CyberWire Daily - Uniting Women in Cyber Podcast: Breaking Barriers in Cybersecurity with Cybersecurity Girl. [Special Edition]

Episode Date: June 28, 2026

In this Special Edition episode, N2K CyberWire's Dave Bittner sits down with Caitlin Sarian, widely known as Cybersecurity Girl, to explore how storytelling, authenticity, and community are reshaping a more human-centered cybersecurity landscape. Recorded live at The Cyber Guild's Uniting Women in Cyber (UWIC) Event last fall, this candid conversation highlights Caitlin’s unconventional path into cybersecurity and her mission to make the industry more accessible and relatable for all.  Together, they explore how breaking down technical barriers can unlock new pathways into the field especially for those from nontraditional backgrounds. UWIC brings together industry leaders, practitioners, and emerging talent to advance the cybersecurity workforce through leadership, innovation, and inclusion. Join us on Oct 8 for UWIC 2026!  Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyberwire Network, powered by N2K. I'm Dave Bittner with this Cyberwire special edition. At a time when cybersecurity faces a growing talent gap, conversations about who belongs in the industry and how people find their way into it have never been more important. In this episode, recorded live at the Cyber Guild's Uniting Women in Cyber Event, I sit down with Caitlin Sarian, better known to many as Cybersecurity Girl.

Caitlin has built a large following by making cybersecurity more approachable, more relatable, and more human. We talk about her unconventional journey into the field, the power of storytelling, and why authenticity and community matter when it comes to building a stronger cybersecurity workforce. We also explore how breaking down technical barriers can create new opportunities for people from non-traditional backgrounds, who may not have seen a place for themselves in cybersecurity before. That's ahead on this Cyberwire special edition. Well, thank you all for having us here today. I am super excited to be here,

and most exciting of all is the opportunity to interview Caitlin. So welcome, and thank you for taking the time for us today. Thanks for having me. I'm so honored to be in the room with all of you guys. I can't even believe I'm here. So thank you for having me. Yep, yeah. So let's start out by giving our audience an opportunity to get to know more about you.

Can you take us through your professional career? Where did you get your start? And what led you to where you are today? Yeah. So my career has kind of taken crazy turns. And I started as an elementary education major in college 20-something years ago. And I changed to aerospace engineering when I found out how cool it could be. And I got my master's in aerospace engineering.

And when I was applying to jobs, I decided, I'm going to do tech consulting because I wanted to try different things. And when I was applying to Ernst & Young, they were like, are you interested in cyber? And in my head, I said, absolutely not. I do not code. I am not a man. And I'm pretty social, so I don't think this is going to work. But really, like in my head.

But as, you know, during the interview, I'm like, yeah, sure, it sounds great. Doing anything to get the job, right? So I said, yeah, sure, I would be interested. I don't really know that much about it. but I'll learn. I'm a fast learner. And I got different job opportunities at other big four Accenture. And I was really intrigued with cybersecurity. So I decided to go into Ernst & Young or EY.

And I learned literally everything on the job. So I started in cyber transformation, worked at large companies after data breaches. I helped companies with, you know, protecting themselves and really assessed companies on the 20 kind of key domains in cyber. And that's really what got my foot in the door and I started realizing, oh, I don't have to code. This is great because I did MATLAB in college, and I don't know if you guys know what MATLAB is. It's pretty useless language, but that was like,

MATLAB and physics were like the two worst classes I had throughout my college career, and I barely scraped by. I think I got C-minuses and everything else I got A's, but terrible MATLAB. So I never thought I'd get into cyber, and I also thought, you know, I'm going to try the cyber. It's probably not going to work out, but at least I get the job and I can transfer it into something else. And then I ended up loving it, and I got really excited about data protection and privacy. And then I had the opportunity to actually move to the UK for two years to help EY build out their data protection and privacy arm before GDPR came into play. So I was absolutely loving every second of it. And I moved back just in time for CCPA.

Who here is privacy people? Anyone? Okay, a few. So, you know, it's really fun. Great. CCPA, all of the stuff. But I did privacy, and during COVID, I got to slow down a little bit and start rethinking my life. And I kind of worked so hard.

I was grinding. I was climbing that corporate ladder. I got to the top and I'm like, okay, well, why am I? What am I doing? Like, this is good, but this isn't what I'm supposed to do. And so I really started thinking about how I could give back to the community. Like I said, I started as an elementary education major. I loved teaching kids.

And I was really, really passionate about how can you. I get the next generation into cyber? And six years ago was when NIST came out with their kind of, I think they had an assessment saying, you know, by 2025, we're going to have 500,000 open cyber jobs and no one to fill it. Now we can talk about how that is not true. But so I was like, okay, we need to get to the next generation and teach the next generation like what a career in cyber looks like. It doesn't technically need to be coding. You can be any type of person and succeed as long as you're excited. So I actually started doing all my stuff on TikTok only under the alias of cybersecurity girl because I was mortified of what people would think about me. Again, I was a director level at a large

law, a global law firm. And I was like, if these people find out that I'm on TikTok, like doing little dances, try to get people into a career in cyber, like, I don't know what's going to happen. found out I didn't really care because it worked but yeah so I started like five years ago and again the cyber security girl alias was like so no one would find me I was again really embarrassed and then it just kind of grew so started cyber security girl with three main pillars and it's still the three main pillars to get more women into STEM fields as a whole because I also had the wrong impression of cyber and the wrong impression of what an engineer looked like and then to get more people interested in a career in cyber as a whole to get to kind of fill that that 20-25 gap and then to

just educate the public on how to be safe online and uh i found out that that piece is like the piece that i'm really passionate about and i can thank my mom about that because pretty much all of my inspiration as had came from the questions that my mom asked me and then i was like i should just make a video about this so those videos just kind of blew up and now i'm i'm honored to be able to work with you know, NATO and NIST and, you know, I collaborate with ABC and Good Morning America. And I just want to educate the public because I truly believe, like, this group is amazing. Like, we are all so passionate about cybersecurity. But at the end of the day, we probably aren't the weakest link.

And the people that aren't in this room are the ones that need to kind of understand how important cybersecurity is. So that's kind of, I was like a short version of my journey, but that was a pretty long version. Yeah, that's good. I would say what I'm hearing from you, a common thread through your journey is a type of fearlessness. You weren't afraid to take on the next thing or try the new thing. Is that an appropriate way to label it? Yeah, I was afraid to an extent because again, I didn't want my coworkers to find out I was on TikTok. So I found a way around the fear and I kind of did it anyways, but you're right. I was told a long time ago that I like to be in uncomfortable situations and put myself in uncomfortable situations.

And to me, that's the only way I learn. So I do have a kind of fearlessness in that sense, I guess. Are there any examples from your career where that did not serve you well, where you found yourself up against a wall or a speed bump? So I think one of my superpowers is kind of blocking out any of the negative, especially being on social. media. So, like, honestly, I don't have any specific ones that come to mind, but I guarantee you there's been many times where that was a bad idea. But I think I'm a firm believer in the fact that nothing's wasted in your career. So in your life in general, like, again, now I kind of find it funny that I am teaching the public because I started as an elementary education major,

and I absolutely love teaching. But every single thing that you do kind of navigates you the right way and where you're supposed to be. And again, even if there was something really negative, it's gotten me here. And I'm like so grateful to be here. And so I, I'm kind of tunnel visioned. And if something negative happens, like, I mourn it for a day. And then I'm like, all right, move on because that's not the right thing. But yes, I'll keep it in the back of my head. If I find, remember an example. Just jump in. Yeah. Yeah. I was like, one time. Right. Well, you mentioned learning on the job when you first entered the cyber realm of things. You already had, you had your master's degree in another field. What was?

Was that on-the-job training like where you, did you feel welcomed? Yes. Yeah. So I felt extremely welcomed. I had amazing mentor named Danielle and also Patrick, and they were kind of director level at Ernst & Young, and they kind of took me around to all these conferences and introduced me to people. And we're just explaining how cybersecurity really fits into every aspect.

Because when you're not in it, you don't realize that it's everywhere. Like, and now it's even more, like, it's even more prominent because, again, we have you know, smart cell phones. Like we are constantly in and connected in everyday life that it is literally in every aspect of our life unless you're living under a rock. And so those mentors really taught me everything. And I'm also like annoying about questions. I constantly am like, if I don't understand it, I'm just going to ask you. And so I, they had to field all of my probably very annoying questions, but I just love being able to kind of just like push myself in and learn and take that time.

You spent some time at TikTok, is that correct? Tell us about that experience. Yeah, so I actually got my job at TikTok from TikTok. A lot of people get very confused about it. They're like, oh, you started to TikTok because you worked at TikTok, and it was actually the opposite way around. So I got a job at the privacy department in TikTok, and then I started speaking to another lady that was there,

and she wanted me to speak, and she's like, oh, my gosh, you're trying to find a new job. Like, we want you to lead the training and awareness piece globally, at TikTok, and I was like, oh, okay. And so, and I never did training and awareness before, but because my content was basically training and awareness, she was like, you should, you would be perfect for this. So I ended up going into TikTok as a global advocacy for cybersecurity and culture. And so I basically did training and awareness at TikTok globally, and I also advocated for TikTok. Now, I was there during the time where, you know, our CEO was on the hill.

We are lobbying. We are trying to basically answer everyone's questions. So I was kind of working with the engineers, bringing them questions, and then trying to filter out what they were saying to an understandable, digestible kind of summary. Because obviously we have the technical piece, but if we go to normal people,

they're going to just be like, what are you talking about? So that was honestly ended up being the main part of my job was trying to work with PR, work with marketing, work with legal, to try to really communicate what we are doing at TikTok and how it was secure. And this was, by the way, I started my TikTok after they had already partnered with Oracle

and when they were moving over. So once that happened, that's when I opened my TikTok. I did not open it when they were still based in China. I just want to preface that. But, and then I also, yeah, I started working at TikTok back in 20, 23 or 2024. But I wasn't, so TikTok actually has two arms. They have a U.S. arm. And then they have the global arm, which is everything outside of the U.S.

So I wasn't in the U.S. arm. I had a lot of incredible friends, ex-FBI, ex-CIA agents that were working in the U.S. arm, so knowledgeable. Obviously, Oracle was auditing us every day pretty much on the floor, and only certain people could go into the U.S. arm. Like, I wasn't allowed to even go in. So it was very strict with what was happening, and that's why I also felt very comfortable.

Again, I knew a lot of people that were working at the U.S. arm, and then also being able to see global and what was happening globally. So, yeah, it was incredible. Given your time there, do you have any insights or thoughts on the present situation that TikTok finds itself in? I think, so when TikTok was trying to get what was about to be banned, I thought it was putting a Band-Aid on a wound that probably needed 25 stitches or way larger. I think there's a lot larger of an issue than just TikTok, like surveillance or I think there were a few main issues, right? One was how do we keep our kids safe?

Is TikTok pushing our kids or our children like, you know, really bad content? I firmly believe that is not true. The algorithm gives you what you want to see. And I think there's a parenting kind of role that needs to be played in that as well. Like if you want technology to parent your children, then you shouldn't be upset with what they're going to get shown because, you know, they're going to be shown what they want to get shown unless you intervene in some way. not going to happen. So that was really interesting. I thought there needs to be a mix with technology and parenting. And I still think there should be a course, by the way, if anyone's looking to, you know, start their influence or journey or like just think of new creative ways

to help out the public, I think a parenting technology intersection would be really helpful for people. I always try to help parents with kids in technology. I think the other thing was, you know, the surveillance does trying to have access to it. And again, our team was global, but no one was in China. So it's very interesting. You know, there's also companies around the world that are also in China too. So everyone has like, you know, Chinese counterparts as well. And then I understand that this is a huge issue in the cybersecurity community. A lot of cyber professionals do not have TikTok. I believe it can be a force for good if you use it correctly. Would I be on TikTok if I wasn't trying to reach the next generation? Probably not. But that is where the next generation is

sitting whether we like it or not so we can't just continue to avoid it or to I mean we obviously there's now a new way that we're kind of having Oracle do its thing with it but and we sold it off but I think there's a lot of issues with social media as a as a whole and I felt like they were pinpointing on TikTok when Instagram, Snapchat, YouTube are all doing a lot of the same things, but because TikTok was, you know, Chinese base, they were really trying to put the nail in the coffin and try to prove a point when I think that there is a larger of an issue. What do you think? I agree. Was being an influence or something that you set out to do?

No, never. Was there a moment when you said, whoa, wait, people are paying attention to what I'm saying? It's still like that every day. Like, sometimes. I feel like I like to say I don't have imposter syndrome but every day I'm like how did I get here? Like how did I get on the stage in front of you guys that are, you know, in my opinion, just incredible humans. I don't know, but I'm honored. And every day I take it day by day. I never thought I'd be an influencer. I didn't. I mean, influencer wasn't a thing when I grew up. Yeah. Me neither. I was aging myself now. But it is such a cool concept to think that you can change and impact the world by just posting every day.

Like, I think we underestimate the value that we bring to the world, and everyone has such a unique perspective. And I actually constantly, like, nudge people and say, hey, you have a really cool, like, perspective, life story that other people are going to benefit from hearing about. And I think it's a real, again, it's very uncomfortable. Like, even to this day, it sounds really weird. I film most of my videos in a closet.

Because I, like, if anyone's in my house, I'm like, I'm not filming in front of you, but I have to post every day. And I'm not, like, I'm so uncomfortable. I don't like hearing my voice. After it's edited, it's like, it's off. And the one thing I say is, as long as I help one person, that's all I care about. So I encourage you guys to kind of take that step and be your biggest advocate, especially in a crazy, like, job world right now where a lot of jobs are either disappearing for no reason or no entiring. I think a lot of people should be their biggest advocate and start kind of posting and sharing your experience

and I promise you you're going to help, if you're going to help one person and just keep going. So I never thought it would be an influencer though. It's still very weird. You mentioned that you had good mentors along the way. How important is that to you now to be a good mentor? There's this notion of when you're, when you've made your way up to not pull the ladder up behind you.

Yeah. mentorship in cyber is everything. And I find it very interesting that everyone wants to get certifications or go to college and get a cybersecurity degree. If you don't have mentors in this space, I don't think you're going to go. I mean, I would say show of hands, but people clap if you agree with that because I just, I say that because we're on a podcast, so they're not going to see your hands.

But I strongly believe that you can't get anywhere in this field without at least one mentor, like kind of teaching and guiding. And that's why I created a cyber career club, which is a community, but it's mentor-based. And it's, you know, I have office hours every week. I bring in guest speakers. Because just no one knows how to navigate. There's so many different areas of cyber.

And I think cybersecurity now you have to be a little bit more niche because, I mean, you can do the general stock analyst role, but, you know, there's privacy. I mean, there's so many areas of cyber, like access management. Now you can specialize in AI kind of cyber. And I think in order to even get to that point, you have to have some type of mentor, especially entry level, right? Like they have no, they come to me like, I want to get into cyber.

What certification do I need? And I'm like, well, what do you want to get into? Like, what are you interested in cyber? It's like saying that you want to get into science and then trying to go be like a chemistry professor. Like I don't, you have to study the certain area that you want. So to me, mentorship is everything. And I never stop having mentors or being a mentee because you're constantly learning.

Yeah, you can applaud. Go for it. When you are mentoring folks who are just coming up, as you say, on that entry level, what's your advice? In this moment, what do you think is the most applicable way to come at this career path. Yeah. In my opinion, it's understanding the area that you want to get into, finding people in that area, connecting with them on LinkedIn, finding that, finding a few mentors, advocating for yourself on what you learn every day on LinkedIn, and then also figuring out the tech stacks behind it. So we're all talking about certifications. But my issue is certifications is like a degree,

right? It's kind of like very general, and that's not really applicable when you get into the job role. But if you're understanding the tech stacks that are sitting in every company and you know, like, you know that when they put you into that job, you can automatically start without having, you know, a long processing time or a long training time, I think that's way more beneficial. So, for example, like if you're in privacy, I know this because, see, I do privacy stuff, like, One Trust is a technology stack that sits behind tons and tons of companies. And I'm like, why don't you learn how to use One Trust or like Palo Alto Networks is like in a lot of different companies, like if you know how to work, like, some of the stack behind Palo Alto networks,

you can literally just be plugged in. And I think that's a lot more important than a, you know, a certain sort of, like a general certification. Now, there's good certifications that are more specific. But I always say, like, get more of an understanding of the tech stack behind the area that you want to work. Network like crazy. Show up to in-person meetings like in events like this, follow up. I remember when I was in college, people thought it was crazy. I would go to career affairs every semester. I collect everyone's cards. I wrote specific details about what I talked about.

Halfway through the semester, I would email them asking them how they were doing, and then I'd see them at the end of the semester. So I did that for the entire time I was in college, and I pretty much, I mean, this sounds bad, but not. I pretty much got every job I applied for because it's about, like, people want to work with you. Obviously, I did really well in school, but people want to work with you because you can communicate

and you're a good leader or you're a good person. There's a lot of soft skills that you learn from just starting to network in person. So I really encourage people to do that as well. I think that's the best bet. I always like to know what you think. Unless you're going to say you agree. Well, I do agree.

Well, what strikes me about your answer and in general talking with you is that you're very humble in the things that you have achieved, you say, and then I was promoted to such and such, eh, but you put in the work. Yeah. Right? Going to every career fair, collecting every business card, engaging with mentors, you put in the work.

And in my opinion, never underestimate the value of putting in the work. Yes. Yeah, for sure. And then, exactly right. If you're going to just do a random resume drop on LinkedIn that has no affiliation, or you're not going to cater your resume, or you're not going to cater your resume, or you're not to cater a cover letter, then there's not really a point of even applying, in my opinion. There's also some fun tricks that you can do to get around the AI bot that does resume scanning.

Go on. Well, I mean, it's... So what I used to do, like four years ago, is there's obviously a lot of times there's an AI bot on LinkedIn many times, and it scans your resume for keywords that are also in the job description. So what I used to do was copied most of the job. job description, not the whole thing, because then it would be weird. It was a 100% match, but I'd copy most of the job description, put it in my resume in white font, very small. You can't

see it even if you printed it out. But when the AI is scanning your resume, it's hitting still all those words, and then it will bring it to a person to actually review, and then you can get it. Yeah, yeah. Whatever it takes, right? Whatever it takes. Whatever it takes to get in front of a real life human being. Yeah. I didn't feel bad about it because it's not like the AI person immediately gives you, you know, the first round interview. It just pulls your resume to the top of the pile for people to actually review. Yeah. Yeah. You and I were talking and you mentioned that something that's really important to you is for people in cyber to get out of their bubble. Yeah. Can you describe what you mean by that? So who here thinks that cybersecurity operates mostly in a silo, like all cybersecurity

teams, not like each team in cyber, but like cybersecurity as a whole. Anyone? Yeah. Okay. Few people. I obviously all of us really want everyone to care about cyber. But the fact of the matter is no one really cares about cyber unless they're in cyber. And I love the fact that we can, we are, I think we're really good at collaborating within cyber teams and across cyber organizations or organizations as a whole. But what my concern is, everyday people that are not in cyber, like that work in critical infrastructure, all they have to do is click on a phishing link, and then it doesn't matter what tech stack you put behind it,

they're already in. And so my concern is always, how do we educate the public and get the public excited about kind of learning these basic tips? And I'm like, well, we have to teach them how to protect themselves at home. Because in my opinion, cyber security starts at home. It does not start in the corporate environment, even though that's how originally starts. started in the 1980s. But cybersecurity now is in every, like I said, in everyone's pocket. And so, yeah, we can continue to, like, beef up our training and awareness and our cyber

kind of resilience across teams and across companies. But at the end of the day, it's the general public that are also just as weak of a link. And so I always feel like it's my duty to help with that. But I think there's other things to think about outside of, like, just people in cyber. Do you think we all have that responsibility to be kind of shepherds for that information? Yeah, I mean, I think it's, again, starts at home. So just teaching your parents, your kids, your loved ones, like, hey, this just happened. Did you know that?

Maybe we should, like, this is why we should do X, Y, and Z. And I think just having those communications where it's, like, not some scary thing is just, like, matter of fact, here it is. Like, this is how it relates to us and here's what we need to do about it. it makes it, again, understandable and relatable and digestible, because cybersecurity, if you said cyber to anyone, it's like most people that aren't in cyber, they're not even going to think about it. It's just going to go, it's going to go through one ear or not the other.

Just like if, I don't know, I would say if, like, astrophysicist comes and talks to me about astrophysics, I'd just be like, yeah, cool. And I wouldn't know what he was talking about. And it's the same thing. That's what people think about cyber. They think it's like extremely, and it is very technical. we are all very smart people,

but we have to break it down to them in a way that they can understand, and that is not scary, because then if it's scary to them, they're not going to want to try. Before we run out of time, there is a, what I believe is a disconnect

between the reports that I see coming at a regular interval that say, we have this big cybersecurity skills gap on one side. And on the other side, I hear all of the young people who are trying to get into the industry saying, I can't get hired.

First of all, do you agree that there's a disconnect there? And what's your insights on that? There's for sure a disconnect. It makes me sad because there's so many people that are really trying to get into cyber. And I'm not sure if it's just we decided that we don't want to mentor people anymore. We decided that they're not going to learn on the job.

I think there's a few disconnects. I actually think the main disconnect is we're not teaching soft skills anymore or they're not getting soft skills in certain areas. And what I've heard from a lot of recruiters that are so like, oh, I'm recruiting it. I just don't find anyone. I'm like, how is that possible

because I know so many people applying? The recruiters are saying, you know, they don't really have the communication skills they need. They don't really have, like, it's more of the soft skills that are missing and they can't communicate what they are able to do. And on the other side, I feel like there might be some issues with, okay, we want these people that are entry level,

but we expect them to have a certain experience. And it's like, well, if you're hiring entry level, their experience is entry, which is nothing. So I think there is this very weird gap where we just need to start hiring people based off of their drive, the skills, all of that, and teach them on the job. Because there's so many eager people right now

that are looking to find a job. And there's, it's just very hard. I also think cybersecurity has never really fully been defined correctly. And I think there's a lot of like, we need to set like standard. And I was talking to Ms. Nice about this about a year ago. We need to set like standard. Like here are the 10 entry level roles, what they're going to be called and the skills that are needed. One, that will help the college board understand how to prepare the kids because I'm,

I'm sorry, but every college right now over the universities, they're all over the place. Like they have completely different things for what is needed in cyber. and if we're able to say, hey, we need these 10 basic entry-level roles like a SOC analyst or, you know, penetration test or whatever it is, and write those skills down and say, here's what we need. Colleges can align. Certification projects can align. But I think it's so different right now. And everyone's like, oh, well, our SOC analyst does X, Y, and Z. And then you look at something else and they're like, our SOC analyst does X, Y, and Z. So it's very disconnected. And so I think it'd be a lot easier if there was like kind of one set, way of, at least for the larger companies. I know it's different for small companies, but yeah. Yeah. Yeah. Personally, I don't like the term soft skills.

I wish we called them essential skills. That's true. Because I think they're important. Yeah. Which skill do you think is, like, which soft skills or essential skills, which I'm, I'm going to steal that, I should start calling it that, is like the most important to you. If you were to recruit, who would you, like, what would you look for? Oh, communications second to none.

Yeah. Yeah. And I say, you know, to everyone coming up, take a theater class, take an improvisational comedy class so that you are comfortable standing up in front of a group of people and presenting your ideas. That is the way you're going to be heard. That's the way you're going to demonstrate your confidence in your abilities and make a difference.

So, all right. Well, we are out of time. How about joining me and thanking Caitlin for being our guest today? Our thanks to Caitlin Sarian, known to many as Cybersecurity Girl, for speaking with me. at the Cyber Guild's Uniting Women in Cyber Event. Conversations like this remind us that the future of cybersecurity isn't just about technology. It's also about the people who bring new ideas, experiences, and perspectives into the field.

Thanks to you for listening to this CyberWire special edition. I'm Dave Bittner. We'll see you back here next time.