerns them, public relations, customer support, etc.

• You have to communicate your project updates. Obvious stakeholders involve your team members and your management. Some other non-obvious stakeholders to think about maybe extended teams who are potential customers of the project who will benefit from the updates, executives who are sponsors of the project, etc.

Choosing the mode of communication

Once you have identified the stakeholders, the next thing to decide is the mode of communication. Here are some well-known modes:

• Chat
• Emails
• Video Call/Conference meetings
• Documents, Spreadsheets etc.

The key takeaway for the mode of communication is CHOOSING the right one. This depends on the situation, for example – If you have an urgent decision to be made that involves multiple stakeholders, relying solely on asynchronous mode of communication, like email, may not be the best idea. When urgency is involved, relying on a more real-time communication mode (and potentially a combination) may work in your favor. So in this case, it would be better to set up a group chat to get every stakeholder’s attention and then set up a follow-up meeting (if needed) to get the decision made on time.

Conversely, if you require stakeholder inputs on a project proposal on a non-urgent issue, writing up a document that informs them of the proposal and sharing it with them ahead of time (or a follow-up meeting to discuss it) would work better.

Creating Content

Now that you have identified your stakeholders and the mode of communication, let’s focus on the content. The content being communicated varies from situation to situation. Having said that, the following guiding principles are key for effectiveness:

• Transparency: Ensure that the full knowledge, visibility, and context of the situation is evident in your content. The lack of context raises questions in the audience’s minds and can create confusion. In a remote situation, it is very easy for people to feel siloed, and adequate transparency is a way to eliminate the disconnectedness. Long term, a lack of transparency can negatively impact the morale of your team and will further disconnect them from the mission.

• Clarity: Ensure that intent of the message is clear and any asks are well spelled out. In a remote situation, people no longer have the opportunity to simply swing by someone’s desk or talk in-person to get more clarity. So it is absolutely important to invest time to be extremely clear in what you are trying to communicate and what specific ask you might have from the recipient.

• Brevity vs Verbosity: Ensure that the content has the right balance of conciseness and verbosity. In some situations, it is important to convey the point quickly and succinctly whereas in others it helps to be elaborate to explain the issue at hand.

Following up

Once you have communicated, it is important to decide if it requires a follow-up. Most communications are one-off, however, there will be several instances that require multiple follow-ups. The key aspect is to remember when to follow up and how often. Defining these two parameters ensures that you can achieve your deliverables on time and also adapt in the event of unplanned work or delay. Communicating early and often is key.

Overall everyone is putting in a lot of effort to adapt to the remote first work environment and as such, you should strive to demonstrate empathy at every step of your communication while keeping the discussion above in mind.

Go forth and communicate!