Protecting Critical Infrastructure Engineering From Cyber Risk

Speaking of of risk and cyber security, you'll often hear that as like a hey, that's like an IT issue, not my department. Why do you see it as a business and engineering issue? Like why is it so important? I think there's a a lot folks want to try to understand before they can dig in and if they can compartmentalize it and set it on a box and say, "Oh, so and so's got that or or we can handle that later or that's being handled by a consultant or a contractor, a partner." It it's nice. It feels good to put it in a box and set it set it aside. The reality is most cyber issues are not actually technical. I've been leading cyber in some ways for the last. Did you know the average engineering firm experiences a cyber security incident attempt every 39 seconds? Behind that number is a question the industry is just starting to grapple with. Why has protecting critical infrastructure become just as much an engineering challenge as a technical one? Today we're going to dig into this and what it means for the firms that are building tomorrow's infrastructure. Joining us today is Nick England, chief information and corporate services officer at Volteg where he leads the technology functions driving both protection and the transformation of the business. With more than 20 years spent at the intersection of technology and engineering leadership, Nick has built a reputation for turning innovation into real lasting impact for clients and teams alike. In this episode, we'll dig into why cyber security can no longer be treated as someone else's job, what it takes to build a technology roadmap that help holds up under pressure, and how leaders can build organizations ready for what's next instead of scrambling to catch up. If you're an engineering or firm leader trying to figure out where technology fits into your future and how to protect what you've already built when you get there, this conversation is for you. Before we jump in, I want to tell you about AEC PM Connect, a series of in-person events we've created at AMI for AEC project managers and the leaders who develop them. You want to stay on top of PM trends, elevate your team, and deliver stronger project results. These full day events are built for you. I'm coming to Kansas City this October. Learn more at registered aecpmconnect.com, and I hope to see you there. It's now time for our conversation of the week with Nick in England. Nick, thank you so much for taking the time to join the show today. Welcome. >> Thank you. Glad to be here. >> Yeah. And I know we just had a had a really nice chat. I think your background spans a couple different areas. It's very interesting. I know you've been with uh old tag, your company for for quite some time here. So, let's just jump in. So, Nick, how did you find your way into engineering and technology? And then what led you to where you are today as chief information and corporate services officer at Altech? >> Sure. That's a a fun question. So child of the child of the '9s. So grew up with uh with with tech and kind of I think I was trying to you know cur through curiosity and kind of troubleshooting. I was trying to take it apart before I knew how to work it. And uh that pretty quickly led me into a career in software engineering. So the the basic idea that you could kind of create something and get near instantaneous response through through development and then solve problems that people actually care about um just fascinated me and drew drew me into it. So my early career was almost exclusively doing integrations between between systems. So software engineering to do integrations between systems mostly in the ERP space. I joined u in the engineering firm. So alt tag here it's been about 18 years a little over 18 years ago and uh what drew me I would say I was less drawn to engineering and more drawn to professional services broadly broadly I wanted to be at a company that cared deeply about people and uh you know I'd come from come from large publicly traded traded firm that you know they they had a view about stake stakeholders and what mattered and um I was really attracted to what I saw from folks that I knew who worked in this space and actually folks I knew that worked at Alt and that care for people and their and their careers and getting to do things for folks that cared about employees, cared about their their customers really resonated for me. And then of course once you get under the covers and you get to work with a bunch of great engineers who who it turns out are also naturally curious folks that like to solve solve problems, it's really a great space to spend spend your time in. Everybody wants to solve all the problems every day. It's fun. >> Yeah. Engineer I mean you know you've you know have you know haven't seen the sitting in the seat that you've sat in engineering great industry. Um sounds like your people are really you know a testament to that but um like as the engineering space becomes more digital how do you guys rethink your responsibility for protecting critical infrastructure across your different service lines? Yeah. So you maybe maybe I would start by saying that the infrastructure space is is having having their moment and kind of their realization with some other spaces have have had a while ago which is to say that digital whether you're talking about automation or applications or or SCADA systems it can't be an afterthought. It needs to be part of the upfront design and procurement of the process. And if it's not, you end up in this really reactive space where you're exposing things to risk or risk, additional cost and you know maybe maybe support or commissioning issues when you're when your infrastructure ultimately goes into service increasingly and I think it's happening in different parts of the infrastructure space engineering space at different times in different ways right now. But it seem it seems to me that most infrastructure will have the opportunity to be better better for the you know the end customer the the population that uses it through digital systems in some way whether it's a you know a power plant that's got smart aspects and sensors etc or it's a you know smarti devices in roads and bridges to help make them safer. They're digital components and for for a while it was kind of an afterthought and I think folks are realizing that it needs to be part of the upfront upfront stream when the thing is designed to actually think about you know what who are all the players in the process. What are the cyber security implications and you know even some of the the kind of the less the less cyber the less digital implications about supply chain as well. You know who's responsible for for this piece? Who can support it long term? Is this entity going to be enduring? What are my alternatives? You your traditional supply chain management kind of things that you need to think about and um you know infrastructure's got a lot of smart parts in it now and it's just going to going to continue and that supply chain risk is got to got to be part of the upfront design. >> And speaking of of risk and cyber security, you you'll often hear that as like a hey that's like an IT issue, not my department. Why do you see it as a business and engineering issue? like why is it so important? >> Well, I I think folks folks by nature and and this is a good thing and good thing generally and it reflects on how people like to lead and folks like to put things in a box. You can put that box up on a shelf and you know when it comes to to tech issues and and especially cyber I think there's a a lot folks want to try to understand before they can dig in. And if they can compartmentalize it and set it on a box and say, "Oh, so and so's got that or or we can handle that later or that's being handled by a consultant or a contractor or a partner. It it's nice. It feels good to put it in a box and set it set it aside." But the reality is most most cyber issues are not actually technical. You know, I've been leading cyber in some ways for the last last 15 or so years. And you know, my my take is that maybe if you're lucky, 40% of that cyber stack gets to be technical stuff you can actually solve with systems and processes and kind of what you see on TV. Most of most of it is management systems. It's process, it's governance, it's training, it's like the human the human factors, the human performance factors behind it. And if you don't integrate that stuff into your business strategy, into your human capital strategy, into your, you know, day-to-day work, it uh it just doesn't doesn't work because either your cyber folks don't understand what your people are actually doing. They think they do, but they don't because they're not talking or your or your folks don't understand the cyber risks. So, they go about their job every day and they don't realize they're taking on risk risk to the company. you don't inter in integrate those two things and really think about it as a a human challenge a people a people thing you leave a lot of risk out there a lot of risk on the table strong project outcomes need skilled managers and competent leaders EMI's corporate training delivers expert-led courses in project management and people leadership plus industry recognized certification and exclusive premium content to take your team even further elevate your team's leadership capabilities today visit engineering management ment institute.org and click on corporate training. >> Yeah. And as we know people are not uh let's say they're not deterministic systems, right? So there's always >> there's there's always going to be variability and that's that's the fun part of of dealing with people. Everybody's a little bit different and every situation is a little bit different. So not to say that even the technical portions of cyber security are that way but you know >> but they are to to a certain extent you know the technical aspects are more deterministic. We uh I think IT folks in general have a reputation you mean like for being pretty heads down and kind of focused on the tech. It's it's easier to solve when we know how it's going to behave. You don't always know how a human's going to behave when you pick them up pick up the phone and you you call them and it's like hey why'd you do that? You don't know what you're going to get. folks don't like to do that but that's really where the magic happens that's how you how you actually have an impact on on risk is when you engage with it with the other humors and I think part of that is like you know that's part of an overall strategy so if we zoom out like Nick say you're you're sitting down to build a technology roadmap which is going to include right some of the the qualitative pieces and some of the quantitative pieces but when you when you zoom out and look at that road map like what are the your top three priorities that you're going to weigh against everything else you have to deal with. >> Yeah, it's interesting. So, right now in today's landscape, maybe I should caveat that and I I actually think it's really important that a business has a digital strategy and a technical strategy and a tech strategy and there's separate separate things. Your digital strategy really needs to be focused on how you're going to change the business, what you're delivering for your customers, and how you're going to compete. Tech strategy is a little bit of different space. And interestingly right now I would I would say 23 of those three points so two of them are really in the governance space. So I think that you know one of them you you need to have a handle on what I would call SAS and AI governance the pace that new applications are kind of infiltrating both both in terms of the value they can provide. So you can't ignore them. You can't just you put your blinders on and say nothing new. So you can't ignore them, but you can't just let it be a free-for-all. And it it is harder today to to govern AI applications, AI use, and just plain old SAS application usage than it than it has ever been. So I would I would put that at the top of my list. Second one on my list would be data strategy. If data is the new new oil, as some folks like to say, need to understand where your data is, where the value is, and and what the potential long-term is to monetize it, what the roadmap is to make sure that you're setting the company up to do that long term, to get the value from whatever data it is you you have or you think you have. >> And then finally, and this is this is an interesting one when I was thinking about this this question, Nick, my my third pillar right now would actually be human capital. And the the reason reason why and this is kind of an interesting interesting time in tech. I think that if you if you view what's going on with AI, you know, there's probably some some bubble aspects of it under under the covers and a little bit going on, but there is a a rethink of how of how humans work going on right now that maybe is akin to an industrial revolution. And I think as as tech leaders, as business leaders right now, we have we have an obligation to all of our people to make sure that we are making the investments in them to bring everybody along. So some folks are, you know, might be might be scared. Hey, this this AI tool is going to take part of my job or I'm going to get displaced. I think the real question is how do we bring everybody along together so they know how to think about and know how to engage engage with and use these different different tools at a time when work is changing maybe more rapidly than it ever ever has been and we we don't want to leave anybody behind. So I think the the human capital intersection intersection with tech and AR right now would be my my third third pillar >> which is uh right if you if you only paid attention to mainstream news and media you would think like we wait a minute like I thought all of our jobs were going to be taken away and and replaced by this all powerful technology but right we we both know that's not true. It's a it's a very kind of interesting interesting space like right now you know kind of the the the threading you know initially it was you know this world of possibility when you know when you're you know your chatbased LN started coming out and then this this revelation with uh with agents agents as you know they've been able to progress into doing doing actual work in some cases. I think right now the the threading is this idea around the human as the orchestrator or the orchestrator of the orchestrator and almost you know we're we're the manager of the of the agents of the tools that are that are doing some of the some of this work that used to be done by people. The I think the challenge is that the somewhere along the line there does need to be a human in the loop for most of these things. They need to understand the tech, at least understand it enough to know how it's working or kind of what's under the what's under the covers. And then also, not all humans are kind of natively built or trained to be able to manage and orchestrate large swaths of things. So, I think there's some reskilling and some rethinking there. And I, you know, I'm I'm an optimist and I tend to have a growth mindset about things. So I I don't I don't know that I I see the the doomsday all the jobs are getting taken by tech kind of angle, but I do see a need like I do think there's real risk if uh we don't help people feel comfortable and feel good about what's changing that that folks could get left behind and I think that's a leadership imperative right now. >> Absolutely. And uh as you know right different people have different levels of that ability to like manage or orchestrate and also at the same time how do they deal with and interact with technology like I know people who right just turning on the computer can be a little bit challenging and then others it's just you give them the tools and equipment and they're off to the races. >> Yep. And you can have issues in both ends of those spectrums. Right. >> Yeah. Well, because if somebody can't turn on a computer, there's only so much damage they can do in the digital world at least. But, uh, you give somebody the keys to the castle without the proper guardrails. Oops. >> It's amazing what some folks can accomplish. Like the ultra curious when there aren't any fences, you know, hey, and I vibe coded this and it does this, this, and this. It's like, that's wonderful, and let's talk about how we can govern govern that. >> Yes. And uh some and sometimes, right, the best thing is like uh hey, we're just going to give you a machine. It's isolated from the network and you can blow it up. It's cool. Just don't do that when it's uh it is connected. >> Yeah. >> So, Nick, what's uh one piece of advice you'd leave with utility and engineering leaders that are kind of being I don't want to say dragged in, right? But we all kind of are like this future is coming. um whether we want it to or not and like you said earlier there's a lot of change. Yeah, I would I was thinking about th this one, Nick, and to me the piece of advice is the same and and the ir the interesting thing here is I've seen folks lose lose sight of this thinking. It it's still all about the customer, you know. So, we're you know, whether you're in the engineering space or you're, you know, or you're running a utility, it's not about it's still not about the tech. And we occasionally get blinded by the shiny penny and we think it's about the tech, but it really is about the customer. And if you can't if you can't look at the look at real problems that your customers have and ways to create real value for for your customers and kind of map that through end to end with the tech, size the prize and what's in it for what's in it for your customer, um you're you're probably looking at it a little a little wrong. And uh I think that's been right now kind of with the the Berber fever pitch with with AI right now. I I can't count how many times I I've heard peers peers who are doing doing what I do at other engineering firms who have this imperative for the from their leader. It's like oh go tell it go tell us what we're doing with AI. It's like maybe maybe let's think about AI as the tool or think about digitization as the tool and then let's look at what the real problems are that we can solve and figure out how they can create value for the customer. And the irony like like where I started here, Nick, is I think that's always been the the way to look at it. We just occasionally get sidelined by the shiny pity of a of the the next thing or new tech, especially when tech gets consumerized and you know the that thing shows up in your in your phone and everybody everybody knows knows about it and they're kind of aware of the potential for business value. Still got to go back and figure out how it how you can create value for your customer with the thing. >> Yeah. And I think the sometimes the f especially like you get to a certain point in your career, a certain position in the company where maybe you're not as connected to the customer as much as you'd like facing their day-to-day problems and it does become easy to get sidetracked, distracted by the shiny object. So I'm in agreement, right? Because uh without customers, well, none of this is possible. >> Yeah, that's right. Nick, this is this has been an awesome discussion and like I said earlier, it's also also great when we can get more Nicks on the show. I love that. So, the final question I have for you today is if you're a firm looking to adopt AI, any new technology, be innovative, what are you telling them to focus on from a leadership and team development standpoint to make the transition from where they are today to where they want to be successful? >> People. So, in a word, focus focus on people. And it goes back to some of what I some of what I said before, which is really just I I really do see it as a as kind of the leadership imperative of the day to bring people along and not leave folks behind, leave folks, you know, out in the cold for tomorrow's work workforce, so to speak. My my colleague, which you previously interviewed, Brian Brian Gas, has a thing he likes to he likes to say, and I'm going to butcher his analogy a little bit, but I think it's really good. So, you know, Brian would would say that, you know, traditional techn technologists have a habit of maybe they'll hand you a bike and say, "Go do something with it." And in this case, the bike is akin to a tool. Like, I hand you a piece of software. It's like, "Oh, go figure it out. Go use it." Um, and with with AI and digitization in particular, folks don't necessarily know what to do with the thing. So, Brian's saying is it's not like here's your bike. Brian's Brian's saying is let's go ride bikes together. Let's figure out that figure this out together. Let's go on this journey. Let's learn together. And I think that's really really apt when we're thinking about thinking about tech and digitization and AI right now. And when we're trying to bring people along, I think we need to give specific examples and kind of show them along along the way. It's not about here's the tool, go do something with with the tool. It's like, hey, here's how here's how I use the tool to help me do this. Here's some training to help you and let's sit down and talk about some of the ways that you use the tool to kind of bring them along bring them along together. And whether that's, you know, using co-pilot to help you draft a PowerPoint or work on meeting notes or, you know, there's examples in everybody's day-to-day life, but for for a lot of a lot of folks, it's not enough to give them the tool and the training. I think we've got to give them the use case in circle doc and kind of, you know, ride the ride the AI bike together to use Brian's and how you go. >> I love it. And you know, and that's that really is like the the the classic IT answer which is like, hey, >> we've procured it. We've got it set up. We've got it secure. All right. >> Our line is like the use case is squarely on like the business. But when you have leaders, >> here's a tool. We've checked our box. We have this project is a success. We give ourselves an A and then you're never going to hear from us again. That's kind of the traditional technologist way. >> Yeah. And and as you know, right, like where does all the business value come from? It's it's the use case. >> Y use case and the people and sitting down and shining them. So, you know, great response. I'm a complete agreement and I love it. But, uh, Nick, you know, again, thank you so much for taking the time to join us today. If the audience wants to connect with you, maybe ask you some more questions or chat, what's the best way for them to reach you? I've reached out to me on LinkedIn. >> Beautiful. Thank you so much for taking the time today. This was awesome. >> Yep. Thank you. It's wonderful to meet you. >> Yeah. Likewise. Till next time. Please remember you can find the show notes for this episode at aechpodcast.com. There you'll find a summary of the key points discussed in today's episode as well as links to any of the resources, websites, or books mentioned during this episode. Until next time, I wish you the best in all your engineering and technology endeavors.