A coffee with… Stu Hirst, CISO, Trustpilot

Stuart Hirst’s journey into cyber security is more colourful than most. The self-confessed imposter syndrome sufferer attributes a large part of his success to being in the right place at the right time with the right people and taking risks that have involved moving out of his comfort zone.

Having spent years balancing a job as a mainframe developer in a bank with a weekend career as an international DJ who was regularly by-lined in Radio 1 playlists, Hirst embraced a change of direction in 2010 after joining the ticketing app Trainline as a support analyst.

Entranced by “the pace and agility” of this new breed of tech company that was emerging, when his boss encouraged him to apply for a cyber security position, he rose to the challenge and hasn’t looked back.

Hirst has since held cyber security positions at Capital One, Skyscanner, Photobox, Moonpig and Just Eat. He was promoted to CISO while at Just Eat and holds the same position at Trustpilot, where he’s worked for three years.

Last year, he began to lose his hearing due to a hereditary condition.

TechInformed met Hirst at Tech Show London earlier this month, where the CISO gave a talk on imposter syndrome — a condition where people start to doubt their skills, knowledge, and accomplishments—something he claims is prevalent in the world of cyber security.

What’s been the biggest challenge in your career so far?

It goes back to the talk about imposter syndrome that I gave. It’s not knowing enough, not feeling like I’m on top of the information I need to know; I’ve taken risks. I’ve moved out of jobs when I was very comfortable in those jobs and moved to try things out, and sometimes that’s worked out, and sometimes it hasn’t. But if you don’t make that leap, you’ll never know.  And then there are just general day-to-day challenges of the role. It’s a vast field of knowledge and expertise that requires you to be on your game all the time.

Why do you think imposter syndrome is widespread in cyber security?

It’s such a difficult field to work in, frankly. I personally never feel like I know enough to get by, and I suspect that most people in security share this fear.

Is there an irony in this, given that part of the role is to fend off ‘imposters’ trying to hack into your systems?

A bit. But hackers don’t know lots of stuff either. They do a specific thing, but they won’t necessarily know how a business runs or how to do half the things we know how to do.

Imposter syndrome isn’t all negative. There are lots of positives to having it: It keeps you on your toes, it keeps your ego at bay, and it keeps you in this realm of learning all the time — which is sort of what you need to do to keep on top of hackers.

You also pointed out that tech leaders don’t have all the answers, either, which is why the best ones surround themselves with people who do…

That’s good leadership, right? When I was at Skyscanner, there was this mantra: ‘ Hire better than you for any level’ — so hire better, even if it’s for someone more junior — because what happens then is that everything gets better, and everyone learns.

I’ve shared some rooms with very smart people. The current CPO of Trustpilot [Ben Lavender] created the iPlayer. However, they will have the same hangups and lack knowledge in certain areas. Once you see that they have the same struggles, it makes it easier to navigate your own part in that.

You also spoke about the challenges of balancing parenthood with a C-suite job….

I think the key to that is knowing when to switch off. I used to be bad at finishing work. I’d have dinner and then read Twitter or blogs because I felt like I needed to keep on top of information because it was pertinent. Now, I finish at the end of the day, and that’s me done. I spend time with the kids. I’m better at switching off my phone on holiday.

I want my kids to understand work ethic and that you can reach the highest levels of your career if you work hard and overcome problems. But I don’t want them to grow up thinking that work is the only thing that’s important.

What else do you do to switch off?

I play drums and guitar. I still go to gigs even though my hearing is a bit knackered. I travel a lot, or I try to.

How do you think the industry can support people with hearing loss and other disabilities?

Companies may say they are doing all they can, but the reality is different because they don’t know how to solve some of the problems, and I don’t know whether they should even be expected to.

If I’m in a big meeting room and someone’s 10 feet away, I can’t hear them in the same way. But there are technologies that can help with that — mics that sit at the end of tables and then come through hearing aids.

I used closed captions on Zoom, but what you read is not always the words that are coming out of people’s mouths! It doesn’t always get it right, it jumbles things up, and it can’t understand accents properly.

The tech is getting great for these kinds of disabilities, but either companies don’t know it exists, or it’s just not quite where it needs to be. I don’t demand that my employers do a huge amount – there’s only so much you can do because there’s a whole raft of different disabilities.

I’ve had to relearn how to do things. Trustpilot has been amazing. I have regular meetings with HR; they are keen to understand what they can do as a business. I am not the only person in the company with a hearing issue.

It’s been an interesting year of working out how to do a job at this level with this thing. I wouldn’t have even thought twice about doing this interview two years ago, but now I’ve got to think ahead more. It’s a learning curve.

A coffee with…a physical pentester who breaks into buildings