This is a long running subject for me and has impacted all the major projects I have worked on, often being the make or break factor, determining if they are successful or not. “Business engagement” is a phrase that is often used in a flippant way, thrown in as if it was a given.

It is not a given. It is not a given in any way, shape or form. Humans are tricky critters they pull in all different directions for all different reasons, and much to the surprise of their managers they often classify their needs as far more important than the orders they are under, but there are some general groupings that exist in nearly all corporates and there are a common set of engagements that you have to be on the lookout for, with the key being to empathise and take action on the engagement needs of groups different to your own.

The three different levels of engagement are going to be the same three as I have used in previous blogs, Lets go through them:

Stakeholders (The Fantasy Zone) :

What Engagement do you need off them?

1. Funds.
2. Political Backing and Authority

What do they need off you to provide their Engagement:

1. Proof that you can deliver.
2. Proof that your actions are competent, justifiable and provide ROI ¹.

This is the strategic engagement level, and it needs to be long term. Alas here we hit our first snag, strategic stakeholders are supposed to think like politicians, they are supposed to think long term, they’re supposed to think in terms of the good of the nation for decades in the future, but they don’t, they are still human. They tend to think in terms of the next election / financial year or even worse the next news cycle / monthly report.

So how do we fix this? we provide them ammo for them to fight off the pressures they are under, this includes

1. Status and proof that the budget and funding they are providing is being used correctly, and if there are extra costs and time slips that they are fully justified.
2. Evidence that this is still the correct path and if it is not, that we have adjusted the deliverable and direction to get the project back on course.
3. Knowledge and evidence that no one is going to pull a skeleton out of the closet and embarrass them in some form of power play.

If you provide these proofs to your stakeholders then they can maintain their engagement to the project, if you don’t, trust me they will yank their funding and without that, you are not delivering anything.

(Middle Management) The DMZ:

What Engagement do you need off them?

1. Access to SME’s ² , the real people who know how current processes work, Such people are often very hard to both find and gain access to.
2. Time: you need time from the business or Support services to get your program or process ratified and tested, and as operational levels are so tightly controlled normally, someone needs to sign off the initial loss in productivity that they will suffer in order to engage with you.
3. No stalling: If you don’t engage properly with the middle management then things grind to a halt, suddenly no decision will be taken without workshops, formal paperwork with every I dotted and T crossed. Time consuming “make work” will start to grow like mushrooms which will generate ill will all round.

What do they need off you to provide their Engagement:

1. Assurance that you are not going to disrupt their teams without some advantage to them.
2. Integration with their existing plans, most middle management already have plans for their teams as well as multiple other projects wanting their time, you need to work with them to reach a balance as your project will not be the only game in town.
3. Proof that you are not the latest stakeholder fad, projects come and go so often in most corporations that many middle management have become jaded, as when an exciting new project is suddenly dropped they are often left with not only partly completed infrastructure moves, but also an expense in committed resource that they now can’t offset.

In Summery: Middle management will already have multiple other plans going on, work your plans in with these and you stand a far better chance of getting support.

Operations (The Coalface) :

What Engagement do you need off them?

1. They need to actually use and accept the new system or process as a long term change.
2. They need to tell you the unofficial and undocumented quirks and work arounds that are being used in the current system so they are addressed before the new system of process goes into production.

What do they need off you to provide their Engagement:

1. Assurance that what you are doing will not lead to them losing their job.
2. Proof that what you are doing is not going to make their job harder or mean they have to do extra work for no advantage ³
3. Proof that what you are doing is not going to effect commission or end of month payroll.

The Operations area are the most important in a true sense, because ultimately they are the part of the business that actually makes the money.

1. Return on investment[↩]
2. Subject Matter Experts[↩]
3. Often projects that seem a great idea to back office just mean lots of extra work at the operational end without any visible improvement[↩]
4. Sound of Mark being sick at the cheesy line[↩]

Last month I got to go to my very first IISYG Meetup, now IISYG is one of the oldest Cyber/Security Groups in the UK, and up till now, I simply haven’t been senior enough or brought enough to the table to be invited as a member. I had seen it for years as a tantalising event that people went to, but other than the subject of its talks I did not know its contents, only that there was a number of senior guests speakers, and a lot of conversations about details in the security industry. So it was with much excitement I received an invitation and potted along to the House of Lords with my security ID, all suited and booted.

Now, the whole of the meetup is under Chatham House rules, which will make this review understandably vague, however it wasn’t its actual content that I wanted to review. It was about the fact that I have seldom enjoyed a professional meetup more, particularly as it was my first time, everybody was instantly friendly and likeable, easy to get on with and most surprisingly, there was none of the normal conference posturing, there was no titles or anything like that, I was engaged within minutes of walking through the door, and people said what they did, but not the level that they did it. when we did a quick roundtable of who was there, it was like a who’s who of security, massive industry representation across the board, incredibly impressive but not one of them was trying to me the most important ¹. It was a minimal name, title, and what they did, which was an indication of things to come.

This was a forum in which people share expertise, shared their knowledge and shared them in a way that everybody else could learn from, it was truly a safe space where you could ask for help, where you could repeat how you’ve done something and would do it differently again, or what plans you had, and people with decades of experience would help you address issues that they could see coming up for you. It was simply like that. there was so little ego in the room, it was unbelievable, just a vast amount of help and experience. conversations would go from deeply technical security details, to laughing and joking then back to serious. It was a very dynamic and very, very open experience.

I don’t know what else to say about it, other than I felt like the most junior person there and I have not felt that for a decade, also that in a couple of hours, I learnt more that weeks of Internet research and public conferences.

However, I did make one mistake. It turns out that even though it officially finishes at 1pm, people go to the pub, have lunch and keep the conversation going, and I’d already got stuff booked for the rest of the day. I’m not going make that mistake again.

1. Often on a new project when you do a round table, there will be a few people that can’t resist tooting their own horn, there was none of that here[↩]

Definition:

A Job candidate that drops out of seemingly no where with the perfect set of skills just when needed.

Explanation:

Disclaimer: As always these posts are not aimed at anyone client or employer and are just my personal observations over a lifetime of dealing with both management and frontline associates.

1. I have only heard of this happening in close communities of companies where people know each other and word can spread of a suitable candidate being available via the grape vine, so the normal search channels are bypassed[↩]
2. I have been the pre picked candidate a couple of times and you really have to bring your A-Game to prove its not favouritism[↩]

I’ve been doing quite a few interviews recently, and I am being asked a lot about team management as expected, but unexpectedly the majority of the answers that people are looking for are based around the core need to not hire a self centred horror and get someone who can help and support a team or project to hit deliverables.

This should be an absolute base line, but as it does not seem to be, here are the 6 most BASIC tips I implement when working as a team or department lead from the perspective of the people you are responsible for:

1. Learn International public holidays. This is a simple one. Go to Google calendar or any major web calendar and load all of the public holidays for the countries of all people that you are responsible for, Learn the public holidays and do not be surprised when someone is not working that day, Bonus points if you can pronounce them and learn their relative importance in the year.
2. Never use any variation of “Well if I’m in, you should be in as well” responsibility and work are nearly always linked to remuneration, or to put it more simply, you tend to be paid more than they are so they are not supposed to be doing as much as you.
3. Don’t pit yourself against the more important real life things. Your monthly report is not more important than their only child’s graduation. Use your judgment rather than your ego.
4. Learn to handle the truth. Anybody who is responsible to you should be able to bring you any related problem in confidence that you will work to make it better, you might be upset, you might even utter a few swear words, but you must not aim it at them, this is now a shared problem and your goal is to help them and to solve it. Do not scream at them, do not take out your anger, fear or whatever on them. They have brought you the truth, If you freak out no one will bring you the truth again. You will have proved yourself incapable of handling it.
5. Do not allow familiarity to breed contempt, This is quite a common one. Someone does something amazing and everyone is impressed, but the next time they go that extra mile, people are less impressed and they get less praise, so now there’s now less reason for them to go above an beyond. Judge each time someone is amazing as a stand alone action, and if they do it a lot promote them or provide a longer term reward.
6. Most importantly never ever, EVER throw them under a bus, you must stand in front of your team or department and take the hit if there is a major issue. after the problem as been resolved there might be repercussions internally, but you stand united and you back them during the time of the crisis against a third party.