In this episode of Make Yourself @ Work, Matt Tverberg sits down with Delia Midamba, Director of Physical Security at Saronic, an Austin-based defense technology company building autonomous vessels for the U.S. Navy. She dives into how she manages visitor compliance workflows, keeps security consistent across multiple sites, and balances a frictionless employee experience with the requirements of a regulated environment. Some key lessons from the conversation include: security works best when it enables the business rather than blocks it, consistency across sites reduces risk and creates a better employee experience, and the biggest security variable is always human behavior.
In this episode of Make Yourself @ Work, Matt Tverberg sits down with Delia Midamba, Director of Physical Security at Saronic, an Austin-based defense technology company building autonomous vessels for the U.S. Navy. Before Saronic, Delia built and led security programs at Splunk, Cloudflare, and Cohesity, and started her career as a Foreign Affairs Officer at the U.S. State Department.
Delia shares what it's really like to build a security program from scratch at a company where the stakes are national defense. That means navigating trade compliance, multi-site consistency, and protecting technology that real lives may one day depend on.
She dives into how she manages visitor compliance workflows, keeps security consistent across multiple sites, and balances a frictionless employee experience with the requirements of a regulated environment. Some key lessons from the conversation include: security works best when it enables the business rather than blocks it, consistency across sites reduces risk and creates a better employee experience, and the biggest security variable is always human behavior.
This episode is a must-listen for physical security leaders, workplace and operations professionals in regulated or defense environments, and anyone building a security program at a fast-scaling company.
—
Quotes
“The human factor adds an element of unpredictability that you always have to be able to pivot and account for. So the security teams always have to be reading people, assessing behavior, and then responding based on the signals they're getting.”
“ Framing the conversation and being flexible and understanding [that] your risk tolerance may not be their risk tolerance. And so coming to an agreement on where they want that risk tolerance to be, and then implementing based on that.”
“I think a lot of the time security is seen as a hindrance or a blocker… So if we can get to a stage where we're not seen that way, where people are comfortable coming to us for help… that's a win for me.”
—
Timestamps
(00:25) Background on Delia and Saronic
(01:31) From the State Department to defense tech
(04:36) The US shipbuilding gap and Saronic's mission
(06:51) Saronic vessels used in a real Navy rescue mission
(09:03) Working with a Navy SEAL founder
(10:27) Communicating security value to leadership
(16:09) One badge, one process: the consistency principle
(19:32) Trade compliance and visitor workflows
(26:38) Incident readiness and tabletop exercises
(30:58) What keeps a defense security leader up at night
(33:09) How Delia defines success in her role
(36:17) How Delia Makes Herself @ Work
—
Links
Connect with the guest and host on LinkedIn!
[00:00:00] Matt Tverberg: Welcome to Make Yourself @ Work. I am your host, Matt Tverberg. Very excited to speak with our guest today. I am joined by Delia Midamba from Saronic. It's such a pleasure to have you here. Awesome. How are you doing today?
[00:00:25] Delia Midamba: Thank you. I'm doing well.
[00:00:26] Matt Tverberg: So a little bit about you, Delia. Very impressive background.
You work for Saronic, which is a Austin-based defense company that builds autonomous vessels.
[00:00:36] Delia Midamba: Yep.
[00:00:37] Matt Tverberg: You started your career in foreign affairs-
[00:00:39] Delia Midamba: Yep ...
[00:00:39] Matt Tverberg: at the US State Department before moving into security and risk intel, and you've built programs for a lot of impressive companies such as Splunk, Cloudflare, and Cohesity.
Mm. But now at Saronic, you're basically building their security program from the ground up. So I'd love to just start there and, like, tell me a little bit more about Saronic and kinda what your mission is there.
[00:01:02] Delia Midamba: Sure. Um, we build autonomous boats of all sizes. Um, we build in Austin and in Franklin, Louisiana at the moment.
Um, but the goal is to redefine shipbuilding in the US
[00:01:18] Matt Tverberg: That's awesome. So what, I guess, got you into that? Like, from technology companies to now, like a defense company like this, how did you, I guess, autonomously navigate that- ... that career path?
[00:01:31] Delia Midamba: Um, kind of blending from my past government experience and then my tech experience.
It's the best of both worlds, right? I'm back kind of tied to the mission. Um, you know, Saronic is a defense contractor, so I'm getting to contribute to the defense of the nation, um, while also being at a tech com- company that moves at the speed of a tech company, um, and has the resources of a tech company.
[00:01:53] Matt Tverberg: Yeah. Yeah. For sure. So I guess I wanna ask, 'cause you have probably one of the coolest LinkedIn headlines- Sure ... which is the Protector of the Realm at Saronic. Yeah. So what is it that you're actually responsible for there?
[00:02:09] Delia Midamba: Sure. Um, I lead all of our physical security, so you know, office security, um, executive protection, travel risk safety.
Um, the whole nine yards, uh, falls under my purview.
[00:02:21] Matt Tverberg: And you said you have, uh, multiple facilities right now. It's Austin, and you're- that's where you're based. Yep. Do you get to visit the Louisiana location- Oh, yeah ... frequently as well?
[00:02:30] Delia Midamba: Yeah. Absolutely.
[00:02:31] Matt Tverberg: How are you able to have consistency be- between the offices as you start to build a program like this?
Like, what is the most important thing, you think, to keep consistency between the locations?
[00:02:45] Delia Midamba: I mean, the security culture, right? How we approach security. Obviously defining standards and things like what cameras we're using and those kinds of things, response times, how the guards look and dress. Um, but we want to create an, a consistent feel for employees.
So when they go from one office to another, it's not like, well, there's different security rules here and different security rules there. Like, you show up, it's Saronic. Y- you know what to expect. You know what the sign-in process is. You know what we're allowed to do or not do on campus. The guards look the same.
They're wearing the same uniform. You know, it's just a consistency that you know what to expect coming in. You know how to report it. You know where to go. Um, and taking that to every office that we have.
[00:03:22] Matt Tverberg: Yeah, and speaking of consistency, I know that part of your, like, personal resume is, you know, you have a lot of cool things.
You're into art, wine, whiskey drinking. You're actually part of a wildlife search and rescue, but you're also a powerlifter, and that takes some consistency. I know I love to lift weights. Yeah. I'm certainly not a powerlifter, but I guess what has that hobby taught you about security and, and the rest of your life at work?
[00:03:48] Delia Midamba: Sure. Um, lifting heavy is more mental than it is physical. It's a mental resilience game. Half the time, you're like, "This looks heavy. I don't wanna do it." Um, but it's all about talking yourself into it, right? It's the mental resiliency, and I think when it comes to security, you know, you're dealing with a lot all the time.
You never really know what's gonna happen day to day, and so it requires a lot of mental resiliency, a lot of just, like, powering through. We're gonna get through this. And then then on, on the other end of it, we can take a break and relax and breathe and eat our gummy bears. Um, but for now, we just gotta, like, focus and get through this incident, you know?
[00:04:23] Matt Tverberg: You probably are somebody who tackles the hard tasks first.
[00:04:27] Delia Midamba: Tend to, yeah.
[00:04:27] Matt Tverberg: Would you say that that's how you approach things?
[00:04:29] Delia Midamba: Yeah, for sure.
[00:04:31] Matt Tverberg: Have you competed then before?
[00:04:33] Delia Midamba: Yeah. Mm-hmm.
[00:04:34] Matt Tverberg: Awesome.
[00:04:34] Delia Midamba: Yep.
[00:04:35] Matt Tverberg: Cool. Yeah. I guess, like, talking about Saronic specifically, you're, you're kind of in a big moment right now. Yeah.
Like, the US is racing to close China's shipbuilding gap.
[00:04:45] Delia Midamba: Yep.
[00:04:45] Matt Tverberg: And also, our Navy is moving into a, um, manned and unmanned ship of, of fl- a fleet of, of ships. Yep. And your CEO actually was recently quoted that, "In a long conflict like this, what matters most isn't who has the best platform. It's who can produce and replace capability the fastest."
[00:05:06] Delia Midamba: Yeah.
[00:05:07] Matt Tverberg: So when a company is protecting our national security like this, how does that change physical security in the day to day for, for you and s- for Saronic?
[00:05:18] Delia Midamba: Sure. I mean, I think the stakes are a little bit higher, you know, for us. Um, a compromise, if somebody breaches our, our space, um, the stakes are a little bit higher in what that damage could do.
It could trickle down into people in the field. Um, so we take that very seriously in making sure that we are implementing the right processes to protect not just our people, but the people that are going to be using, you know, and purchasing our product.
[00:05:45] Matt Tverberg: And then comparing it to some of the other, I guess, technology companies where you've built programs, what would you say are the really major differences, or are they, you know, relatively the same?
It's kind of a similar playbook.
[00:05:59] Delia Midamba: You know, our, our... We're both software and manufacturing, right? So the software piece, pretty much similar. Uh, but the manufacturing piece, obviously there's a lot more, there's a lot bigger scale to protect. Um, I think in software we're focused a lot more on the people because generally speaking, if you break into our office, you know, you're not really...
You're not stealing our source code for per se. But you know, if you break into a, a facility where we're manufacturing boats, you could tamper with the boat, which could put people in harm's way down the road. You could physically take an asset of ours, right? Versus, you know, software where you, you know, maybe you hack it or maybe you do something that affects the code.
But breaching an office in a manufacturing sense comes with a, a lot more risk.
[00:06:42] Matt Tverberg: Absolutely. And you know, I recently read in the news actually, Saronic was in the news for something kind of exciting that the, the listeners may actually be aware of, but your vessels were part of a, a recent rescue mission- Yep
right?
[00:06:56] Delia Midamba: Yep.
[00:06:57] Matt Tverberg: Talk a little bit about that.
[00:06:58] Delia Midamba: Sure. The US Navy, um, US Department of War, I should say, recently used one of our, our vessels to help rescue two pilots that were downed in their helicopter. And-
[00:07:09] Matt Tverberg: Was that a, a big moment for, for you all at the office?
[00:07:12] Delia Midamba: Oh, absolutely. I mean, you know, we talk about what we're there to do, um, and so to finally see that come to fruition was definitely a moment of like, "This is why we're here."
You know?
[00:07:23] Matt Tverberg: Uh, yeah. Could almost imagine it's like when, like Blue Origin launches a rocket, like our vessel just saved lives.
[00:07:30] Delia Midamba: Yeah. Lit- literally saved lives. Yeah.
[00:07:32] Matt Tverberg: That is so cool. So given you like started in the Department of Foreign Affairs and you were supporting interests in the Middle East, uh, and then obviously, like I mentioned, building programs at some technology companies, what do you think pulled you this, this direction?
[00:07:53] Delia Midamba: In, like, which direction?
[00:07:54] Matt Tverberg: In, in the direction of, like, moving from the technology to the, the mission and the defense-
[00:08:00] Delia Midamba: Sure ...
[00:08:01] Matt Tverberg: side of
[00:08:01] Delia Midamba: things. Yeah. Um, I think I missed the mission, right? Um, not that- W- Not that I wasn't bought into the mission of the tech companies I was at. Like, still doing really cool things, really important things.
Don't wanna, you know, um, don't wanna be dismissive of the things that they're doing. They were doing awesome things. But, you know, working for the government, I was a lot more tied into national security and the protection of the nation. Um, and I missed that piece, right? Obviously, doing things like being a volunteer firefighter, search and rescue, those kinds of things.
I, I like to help people. Um, that's something I enjoy. And so I was looking to get a little bit more of that back into my day-to-day.
[00:08:40] Matt Tverberg: Yeah. I bet we could have a whole episode about your search and rescue time though.
[00:08:45] Delia Midamba: Probably.
[00:08:48] Matt Tverberg: So a, a little bit about your, your founder, Dino. He was a, actually a Navy SEAL, including many years on SEAL Team Six, which is pretty impressive.
Yeah. With a founder that has a, a background like that, does that make your job easier or harder?
[00:09:06] Delia Midamba: Um, I'd say easier in general, right? Uh, Dino gets security, so where I have to spend... In my previous roles, I'd had to s- have to spend a lot more time explaining why things are important. Um, I think he gets it in general, um, and he's more just like execute it in a way that makes sense, right?
I don't have to expend as much energy on the like, "This is why we should care. This is why we should..." He's like, "I get it." Like, "Just go do something that makes sense." Uh, so it actually helps.
[00:09:33] Matt Tverberg: Ah, that makes, that makes a ton of sense- Yeah ... 'cause, uh, other guests we've had, they have to convince people why security is important.
Yeah. And Dino must get it. He gets it. He, he gets it. Yes. Probably a very collaborative partnership then, and- Yeah.
[00:09:47] Delia Midamba: Absolutely ...
[00:09:47] Matt Tverberg: you know, whatever budget you need to make the place secure- I
[00:09:52] Delia Midamba: wouldn't go that far. Wouldn't go that far. We are a startup. We, we do have to mind our budget, you know? Yeah. We can't... I can't just spend whatever I wanna spend.
We don't need Fort Knox. Um- ... so there's still a balance of like what is the risk and, you know, how much are we willing to buy down? But, um, but he gets it.
[00:10:07] Matt Tverberg: Got it.
[00:10:08] Delia Midamba: Yeah.
[00:10:08] Matt Tverberg: And, and what would you say, uh, I guess comparing the relationship that you have with him to some of the other past roles, and you mentioned the differences, that less explanation.
Is there anything else that you think would be helpful for our viewers when they look at building out their programs and communicating the value of security with their, their leadership?
[00:10:30] Delia Midamba: Sure. I mean, at the end of the day, you know, does Dino get security? Yes. Is that his day-to-day concern and worry? No, right?
It's still my job to understand the landscape and then be able to articulate to him what I'm doing and why. So at the end of the day, it all boils down to risk, and the risk that we are willing to accept and the risk that we are not. Um, and so being able to articulate that in expressing what resources you need, why you need them, when you need them, and the cost, right?
Um, "Hey, this is the risk. I think we should bring it down to here." They may come back and say, "No, actually, I wanna bring it down only to here," you know? "I think you're being a little bit too conservative with the risk. We are willing to accept more risk, so what's your recommendation based on that?" Um, and being, and having framing the conversation and being flexible and understanding, like, your risk tolerance may not be their risk tolerance, right?
And so coming to an agreement on where they want that risk tolerance to be and then implementing based on that.
[00:11:26] Matt Tverberg: Got it, and that could be a mix of technology and process, I assume.
[00:11:30] Delia Midamba: Oh, 100%. Yeah. Yeah.
[00:11:32] Matt Tverberg: Do you have different, uh, I guess, risk tolerances based on the location, or is it-
[00:11:41] Delia Midamba: I wouldn't necessarily say it's based on location, um, but it is, you know, for exa- I said we are a manufacturing site, right?
So our offices do different things. Not every site is a manufacturing site. So there is gonna be the... For example, we could tier our sites and say a tier one is we're manufacturing, and we've got R&D, and we've got this, that, and the other thing. Um, and maybe a tier two site is a test site. So there's, there's assets there, there's boats there, but we're not manufacturing them.
Um, you know, maybe a tier three site is like, it's a, it's an office where we've got, you know, engineering and things, but there's not boats on site and, you know. So based on the tiers, the security profile might look a little bit different.
[00:12:19] Matt Tverberg: Okay. That makes a... Perfect. That was very helpful. Thank you for that So, Seronic is, it, you're more than a, a shipbuilder, right?
You, you have an AI component, and obviously it's an autonomous vehicles. That means there's a lot of valuable assets that aren't just the ships themselves. So, with that in mind, what unique challenges do you think come with protecting both, like, AI data, your people, and then also the, the vessels and the, like, balancing the security and compliance expectations that also come with that?
[00:12:55] Delia Midamba: Sure. Um, it's a very strong partnership between me and our cyber team. Mm. So, you know, when you look at the AI components or the software components really, um, that's a strong... You know, the attack surface there is probably more gonna be a cyber incident. However, a physical breach could lead to the compromise of those attack surfaces, right?
Um, so it's a very, very strong partnership between me and cybersecurity looking at the whole picture, um, and understanding where those potential gaps in our, you know, footprint come from, and then working together to fill them.
[00:13:32] Matt Tverberg: And how are you collaborating with them to, like, disseminate the information down?
Because really a security program's only as good as th- your employees and the people obeying the policy, right?
[00:13:43] Delia Midamba: Yes.
[00:13:44] Matt Tverberg: Absolutely. So, so how do you, how do you balance that with them, and then how are you going about ensuring that they're followed?
[00:13:52] Delia Midamba: Yeah. I mean, like, we're still a young company, so we're still ironing some of that out.
But we're looking at joint products together. Um, you know, joint messaging. A lot of the messaging, it's like, "Hey, I wanna send this thing out. Is there anything you guys wanna add to it?" Um, we don't wanna hit them with too much from different channels. As much as we can make it one cohesive message, "Here's some physical risk, here's some cyber risk, they're related, go forth and conquer," um, rather than physical's messaging over here and cyber's messaging over there, and somebody el- Right?
Try to bring it all together. And then the enforcement part w- w- we can't really be the enforcers, right? That's really more of an HR and a legal, um, task to do. Um, so what are those actual consequences? Are there real consequences for things that happen? And people make, make mistakes. People will always make mistakes.
We're all human. So it's not a culture of, you know, "How dare you," and "If, if you do one thing wrong, you're out of here." But, um, there have to be real consequences or people won't take it seriously.
[00:14:50] Matt Tverberg: Right. Yeah. So it's just a unified messaging front, and then having people understand the why behind it,
[00:14:57] Delia Midamba: it seems.
Absolutely. Yeah.
[00:14:59] Matt Tverberg: Makes, makes a lot of sense. So you, you didn't inhi-inherit a security program here. You, you came in, and you're basically building the plane as it- as it's fly- You're building the ship as it's sailing- ... we will say.
[00:15:13] Delia Midamba: Yes, yes.
[00:15:16] Matt Tverberg: But you have, uh, sites across the US, and in, in Australia now. And Envoy, we talk a lot about multi-site governance and- Mm-hmm
and centralized overn-oversight to keep consistency, as we were just kind of talking about. Yeah. The consistent policies. But it's a hard thing to do and solve. So as you're building a security program, and it's a fast-moving, fast-growing company, what are the most important things, you think, to keep things consistent?
[00:15:47] Delia Midamba: Sure. Um, I think the employee experience, right? So I shouldn't have five different badges for five different offices, right? One badge, make it work everywhere I go. Um, the process for bringing a visitor here should be the same process for bringing a visitor over there. Um, maybe on the background things are different, right?
Maybe the NDA that gets signed in Australia is different and meets requirements for that locale, but they don't know that, right? From their experience, their process, it's the same thing. The expectations are the same. No videos and photography in the office. Great. Got it. It's consistent everywhere you go, you know?
And the more consistent you can make it, the better people would h- will adhere to it. It's less for them to remember. Um, but it also just creates a better experience for the employee.
[00:16:34] Matt Tverberg: Got it. Yeah, and then when you travel from office to office, the expectations are always the same, and-
[00:16:39] Delia Midamba: Yeah. It's never like, "Oh, I didn't know that I can't do that here," you know?
It's like s- same, same everywhere.
[00:16:46] Matt Tverberg: It's always the best, "I didn't know I couldn't do that." So one of Envoy's strengths is we help organizations manage compliance through identity verification. You've built workflows that route guests through trade compliance and security reviews based on factors like nationality and whether or not they're, um, a US or foreign national.
[00:17:09] Delia Midamba: US person.
[00:17:10] Matt Tverberg: US person.
[00:17:11] Delia Midamba: Mm-hmm.
[00:17:11] Matt Tverberg: What makes this process more complex than a standard visitor process?
[00:17:18] Delia Midamba: I think the teams that need to review and approve aren't like standard teams that would normally be involved in your visitor sign-in process. Um, so we have a, a USG security team, or government security team, um, and they need to review certain types of visitors, and so making sure that they have the information they need, um, ahead of time so that they can do the right reviews, right?
Then there's your traditional security reviews of, you know, criminal background and things like that, that go to with my team, separate team. Um, and then there's some legal compliance elements as well. So- Being able to route each visit request or each visitor through those teams quickly, right? The visitor has no idea it's happening.
They just know that they signed in, um, or they received an invite and they filled it out. Um, and even their host doesn't really know it's happening. It should all happen seamlessly in the background. But it makes it more complex 'cause it's not just sign this iPad and walk in
[00:18:15] Matt Tverberg: And I, something I've heard too when, when people have these more complex approval flows is they try to measure, like, the time to approval.
Mm-hmm. So how fast can I get from this person wanting or needing to come to a facility to when they either have the green light or the red light? Is that something you try to consistently work on in, like, bringing that time to approval down, and how has that evolved since you've started doing this for Saronic?
[00:18:44] Delia Midamba: Yeah, absolutely. Um, like I said, we don't want the visitor to know that what's happening in the background. We just want them to have a seamless experience. They came to Saronic, they signed in, they're good to go. Um, there are some requirements that we have as a defense contractor that certain things need to be screened in advance.
Um, so we try, and again, this is part of the culture and training of employees, right? We're trying to get people to do invites in advance, um, as much as possible so that we have the b- amount of time we need to do these reviews. But it doesn't always happen, and we have to be flexible with that, right? We don't wanna be a hindrance to the business.
We just wanna make sure that we remain compliant with all of our, our standards. So tracking, you know, how quickly can this person get to the review is mostly about are there multiple people that can do the review? Um, we don't want any single points of failure, so if this person's out, who else can do it?
Who else can do it? Who else can do it? Um, so that it is a seamless experience for the visitor.
[00:19:40] Matt Tverberg: Got it. So the, the moral of that is invite your visitors.
[00:19:44] Delia Midamba: Invite your visitors, please. Please.
[00:19:48] Matt Tverberg: So you're a design partner for Envoy, and you actually are helping us shape our products. So knowing we have a great partnership, what does a, a company like yours value most when you look at tools across your workplace?
Sure. So how, how is a good vendor partnership, and, and what does that really look like for you?
[00:20:09] Delia Midamba: Yeah, I mean, from the partnership perspective, you guys are very, very receptive of feedback, of new feature requests. "Hey, we need it to function like this. It kind of does it, but it doesn't really." Um, and you guys, you hear us out, and it's implemented fairly quickly for, you know, the size of your company.
Um, but also the, our needs differ from, you know, like some of my previous employers, just because we do have some compliance elements that we need to reva- be able to track and document. Um, and so tools that allow us to do that, right, easily without pen and paper.
[00:20:42] Matt Tverberg: And as you've gone through this process and, like, I imagine you'd said that things stay consistent, but they tend to change.
And are you having different regulations that come down on an annual basis? Like, how often are you doing a review of the current processes? Is it, is it ongoing, or is it something that you do quarterly? Like, w- I guess talk me through how you-
[00:21:05] Delia Midamba: Sure ...
[00:21:06] Matt Tverberg: stay on the, the front edge of any changes.
[00:21:08] Delia Midamba: I'd say for the most part, you know, um, the requirements aren't changing.
Um, the company is growing, and our needs are changing, and how we meet those needs is what j- drives kind of changes to our process. Um, as far as evaluating them, it's kind of a constant loop, right? Um, we'll open a new office, and the people will be like, "Well, this doesn't work for us because the way the office is designed or whatever.
Where, where is this gonna happen? Where is this gonna take place?" Um, or, you know, customer feedback, um, people's feedback of their experience coming into the site, right? They'll say like, "Hey, this took way too long. Like, how can we make this faster?" Or, you know, big groups is just always a challenge. What can we do to speed this process up so they're not waiting in the lobby for 15 minutes?
That's eating into, you know, our very tight schedule of what needs to happen. Um, so we take all of that feedback, and then we, we refine our processes. Um, but it's really just a feedback loop that helps us.
[00:22:06] Matt Tverberg: Sure. Sure. And are you part of the process to decide on where an office goes? Like, do you work with the real estate team, or is it more so that real estate team decides like this is the best location, and then you come in and give your, your security eyes on it and then work backwards from there?
Is that-
[00:22:26] Delia Midamba: Yeah, I mean, I think the needs of the business really determine locations, right? The real estate team is given parameters based on what the business is needing and looking for. They take those parameters. They find some sites. Um, you know, they'll ask, you know, "Hey, there's this... We're looking at this one versus that one.
Do you have any thoughts?" I'll say, "Well, this location's gonna be better from a security perspective." But obviously security's not the only thing we care about, so they're, they're looking at a whole bunch of things. Um, and they make the decision on what the final facility is, and then from there we work on designing it and making it, you know, meet the needs of the business really.
[00:23:00] Matt Tverberg: Right. It's gotta be fun, fun projects to open.
[00:23:04] Delia Midamba: Absolutely.
[00:23:05] Matt Tverberg: Fun, stressful, you know.
[00:23:08] Delia Midamba: Depends on the timeline and we have to get it done, right?
[00:23:10] Matt Tverberg: Uh, so we, we tend to describe, you know, a journey from the front door for visitors and, and workplace operations all the way to the SOCs, so a, a full security- Mm ... um, visit.
So how do you think about it at Saronic? W- what does the front door stop and have the sign and experiences? Is that the foundation, do you think, of, of the beginning of this security journey? And then where do you think that physical and digital security become, like, one?
[00:23:42] Delia Midamba: Yeah. Um, ideally it starts with the invite multiple days before- Hey
the visitor shows up in the lobby. Ideally. Um, but the, for the f- from the visitor's perspective, you know, it shows up when they show up at Saronic. How easy is it to find? How easy is it to navigate? Where are they parking? Once they get in the lobby, is there someone there greeting them? Are they pleasant or are they rude, right?
Um, that's all part of their visitor experience. How easy is it to sign in, get the badge, keep going, um, return the badge at the end of the visit is a pain in the butt because your visit ended way down there and there's nobody to pick that badge up, and you now gotta truck all the way up here to return the ba- Like, all of those things play into the visitor experience from a security perspective.
And then as far as where the physical and the digital meet, you know, I, like I said, ideally we're getting these invites in advance, so if there are concerns or changes that need to be made, "Hey, this person actually didn't pass our screening process. Somebody else needs to come instead," those conversations can be had ahead of time.
You know, it's always awkward. Somebody's made time, taken time out of their day to get to your office, and if you have to turn them away for whatever reason, um, it's not a good experience for the person. It ma- it's awkward for them. You know, maybe they knew that there was something that was gonna potentially turn them away.
Maybe they didn't. Now they've got... Maybe they have colleagues that are now questioning, like, "Why, why couldn't you come on site? But we got on s-..." You know? It's an awkward experience, so as much as we can get Ahead of that, and as much as we can make the physical experience seamless and smooth, um, the better
[00:25:12] Matt Tverberg: Got it.
And i-information
[00:25:14] Delia Midamba: ahead of time Information ahead of time Totally Yeah
[00:25:17] Matt Tverberg: Well, another thing that I know likely falls under your purview is the, like, incident readiness. And, you know, speaking of, like, the visitors coming on site, but you're also responsible for, like, the employees' safety and the duty of care- Yeah
for them. And, you know, as you think through and, and have different types of facilities, now you have, you know, offices and manufacturing centers, and the incident readiness likely varies from site to site. Like, how do you design programs like that and ensure that you're ready for these types of incidents, and, um, how can those vary from the tiered sites like you were mentioning before?
[00:25:59] Delia Midamba: Yeah. Um, we have an EH&S team, um, that I work very, very closely with as well. So a lot of it is joint, um, like, tabletop exercises. You know, "Hey, we're gonna practice what happens when the fire alarm is pulled." Um, and not just from an employee perspective, but from our incident response perspective. So, you know, how is the GSOC notified?
Did the GSOC notify the right people? Um, you know, did they open the right channel on the radio to, for the communication? Like, all of these things get tested and reiterated on, um, in the background. So when an actual incident happens, hopefully it's smooth.
[00:26:41] Matt Tverberg: Yeah. And I have to say, like, when those things happen, you always learn something, right?
But the, trying to eliminate the unpredictability, I guess, of these types of events is why we go through these ty- I guess, like, rehearsals, we'll call them.
[00:26:58] Delia Midamba: Yeah. Um, and also just to get people used to, like, you're probably gonna make a mistake, and that's okay, right? Like, most of the time something will go wrong.
Let's make it a little something and not a big something. Right Right? Um, but getting people used to, like, "Okay, I do this, and then I do this, and then I do that. And if I don't know what to do, I reach out to this person."
[00:27:20] Matt Tverberg: So there, there's, uh, something we, we like to talk about here, and it's just like you were, you were alluding to it, actually.
Like, how do you create this frictionless experience for visitors where a tool becomes just, like, part of the experience, and it's not really thought about How do you take something that, you know, you want to be a good experience, but still be able to be super secure? Like, where, where is that line for you, and, you know, what do you think is a good thing for the, the listeners to keep in mind as they design programs like this?
Like, how do you weigh the frictionless versus, like, the secure?
[00:28:01] Delia Midamba: I look at it as, like, what are we com- legally bound to do, like, per our contracts and, you know, our customers, et cetera, um, versus, like, what is a nice-to-have that we're just doing because it makes sense, right? As long as we can remain compliant with the, like, what we are required to do, um, the rest of it can be fluid, right?
So we talked about big groups, and big groups are hard to sign in, and this and that, and the other thing. It's like, okay, what is the actual requirement that we have to meet? If it's just that we need to know who's coming in and out, and we need to document, you know, US persons, that, great. To make big groups faster, screw the iPad, you know?
And we're just gonna, like, hand out badges and check IDs and get you in the door. Mm. Right? Um, and that's a exception to the rule. The normal process is still this. We'll go back in the back end and make sure all of this gets documented in Envoy. Um, but what is actually required that we need to do, and then what is just a nice-to-have and we can do it later or on the back end or switch it around, um, so that the, the customers have a nice experience coming in.
[00:29:04] Matt Tverberg: Got it. Just f- being flexible.
[00:29:06] Delia Midamba: Yeah, absolutely.
[00:29:07] Matt Tverberg: Being flexible while ensuring to check the critical boxes.
[00:29:11] Delia Midamba: Yeah.
[00:29:11] Matt Tverberg: Got it. So you're here with a small group of Envoy customers today, which is why, um, we're so lucky to have you here from Austin. But what challenges can you, like, quietly share that people outside of regulated industries, they don't probably see?
What are some things that maybe keep you up at night that didn't in the past?
[00:29:37] Delia Midamba: Oh, um, definitely, like, office breaches. I think in the past, office breaches were more related to, like, workplace violence, an active shooter, and things like that. Um, but for me, it's more like who can get in our facility and what can they get onto, or what can they do?
If they touch our product, what could go wrong, right? Um, we talked about the rescue, but what if that boat had been compromised in some way because there was a breach in the office and someone did something to that boat? That's what keeps me up at night. Yeah.
[00:30:06] Matt Tverberg: Yeah. Can imagine. So with that, you know, the, the real risk, I think, comes with the behaviors that we're trying to instill.
Mm-hmm. And that's really what helps prevent these things from happening. Technology's one piece of it, but at the end of the day- Yeah ... it's, like, us and the, the employees following the process.
[00:30:29] Delia Midamba: Yeah.
[00:30:30] Matt Tverberg: What, what's one thing about people and the, the security teams that maybe is consistently underestimated?
[00:30:39] Delia Midamba: Oh, I think people always assume people are rational, and they're not.
They're highly irrational. And it's- Even more ... it's hard to predict what people are gonna do, you know? Um, at the end of the day, human behavior You could have a bad day, and the behavior that I would expect and predict from you could be completely off just because. And I'm not gonna get a warning about that, right?
Until I'm already interacting with you, until something's already going wrong. Um, and so the human factor adds an element of unpredictability that you always have to be able to pivot and account for. So the security teams always have to be reading people, assessing behavior, and then responding based on the signals they're getting.
But I think people kind of always assume that, well, everybody has everybody's best intent in mind, and everybody's rational, and everybody's... You know, no. Unfortunately, that's not the case. Okay, '
[00:31:33] Matt Tverberg: cause my coffee order was wrong today, so I'm gonna take it out on everybody.
[00:31:38] Delia Midamba: Perhaps, yeah. Exactly.
[00:31:38] Matt Tverberg: Whatever it may be.
[00:31:39] Delia Midamba: Yeah.
[00:31:41] Matt Tverberg: So how would you, how would you define success? You are protecting a mission and real-life national stakes at a company moving incredibly fast. So when you step back from your day-to-day, like, how are you defining success in your role?
[00:31:57] Delia Midamba: The employee experience, right? I think a lot of the time security is seen as a hindrance or a blocker, or like, "Hey, we can't do this 'cause security said," you know?
Um, so what is the employee experience, and are, are they happy to interact with security, or are we seen in that kind of negative blocker kind of a light? So if we can get to a stage, or we are in a stage where, um, we're not seen that way, where people are comfortable coming to us for help, where people are willing to, "Oh, security asked us not to do that, so we're not gonna do it," rather than seeing us as, you know, some sort of hindrance or blocker, that's a win for me.
Obviously, getting to a place where the team feels comfortable handling anything that might come their way, 'cause we never know what it's gonna be. So where they feel like they've been trained and are able to handle different types of incidents and events, that's also a win. And then, like I said, consistency across all of our locations, that's a win as well.
[00:32:51] Matt Tverberg: So the success of your people.
[00:32:54] Delia Midamba: The success of the people is the success of the team.
[00:32:58] Matt Tverberg: Love it. So la- last question. You, you've built a career in a field where a lot of people probably don't even know that this exists as a career path, and you did it as a woman in a space that is historically male-dominated.
And I know that Envoy's Women at Security breakfast in ISC West this spring, you also were part of that. So would you recommend this profession to the next generation? And what's the opportunity you see for people coming up right now, especially for a woman looking in a career in, in security? What advice would you have?
[00:33:35] Delia Midamba: Um, I would absolutely recommend this. I mean, I enjoy doing what I do, so I would definitely say yes, I recommend it. Um, advice, you gotta have thick skin. You do. Um- People are not always happy with security, right? Sometimes you just have to be that voice that's like, "I'm sorry, guys. Like, it, it just has to be this way.
I would love to give you what you want, but you're not gonna get it." Um, and people don't like that, right? So you gotta have some thick skin. People are gonna complain. People are gonna whine. People are gonna, you know, do whatever. Um, as a woman, you, you're most of the time, if I'm in some space that is dedicated to my field, I am one of the few or if not the only woman in the space.
You have to be comfortable with that. Is it challenging? Sure. Has it stopped me? No. But you have to be comfortable being the one or the only or the few. Um, and you have to be comfortable, you know, managing people who are gonna have different backgrounds and different ideas and different, you know, perspectives from you.
Um And you have to be able to build teams where that's okay. There's that mutual respect, you know?
[00:34:42] Matt Tverberg: How, how do you remain, like, passionate about what you do? What gets you up in the morning, and, you know, how do you Make Yourself @ Work and- Yeah ... and continue to thrive in, in such a, a cool industry?
[00:34:57] Delia Midamba: Sure. I mean, like I said, I love helping people.
So for me, security is about helping the people, helping the business in general, making sure that the business can do what it can, what it needs to do. That's why I say, "I'm not here to tell you no. I'm just here to say yes, but we need to do it in this way to be secure," right? So making the business operate in a secure way so that the people can keep doing what the people need to do.
[00:35:19] Matt Tverberg: Well, Delia, thank you so much. You're very impressive. I think your company's doing some really amazing things, and I'm really excited to continue to watch Sironik grow and protect our nation at the same time. So thank you for protecting your people as well.
[00:35:34] Delia Midamba: Awesome. Thank you for having me.
[00:35:35] Matt Tverberg: With that, this is another episode of Make Yourself @ Work.
I'm Matt Tverberg, and Delia, it's been an absolute pleasure. We will see you all next time.