Valentina: 00:00

Everybody is touched by privacy. It is not something that is siloed in one single function. It needs to be shared across an organization. Oh the regulators are telling me to do this. No. Now the customers are expecting a company to take care of their privacy, to take care of their data. Now the investors are looking at how companies are sharing and processing and transferring those data. What I would say for companies that have a very confidential data is really try to get hacked. Why, because?

Intro: 00:38

Are you ready to know what you don't know about Privacy Pros? Then you're in the right place.

Intro: 00:46

Welcome to the Privacy Pros Academy podcast by Kazient Privacy Experts. The podcast to launch progress and excel your career as a privacy pro.

Intro: 00:57

Hear about the latest news and developments in the world of privacy, discover fascinating insights from leading global privacy professionals, and hear real stories and top tips from the people who've been where you want to get to.

Intro: 01:12

We're an official IAPP training partner. We've trained people in over 137 countries and counting. So, whether you're thinking about starting a career in data privacy or you are an experienced professional, this is the podcast for you.

Jamilla: 01:36

Hi, everyone, and welcome to the Privacy Pros Academy podcast. My name is Jamilla, and I'm a data privacy analyst at Kazient Privacy Experts. With me today is my co-host is Jamal Ahmed, Fellow of Information Privacy and CEO at Kazient Privacy Experts. Jamal is an astute and influential privacy consultant, strategist, board advisor, and Fellow of Information Privacy. He's a charismatic leader, progressive thinker and innovator in the privacy sector who directs complex global privacy programs. He's a sought-after commentator, contributing to the BBC, ITV News, Euro News Talk Radio, the Independent and The Guardian, amongst others. Hi, Jamal.

Jamal: 02:12

Jamilla, amazing to see you again. I hope you're feeling much better than you were last time.

Jamilla: 02:17

I'm good. How are you?

Jamal: 02:18

Fantastic. I am looking forward to getting into the mind of a privacy solutions engineer today. Why don't you tell us more about our guest?

Valentina: 02:27

Yes.

Jamilla: 02:28

So our guest today is Valentina Raineri. She serves as a Principal Solutions Engineer at OneTrust – the #1 most widely used privacy, security and third-party risk technology platform. In her role, Valentina supports many of the world's leading organizations on General Data Protection Regulation (GDPR) and ePrivacy (Cookie Law) solution implementations, along with hundreds of the world's privacy laws, focused on formulating efficient and effective responses to data protection requirements as well as building and scaling enterprise-level privacy programmes. Valentina is a Certified GRC Professional (GRCP) and Fellow in Privacy (FIP) and earned a Master of Science in Management from Imperial College (London). Hi, Valentina.

Valentina: 03:09

Hi, Jamilla. Hi, Jamal. Thank you for having me.

Jamal: 03:12

Thank you for coming to share some amazing value to the world.

Valentina: 03:16

Yes, I'll try.

Jamilla: 03:18

And as we always do on the Privacy Pros Academy podcast, we start off with an icebreaker question. So, Valentina, do you have a new years resolution?

Valentina: 03:26

Gosh, love this. Well, I actually have two. One is to stop drinking alcohol. Yes, that is my resolution. The second one is actually doing more volunteering. So these are my two main ones for the next year.

Jamal: 03:47

I love that. And what kind of voluntary work do you think you'd be inspired to do?

Valentina: 03:51

So I've been working in different charities, especially with kidney related problems charities. I'm not really sure how to say it in a nicer way, so I'm going to be doing that probably, and I’m going to come back to do that. But also I've just been asked to take part of the Technical Education Advisory Board for T levels, like A levels apprenticeship, and I think I will be doing that as well, but trying to kind of use my skills to help others.

Jamilla: 04:21

That's great. T levels is like revolutionizing the education for 16 to 18 year olds.

Valentina: 04:28

We're trying to.

Jamal: 04:32

For somebody who is ignorant like me, who has no idea what T levels are, is it replacing A levels when you talk about 16 to 18?

Valentina: 04:38

Yeah, they're more like a technical focus. It's to kind of like, build out that workforce that is more technical, rather than, like they're not replacing English or Math, of course, but they're giving, like, the more technical people technical skills sorry to those kids. Yeah, it's between like, 16 and 18.

Jamal: 04:57

Okay, great. Because we have massive talent gap when it comes to especially the technical skills here in the UK. So it's good that you guys are going to be making a positive impact, which is not only going to help the young people of this country, but also the economy. And I look forward to some of those individuals making some amazing contributions to the world, just like so many years ago when we had a Brit who invented the internet.

Valentina: 05:21

Yes, exactly. And there is a lack of resources and workforce that know how to be a technical support, how to translate technical problems in business decisions. Those are quite important skills to have.

Jamilla: 05:37

So I volunteer with young people, help them with CVs, help them into work, help them with homework. When I ask them what they want to do, they say, I want to do something in tech because they know that tech pays well, but they have no idea what's out there. Like, their parents would have no idea or the people, their teachers even, will probably have no idea what's out there. So I think that's really cool.

Valentina: 05:57

Absolutely. And Jamilla, just send them to me.

Jamal: 06:04

Jamilla I'm curious, do you have a New Year's resolution?

Jamilla: 06:07

Well, for like the last seven years, my New Year's resolution has been to do a cartwheel. And I still can't do one, so I'm going to try that again.

Jamal: 06:15

Do you know someone who knows how to do cartwheels?

Jamilla: 06:18

Yeah, my niece. Like, my five year old niece.

Jamal: 06:21

Okay. Are you going to ask her to coach you to do a cartwheel?

Jamilla: 06:24

I do, but then I need somewhere with a soft landing.

Jamal: 06:30

Trampoline park, that’s ot, that's our next team outing is going to a trampoline park. And you can do your new year's resolution.

Jamilla: 06:40

And what’s yours Jamal?

Jamal: 06:43

I don't do new year's resolutions. Instead, one of the things I've been focusing on is who do I want to become? Like, what is my next best self? And creating an identity, because, look, resolutions they’re meant to be broken. That's why people have resolutions. But when you look at the kind of science behind habits so you can have habits, which are things you do, but that's not enough. And you have to create systems that support those habits. And to really be able to create effective system that supports those habits, you have to have the identity. So I focus on identities, and I'm in the middle of working, actually, I’ve been speaking with my wife about who we want to be next year and what those identities should be, because when you have the identities, everything else becomes easier. So I could say my newest resolution is to go to the gym. Go to the gym for and then I probably get demotivated and end up back where I am now. Or I could say my newest resolution is or my new identity is I'm a healthy person. So that means I'm now going to make conscious choices about what I eat, what I consume, the calorific values and how much exercise I do and whether I go for a walk in the morning or not. And how I kind of get a massage and reward myself just to focus on not just health physically, but also mentally. Because health is physiological, isn't it? So I think shifting our identity is super powerful. And so for everyone who was listening or looking forward to hearing about my new year’s resolution, I don't actually have one. I'm thinking about identity.

Valentina: 08:00

Love it. So that's a very good way of looking at it.

Jamal: 08:02

All right, let's get back into privacy.

Jamilla: 08:05

Valentina, why privacy in the first place? What attracted you to privacy?

Valentina: 08:10

So I always wanted to work in tech. I'm just taking one point from the kids you help, and I like the fact of basically going into a growing sector, which is a direct tech kind of thing, right? So, like having, like, the compliance privacy translated into a technology or to actually use technology to help with compliance and privacy. That was the first thing. The second thing, I always kind of wanted to have a job that helped people. I've always wanted, like, a second reason to do business. And there are lots of companies that do it so well and so clearly look at Patagonia, for example. Like, every profit they make, they dedicated to a specific environmental issue. So it's amazing what they're doing. Obviously, not that many companies out there that do it. But the idea of privacy is, you're actually helping people protect themselves. And it doesn't have to be maybe a physical threat, but it is more like a psychological threat when it comes to privacy because lots of people are ignorant about how companies or how certain influencers, and I'm not saying about fashion influencers, of course influencers can actually manipulate the technology to make them do or think or opt in into something. So for me, it was like a way to help people protect themselves. And then I think I get bored quite easily. So I always like something changing. So it thoroughly keeps you on your toes, right. There is always like a new regulation and new guidance coming up and you have to study all over again. So I think that's super great.

Jamilla: 10:05

Yeah, I liked what you said about wanting to help people and yeah, Patagonia, something I heard about recently is all the work they do.

Valentina: 10:10

I think it's great. Those companies, clearly, they send a message, but I like that with my job, with what I know and how I can help people, I can actually make a difference. That's my main thing as well, with privacy.

Jamilla: 10:26

Yeah, definitely. And speaking of RISK, you speak at a lot of events and conferences. What advice would you give to someone who is looking to do that with their career and start speaking at events? How did you get into it?

Valentina: 10:41

Well, I do like to speak, so that's probably like the first thing on the reason why I got into it. I think like some recommendation advice that I can give. It's kind of like privacy as a market, as a sector, as an industry is quite big, it's quite broad. So I would probably suggest to anybody that wants to get into it to find a topic they really love, they're passionate about. For me, for example, cybersecurity, I really love it and I'm passionate about it. They said that, I read the news, I tried to find out what happened with some of the breaches, what are the trends of the threat in the new year and so on. So I would say find a topic that you really like. Second one is always bring it to real life examples. Like one of the things that I sometimes go on top, that's very theoretical, but it's never like something that can say like, oh, I've just talked to for an hour about this. Here’s an example. Here is what happened to other people. So I think that's super key whenever you do talks because people are going to remember the examples, they're not going to remember the theory. And then the last one is start small. So I started with my first Privacy Connect, which was after like two weeks of joining One Trust, which is very fast, maybe too fast. And it was a very good learning because I prepared a lot, I studied a lot for it. And then at my 7th Privacy Connect, it was so natural that I was even like, oh, I have a talk tomorrow. Okay, let me go into it. Because you're so used to it, you're confident. So the suggestion I will give is start small. And one of the key places that I would go with actually the IAPP KnowledgeNet, those are in every city. You just can reach out to the chapter of that specific city. You can go maybe like be on a panel first instead of, like, going doing a solo session, but totally, I would start like that.

Jamal: 13:03

Awesome, Wow. Such value there. So, Valentina's top tips for anyone who is looking to increase their personal brand who's looking to grow their personal brand and become known as the go to person in your industry or for your niche. She's got three key points. Number one, she says, start small. Look for the smaller things you can do, and then build yourself up. That will also give you time to practice, to really get your head around this and really figure out what you enjoy doing, what you don't enjoy doing. And she also gave a really good example, a really top tip for what to do when you're speaking facts, tell stories. So the stories that you tell people, that's going to resonate better with them. They're going to remember that more, and it's going to make you much more of an engaging speaker. So focus on that. And the third kind of thing you said is you can go and focus on KnowledgeNet chapters. IAPP have them. Privacy Connect have them, and I think they have a chapter chair and some sub chair. So it's also a great opportunity to network and also to really get yourself visible for sharing the message or whatever it is you're passionate about. And also, one thing I've kind of almost forgot about, or you said, Valentina, was it's important to stay relevant, like, what is happening? What are the latest trends? And make sure that you can add value and you have something important to share with people, and people will not know what's going on, and they're going to seek to look at you for that source of knowledge, and you'll be able to really help them because you're up to date and you're relevant.

Valentina: 14:28

Absolutely.

Jamilla: 14:29

Lovely. I think that's good advice for anyone wanting to give talks, no matter what sector they're in. Valentina, what do you think the biggest challenges are for you in privacy but also cybersecurity at the moment?

Valentina: 14:42

. So in the privacy world, in: 2023

Jamilla: 17:38

Yeah.

Valentina: 17:39

There is like literally like: 7000

Valentina: 19:02

My suggestion is to for sure get a hacker and tell that hacker try to penetrate all of my systems and then I'm going to use what you found out to put up all the technical measures that I need.

Jamal: 19:18

little bit by saying there's: 7000

Valentina: 19:36

Yeah, I mean, it's one way, right. So penetration testing plan that goes through the vulnerabilities within the system and usually is done by the IT team. What I would say for companies that have very confidential data is really try to get hacked. Why? Because they are going through other tools as well. It's not only about looking at the vulnerabilities from an IT perspective, but you go into maybe more social engineering or trying to get through a phishing. So understanding it there as well. Like, how prepared is my workforce to deal with a phishing attack? Do they recognize it? Do they know how to and if they don't, you know what to do. Right. You can do training, that's the easiest thing to fix because that's like literally underestimate all of it. But that could be like something very easy to do.

Jamal: 20:37

Yeah, like a very easy first step. Let's make sure we are all aware of what to look out for and how to respond when we deal with these, so then we can prevent the attack rather than something that we actually help the hacker with through the exactly, whatever, phishing or social engineering methods. And they're getting more and more innovative with how they're collecting information and how they're getting little bits of information to be able to get more information and more information and then launch some kind of an attack.

Valentina: 21:03

Yeah, but also the interesting part is we always think about like the cloud or they can attack us in the cloud or in our infrastructure in the IT and so on, and nobody actually think about the physical environment. And there was a very interesting sorry if I say interesting, but actually like something bad that has happened to a university in the UK. It was like, I think at the beginning of this year, they basically did not destroy around 300 hard drives and the thief stole the hard drives. They were able to access the data within those hard drives and sold them in eBay. Obviously, the university was charged, was fined because those hard drives should have been destroyed. But as you can see, the physical is super linked to the actual cyber part. So there is a very key part of cyber security, which is the physical security. They are so interlinked now that you can't just separate them anymore.

Jamal: 22:11

Yeah, and I think what's also really interesting, what you said there, Valentina, is a lot of people, when they actually think about the threats and the challenges and compliance, they focus so much on the middle of the life cycle rather than the full life cycle, where at the point of collection were actually threats and vulnerabilities. And also at the end, and this is a pure example of where the university haven't actually thought through the full life cycle, and they've just been irresponsible with the way they've left those hard drives. What practical and pragmatic tips can they take to really make sure they don't overlook it? And they are doing the right thing to avoid becoming the next story.

Valentina: 22:52

Well, in my opinion, having visibility into the lifecycle of every single asset within your organization is fundamental because then you avoid those things. This is the first thing. The second one will be like testing effectiveness of your controls. So it is not enough to say, oh, I'm using ISO and I'm using ISO in XYZ, the process XYZ asset. But it is, is the control from ISO actually effective for your organization? Have you implemented it correctly? Which is something that a lot of companies struggle with, especially if they don't have the right tools. The third one is, for me, training, like enabling your workforce, making sure that they have a risk mindset, that they know what to do if a breach occurs, not hide it, but they are comfortable in saying, yes, I need to report this breach because, yes, I clicked on this link, and I think this is something that all organizations should deploy. Like it's literally a cultural change in a way.

Jamal: 24:08

Okay, great. So three super tips there from Valentina of how you can really protect your organizations and your employers and your clients. So, she says, first thing is awareness. Be aware of all of your assets, be aware of all of your processing activities and make sure you look at the full lifecycle. And then Valentina says the second thing is effectiveness. Okay, yes, you might follow certain standards, you might follow certain frameworks, you might have certain measures in place. But actually she challenges you to think how effective are those things for you to be able to achieve what you've set out to achieve to begin with. And finally she says, look, easy win, make sure everyone in your team is empowered because your team is only going to be as strong as the weakest link. And if people don't have the right understanding of what is an incident, what is a breach, and when that happens, what the follow up is, and that they don't actually feel comfortable and they have fear of reporting those things, then it's going to be a big problem. And the easiest win you can have is deliver good training, back it up with adequate awareness and if you need more help, get in touch with Valentina, get in touch with us. We can definitely help you to empower your teams to do that. Valentina, I have a question for you. So a lot of people we speak to and a lot of the community that we have at the Privacy Pros Academy, it's all really focused more on the business side of things. And recently as we've introduced the CIPT, the ultimate CIPT training for non techy professionals, we're getting a few more solutions and engineers, architects coming through. What advice do you have for someone who is looking to pivot their technical background towards a privacy career?

Valentina: 25:46

That's a very interesting question. So their technical background into the privacy? It depends always what kind of technical background? I would say, so I think like in the privacy world, if you have a technical background you can straight go into security for sure because security at the end is about security people used to be like very IT focused guys. Right now the security guys are actually part of the board. So you from a technical background, you have the ability to understand the technical pieces. But what you will need to work on is translating those concepts into business challenges, into business results, into business impacts. And that's something that, for example, people that come from a technical background struggle because they're like, yeah, but this is how it is when technical yeah, I get it, but what is the value for the business? What is the impact the business could have. On the other side if you are more like a technical background such as like a graphic designer or something that you want to basically use your technical skills to build something creative, privacy is a great place to be because we are talking about cookies, we're talking about consent, we're talking about marketing preferences. So you can really use your tech background to provide customers with easier to use interface, for example. So again, going back to what I said at the beginning, helping people, help people understand what the privacy is, right, what kind of cookies that they are opting into and which ones are marketing preferences they want. All of this can actually be built out in the background that we need like of course, technical tasks to do, so.

Jamal: 27:47

Okay, awesome. And my next question as a follow up on that is when you're looking to expand your team or hire people into your team, what are the top three qualities you look for?

Valentina: 28:00

So first one, the top quality that I would go for is actually like the perfect hybrid between sales and tech, which I know is super difficult. But you need to have a well diverse team. So you need to have some team members who are more salesy, let's say, and some that are more technical. If you are too technical, if you're too salesy, that is not going to work for the role that you are supposed to be. The second one is from a solutions engineering perspective, is being able to understand the value of the technology. For a business, it's not really a skill. It's about like going a bit deeper into what does the market want, what are the challenges and why that technology is relevant. So, in terms of skills, I would be critical thinker when it comes to a technology. I didn't actually never thought about it in this kind of words, but that is helping me Jamal, by the way, because I'm like, what do you want in a team?

Jamal: 29:12

Your answer is helping hundreds across the globe right now.

Valentina: 29:16

That's good. And I think the third one, being a team player, like as a solutions engineer, you really cannot do it everything by yourself. You need help from product, you need help from sales. Your job is being not only like part of the team, but sometimes even the leader of a team. So you need to have that interpersonal skills to be able to receive feedback, give feedback and making sure that everybody is working towards a common goal.

Jamal: 29:47

All right, so, Valentina, your top three qualities that you look for in an individual is, number one, a balance between their technical abilities and the, shall we say, persuasion and influence abilities. Because sometimes I find that people in the UK don't necessarily like the word salesy too much. It's something that people shy away from. But one of my mentors, he taught me a lesson very early on. He said, look, why do you have such a problem with sales? And using the word sales, everyone is always selling. If you go to an employer, you're selling them that they shouldn't pay you whatever it is to be able to do that job. If you go to an interview, you're selling them the idea that you are the best candidate there. If you want to get married, you're selling them the idea that you are the best choice for them to spend the rest of your life with. So everybody is always selling something. And he said something to me that gave me a really profound understanding. He said, when you grow up, so this can tell you how old I was when I had this mentor and maybe I'm still growing up Jamilla. He said, look, when you grow up and you have children, the only thing that's going to depend on whether your children end up on drugs or not is who's the better salesperson, you or the drug dealer. And that really had a big impact on me because where I grew up in the East End of London, everybody around me was either selling drugs or taking drugs. And one of the things I took inspiration from was the people. That were using drugs is no matter what happened, they did not question where their next hit was coming from. They always found a way. And one of the things I mentioned, I think, on the webinar is I then said to myself, I'm never going to let a drug dealer outwork or outperform me. So two great lessons from there is, look, everybody is always selling, and you need to get a good at persuading and influencing people provided that you’re leading them to the correct ethical outcome and like you said trust is a very important thing. So bringing this back into what Valentina has been so kind enough to share with us is there needs to be the right ability between sales and technical. If you're too salesy, you're going to push people away, so you're not going to be able to make the impact. If you're too technical, you're going to lose people because they won't understand why they should buy in to whatever you're offering. The second biggest quality or the second strong quality you look for is their ability to apply critical thinking to the challenges that are existing out there and then to be able to say, okay, how does the technology or how can I now add value to solve those challenges? And how can I bring this technical solution to solve the problem that we see out there? And finally, you said it's all about the soft skills, the interpersonal skills, the ability to work in teams, the ability to lead, the ability to really make an impact on the people around you by having the right attitude and making sure that you show up with the right activity. Have I understood you? Great. Right there.

Valentina: 32:35

Perfect. Yes, absolutely. You did. Thank you.

Jamal: 32:41

No, thank you.

Valentina: 32:43

This question really helped me to understand what am I looking, really, in a solutions engineer? And I think that could actually help other people when they're applying to it. Am I the right person for it? Because it's always like this, right? We are selling the company and the solutions engineer or the candidate is selling it to us.

Jamal: 33:05

Yeah, exactly.

Jamilla: 33:07

Valentine, what's your most memorable client story that you've got that you can share with us?

Valentina: 33:14

the first call that I took in: 2022

Jamal: 35:41

Great job. And you know what you did in that story, Valentina, you gave us insights into how you actually demonstrated all three qualities that you spoke to us about.

Valentina: 35:52

That's true. That's so true. Thank you.

Jamal: 35:57

You are awesome, Valentina. I love it. Thank you. Valentina it's been an absolute pleasure having you on the podcast. Thank you so much for sharing all of your valuable insights with our audience. On behalf of everyone at the Privacy Pros Academy, a massive thank you to you.

Valentina: 36:12

Thank you so much for having me. It's been so much fun. Thanks.

Outro: 36:18

If you enjoyed this episode, be sure to subscribe, like, and share so you're notified when a new episode is released.

Outro: 36:26

Remember to join the Privacy Pros Academy Facebook group, where we answer your questions.

Outro: 36:31

Thank you so much for listening. I hope you're leaving with some great things that will add value on your journey as a world class privacy pro.

Outro: 36:38

Please leave us at four or five star review.

Outro: 36:40

And if you'd like to appear on a future episode of our podcast or have a suggestion for a topic you'd like to hear more about, please send an email to team@kazient.co.uk

Outro: 36:52

Until next time, peace be with you.