Randy Pestana is a national security and cybersecurity expert who serves as Director of National Security Policy and Strategic Engagement at Florida International University’s Jack D. Gordon Institute for Public Policy. His experience spans defense policy, regional security cooperation, cybersecurity strategy, and U.S. engagement with international partners.
Summary of the episode
Randy Pestana discusses Florida International University’s cybersecurity ecosystem, including technical degrees, cyber policy, threat intelligence, risk management, workforce development, and hands-on learning opportunities. He also advises students to choose a cybersecurity pathway that matches their interests, build practical experience, and develop meaningful professional relationships.
Listen to the episode
Read a full transcript of the episode
Steve Bowcut:
Welcome to the Cybersecurity Guide Podcast where we talk with educators, researchers, and program leaders who are helping students understand the many pathways into cybersecurity.
Today, we are very pleased to be joined by Randy Pestana. He’s the deputy director at the Jack D. Gordon Institute for Public Policy at Florida International University, where he oversees the institute’s national security and cybersecurity programs.
In this role, Randy helps manage FIU’s cyber-related partnerships with a wide range of government, international, and industry organizations, including the US Department of Commerce, Defense, Homeland Security, Labor, State, and Veteran Affairs, as well as the organization of American states and partners across the cybersecurity community.
Randy’s background brings together international relations, US foreign policy, security studies, cybersecurity education, workforce development, and national security. He also serves as an adjunct professor in FIU’s Stephen J. Green School of International and Public Affairs and Honors College.
Randy holds a master’s of arts in Latin American and Caribbean studies, a graduate certificate in national security studies from FIU, and an executive certificate in cybersecurity from Harvard University.
Our conversation today will explore FIU’s cybersecurity ecosystem, including technical degree programs, cybersecurity policy education, workforce development, cyber threat intelligence, and the many ways students can begin building a career in cybersecurity.
And with that, Randy, welcome to the Cybersecurity Guide podcast. We’re so happy to have you.
Randy Pestana:
Well, I appreciate the invitation. Look forward to this conversation.
Steve Bowcut:
I do too. I’ve been looking forward to this. It’s going to be interesting and fun. So what we like to do typically on this show is we start with a little bit of background on our guests.
So if you could tell us a little bit about your academic and professional journeys and kind of led up to where you’re at today.
Randy Pestana:
Absolutely. So a lot of my background coming out of high school was really centered on getting into the military. So upon getting enough eligibility and credits in college, I was able to join what it was called the Platoon Leaders Course in the United States Marine Corps.
And from there, I did my training, which will allow me to graduate and commission upon graduation. So I had a very short career in the military, but one of the things that it gave me the opportunity to do was when I transitioned out was identify where I wanted to go.
And one of those niche areas was bridging the gap between defense and academia, often confrontational relationship historically. It was a role at FIU to begin communicating the academic perspective on defense programs, but also looking at defense issues from an academic perspective and bridging that communication gap.
So I joined FIU working first at the Latin American Caribbean Center before being hired at the Applied Research Center, which is kind of our engineering school. So this is where I was first introduced to technology and the impacts that technology can play certainly on national security issues, but beyond my general comfort zone of international relations and defense relationships.
In 2015, I joined the Institute for Public Policy where I was asked to maintain the relationship with SOUTHCOM, but think about new growth areas. And one of the areas that we thought immediately of given our experience in the engineering school was really the cybersecurity, but from the policy perspective.
Now, this is back in 2015 where cybersecurity policy as a field really was new, it wasn’t really grown, but we understood that the ability to articulate complicated technical terms into layman’s terms for general defense audiences was really valuable and an area that we grew from there focused first on workforce development, education and training, not just for students, but for lifelong learners, as well as ability to work with professionals in the defense community and prepare them for technical skills that they need to do better at their roles or advance to more different roles in government.
Steve Bowcut:
Interesting. So is there any one thing that you can point to that you’ve identified has helped cybersecurity become such a central part of your career?
Randy Pestana:
Yeah, no, I think it was an interesting scenario where I was doing work on transnational criminal organizations in Central America and I’m looking at the gangs, I’m looking at these criminal groups, and I’m looking at a lot of financial information, a lot of networking information on how to launder money and supply chains.
And it started evolving from just traditional cash transactions to drug transactions to more technical cyber kind of activities. So it wasn’t just a physical security issue, it now became a network security issue, which piqued my interest in saying, “Huh, there’s a different way to look at this that’s not as I had thought,” which is always give me guns, give me drugs and weapons.
It is now non-technical areas that we need to be aware of and how to protect not just ourselves in the United States, but our partners across the region. So that’s what really interested me in cyber.
And the more I looked into it, the more I realized how robust the threat landscape really was and how ill-prepared, frankly, a lot of governments, including our own, was to meet this new challenge that was going to impact us.
Steve Bowcut:
Oh, that is fascinating. All right, so for students and/or their families who may not be completely familiar with FIU, how would you describe cybersecurity at FIU and the role that it plays in connection cybersecurity activity across the university? How does that all come together?
Randy Pestana:
Yeah, FIU being a young university, we were able to challenge a lot of the traditional institutions. It’s very hard to move a ship and turn a ship in a direction you want to go, but when you’re young, you can be agile. You have innovative faculty, entrepreneurial faculty that were really interested in not just looking at the student components.
Certainly it’s there, but also the professional component. So what we did was we took training and education and merged them into the concept of workforce development in a larger lifelong learning kind of model.
So K to gray, if you will, focused on how we prepare K to 12 students and make sure that they’re getting opportunities through summer camps, bootcamps, supporting Girl Scouts of the Americas on their cyber badge programs, and then transition them to FIU where you have affordable education that gives you options, whether it’s the technical degrees, the non-technical degrees, or a lot of the hybrid degrees that we have.
Opportunities for master’s programs and PhD programs if you so choose to go that route. Or if you’re going in the professional route, have professional opportunities for our local community and our international community as well.
So really thinking about the life cycle of education and training as opposed to just doing student success, which we do well, but we want to do more than just that.
Steve Bowcut:
Yeah. And if I understand it correctly from the research that I’ve done, so you can get a more technical degree and we’ll talk about these things as we move forward here, or you could be more on the policy side, but cybersecurity at FIU just kind of ties that all together. Is that a decent way of saying that?
Randy Pestana:
No, that’s exactly right. That’s exactly right. And I think we think about it from three broad approaches. I think from the first side is the kind of cyber threat intelligence side of the house, so ahead of a breach.
So really understanding the risk management frameworks as well as what kind of vulnerabilities are out there in the field and preparing a set of group of students to focus on those kind of things.
So this is through our masses of global affairs. It’s also through our intelligence fellowship program for cyber threat intelligence. And then you move into the more zeros and ones side of it, the software development, the hardware side of the house, really understanding the technical competencies to be able to support the technology that’s underlining everything.
And then the other side, which is after the breach, this is where our digital forensics side of the house and understanding what occurred so that we can go back to that first part of it.
So again, that’s how we looked at it was through three different lenses and figuring out how do we build programs that fit under these three broad brackets. But one thing that we did at FIU was understanding cyber hits everyone regardless of what their career is.
So we built in the requirements within each of the different degree programs that you take courses, even if it’s an elective, one or two courses in the different elective in a different bucket so you get a well understanding of the field, but also a respect for the other components of cyber.
Steve Bowcut:
And that’s the part that I really thought was fascinating and interesting. It’s such a great way to do it because everybody needs to have at least a basic understanding of cybersecurity and cyber hygiene and the threats and those kinds of things.
So let’s dig down into some of these. So FIU offers a bachelor of science in cybersecurity through the College of Engineering and Computing. So what kind of a student is a good fit? That’s obviously a more technical degree path. So what kind of a student would be a good fit for that and maybe what kind of foundational skills should they expect to build and to learn?
Randy Pestana:
Yeah, I think it’s twofold. I think you obviously have to, for the bachelor’s in cybersecurity, have a baseline technical understanding.
Those in STEM schools or those coming from STEM backgrounds, those that are really good with mathematics and computer programming and things like that would be very successful, at least initially, because it goes into the networking aspect very quickly, but that’s the technical foundations.
And I think you have to have that if you want to be in the technical field of cybersecurity. And that’s more of that second bucket that we had talked about about the zeros and ones, the underpinnings, underlinings of what makes cybersecurity cybersecurity.
The other side of it is things that make you successful. So it’s not just what puts you in the program, but what makes you successful and makes you stand out within the program is your ability to communicate what you’re seeing.
It’s not enough to build a good baseline security infrastructure. How do you then ensure that you can communicate that vulnerabilities are forthcoming or that you can adjust and communicate to your engineers and your future career, “Hey, we need to work on this because this risk is increasing by the day.” So having those non-technical skills as well really makes you successful in the program, not just prepared for the program, but successful.
Steve Bowcut:
Okay. So one of the features of your undergraduate security degree is the senior design capstone. So let’s talk about that a little bit. How important is this kind of a project-based learning in preparing cybersecurity students?
Randy Pestana:
Personally, I think it’s everything because at the end of the day, what a lot of students go to university for is to get into a career pathway. And what the capstone allows you to do is not just work with different industry partners that we bring in, but mentor faculty mentors, non-faculty mentors, and build a lot of those skill sets that ultimately prepare you.
And if you think about the capstone project itself, it’s essentially your portfolio that you’re putting forward to job potential employers. So being able to showcase, “Hey, this is what I did. I don’t just have this degree.
This experience and this hands-on project that I did shows you why I’m qualified for this specific job and ultimately allows you to stand out as compared to a number of other institutions in the country. All have great foundational education.
There’s plenty around the country, but what is that project with practitioners, with mentorship that you did that makes you stand out and qualify for that specific role?
Steve Bowcut:
Yeah, I like that idea. And I can imagine that also gives the student a degree of confidence knowing, okay, I’ve got this capstone project under my belt. It’s something that I can show prospective employers. I’ve been there, I’ve done some stuff. It’s not all just theoretical for me, and that’s got to be huge.
Randy Pestana:
That’s absolutely right. And I think going back to something we said earlier, the ability to communicate that.
And part of the whole program is built in terms of giving you the technical foundations, giving you the broad range of understanding across the cybersecurity spectrum, the ability to focus in your skillset and expertise on a specific project, but then communicate to the employer upon graduation that, yes, I am qualified for this job and I’m going to be able to succeed beyond just the initial entry point.
Steve Bowcut:
Interesting. Okay. So you also have a master of science in cybersecurity with thesis and non-thesis options. So for students who already have a technical background, how should they think about whether graduate studies is the right thing for them?
Randy Pestana:
I think it’s really what you want to get out of it. And I think there’s two different ways that a master’s degree, in my opinion, can help advance you.
On the one side is if you want to go into academia and be a researcher and be a faculty member that can mentor the next generation of cybersecurity professionals, a master’s is certainly going to help you there ultimately going towards a PhD or really be a specialized master expert on a specific field.
So that is the academic pipeline that if you want to do that, and that’s pretty clearly across the country and that’s been defined over centuries really.
Steve Bowcut:
Right, exactly.
Randy Pestana:
But thinking about the master’s for practitioners is what is that additional credential that gives you a level of legitimacy? One of the criticisms about certifications broadly is that you take a couple courses or a couple bootcamps or gain some experience, you pass the test and now you have the certification, but it doesn’t qualify your ability to actually do the job. It just shows the ability to retain information and do the test.
Steve Bowcut:
Yeah.
Randy Pestana:
So certification companies are getting a lot better in terms of trying to qualify the side, but they’re still a little bit behind.
A master’s degree shows employers, shows government that you not just entered a program, you completed a program that oftentimes 12 months to two years, three years maybe, and you stuck with it, one.
Two, you have likely dealt with some difficult time, but you’ve developed an expertise and you have some practitioner experience likely because a lot of these master’s programs require working with professional organizations that we’re affiliated with to then, “Hey, they’ve stuck out this program, they’ve completed this program.
They then just pass a test and retain knowledge. They’ve had to sustain that knowledge to go through the 18 to 36 months of a master’s program.” So again, it adds your value in terms of going into the cybersecurity workforce.
Steve Bowcut:
Yeah. Okay, very good. So let’s see there’s also an MBA. So you have a business school offers an MBA in cybersecurity risk management. So how does that pathway, let’s talk about maybe the differences between that pathway and the more technical cybersecurity degree programs that FIU offers.
Randy Pestana:
Absolutely. So this goes back into the initial cyber threat intelligence bucket, if you will, that we looked at when developing broad curriculum across university. And this was really intended to support our local community down in South Florida, which is, hey, you might not have the technical expertise.
We don’t have as many STEM schools as a lot of other places in the country. So how do we then take the ability to understand technical concepts without the necessary need to be a coder or a software developer? You can understand cyber even if you can’t do the technical work or maybe the technical work you could do it, it just doesn’t interest you as a career field.
So thinking about the threat before bang, left the bang, if you will, and understanding how to reduce risk as much as possible. How do you ensure that you have proper project management and communications and strategies and that you’re complying with existing policies and frameworks that are required by the state of Florida, by the federal government?
And how do you then use your ability to take complex technical concepts and bring it down to simple layman’s terms for customers that inevitably aren’t there yet with their understanding of cyber? So understanding the risk and how to reduce risk as much as possible.
Now they certainly introduce some technical concepts, so you do gain some technical competencies within there, particularly in the database management side of the house as well as the information security side, so more in the IT kind of technical space.
But it’s really centered on understanding risk management frameworks, project management frameworks and anticipating where those threats and vulnerabilities are going to be so you can reduce and harden your systems.
Steve Bowcut:
Excellent. Okay. So this is kind of circling back to something that we just touched on at the top of the show, but the Jack D. Gordon Institute offers an undergraduate certificate for cybersecurity intelligence and information policy.
So that goes back to when we were talking about everybody needs to know some stuff about cybersecurity. So how does that certificate compliment majors outside of computer science and engineering?
Randy Pestana:
Yeah, so that program’s certainly near and dear to my heart being deputy director of the Gordon Institute. It’s one of those that we understood that the mission is half the battle.
And if you look at students within our program, they’re all national security student-centric. So they want to serve their respective countries, they want to serve their respective organizations. Service is in their ethos and their blood. So we said one of the ways that we need workforce in is cyber.
So understanding, bridging that gap between the cyber and the national security and allowing the students to then understand what the cybersecurity vulnerabilities and risk are so that they can then protect national security broadly.
And as we talked about, it goes across all fields. So you’ll see in our national security programs, criminal justice majors and political science majors, you’ll see computer science majors, you’ll have electrical engineers, you’ll have IT majors.
And we have from all disciplines centralized focus on national security and the role that cybersecurity plays in national security. So that’s how that program was built out and it supplements the electives that we talked about in the cybersecurity program.
So I teach a cybersecurity policy course every semester and I’ll have about a quarter computer science majors, I’ll have a quarter electrical engineers, a quarter cybersecurity majors, and then I’ll have the traditional softer sciences, the social sciences and things like that.
So it broadens the ability of all the different degree programs at the university to look at the cybersecurity mission from a different perspective. It also, if you look at the courses, teaches them writing, reading, how to articulate arguments and risks that you’re seeing.
So again, it really develops some of those more social skills as compared to the technical skills that they’re already getting within their respective degree program.
So it’s a great supplement.
Steve Bowcut:
Very good. All right, so there’s a cyber threat intelligent fellowship and it appears to be a very career-focused opportunity with mentoring and practitioner engagement and security plus training and that kind of thing.
So what can students expect from that fellowship and what kinds of students should consider applying for that?
Randy Pestana:
Yeah, so I think students that should try applying for that and participating in that are those that really want to one, serve their country, whatever country that might be, but they want to serve their country, but they also want to deal with practitioners as opposed to just academics. Nothing wrong with academics, that’s the foundation.
So if you look at our cyber threat intelligence fellowship program, it really has four components. One is the academic foundation. Every person is going to take six courses related to cybersecurity policy and cybersecurity risk as happenstance, not purposeful.
A lot of our students end up getting their Security Plus certifications just by taking the exam following the year in the program. Second is the mentorship, and that’s something. So we take practitioners from former intelligence community practitioners, former government defense practitioners, as well as cybersecurity practitioners from FBI or leading industry companies.
And they serve as mentors to each of the students that allow them to give some of the understanding of the culture and subculture that is cybersecurity because cybersecurity as a field is a very niche field in many ways. Everyone kind of knows each other, everyone talks to each other.
We meet up at these different engagements. So being able to understand how do you become successful in these engagements as you proceed through your respective careers? Third is the research foundation, and this is where students are coming into the lab.
We have a lab there in our facilities where they’re able to do some kind of hands-on cyber threat intelligence work, obviously on segments and networks to make sure that we’re protecting our broader FIU network.
But they’re able to get some experience of playing eyes on glass that often you don’t get with traditional courses. And then finally, it’s the expertise side of it.
So they’ll do a number of research projects and present in front of different practitioners. Sometimes we’ll do trips to local facilities, emergency operation centers, so they’ll see what it looks like. They’ll be able to present their research in front of practitioners.
A few years ago, we took a group of students up to Tampa, Florida at one of our facilities where we had folks from special operations command come over and listen to briefs on Chinese, Russian, Korean and Iranian APT groups and understand what the key capabilities using the MITRE TAF framework to break down what the initial access points were.
So they’re able to articulate two practitioners and it gives them that professional development experience that again is also often missing with academic curriculum.
So between those four, the research, the professional development, the academic foundations and the mentorship, you’re now able to get a student that comes out of this program well ready to contribute towards the cybersecurity workforce, hopefully in government, but even if not in government supporting defense contractors or just supporting the local communities or industry partners if that’s where they aspire.
Yeah.
Steve Bowcut:
Okay, Randy. So this has been hugely interesting and informative, but let’s wrap up here with getting some advice from you for prospective students.
So for students that are listening to this episode and they’re interested in cybersecurity, but they’re really not sure whether they belong on the technical side or the policy side or the business side or the intelligence side.
So what kind of advice would you give to them about exploring FIU’s options, cybersecurity options and finding a path that’s best for them?
Randy Pestana:
Yeah, so I think the first thing is do what you enjoy. There are different people that will tell you, “Hey, this is your one-stop shop and you’ll get a degree or you’ll get a certificate and you’re going to get a job averaging $80,000,” whatever it is. We’ve seen the commercials.
But really, is that what you enjoy? Do you enjoy coding all day? And if so, there’s plenty to do there. Do you enjoy looking at the news and reading about China and Russia and the threats coming from their different APT groups? Maybe you do.
Do you like risk management framework or are you an introvert and really like looking at logs and digital forensics? So think about what you enjoy doing and then look for programs that align to that because I can tell you, if you join a program or you pay money for a degree or a certificate and you’re not doing what you enjoy, you’re not going to be doing that for very long.
You ultimately have to do what you enjoy. So that’s first and foremost, understand what you enjoy, be true to yourself, and ultimately identify programs that fit more closer to your ethos.
My recommendation would look at the three buckets that I articulated, the cyber threat intelligence, the cybersecurity foundations, or the digital forensics side, the after the breach, and figure out which bucket of those three really fits for you and then find your specific role and degree program from there.
Second thing, and this is broader beyond certificates and degree programs, is really understand the field. The cybersecurity field is a growing field, but it’s not a very large field. As we mentioned, a lot of people know each other, especially in these subgroups.
So go to local conferences or events, find out your local Infoguard, understand what community events are going and go to them and meet people and network.
I have a saying that I say all the time to my students and anyone who would listen, which is build relationships, not contacts, which really means you’re going to meet these folks and yeah, you’re liking an exchange business cards.
You’re likely going to add them on LinkedIn. But how do you engage them or identify those individuals that you’re like, “Ooh, I aspire to be like this person,” or, “I like this person’s story,” or, “I really enjoy the way they articulate their experiences in cybersecurity.”
Reach out to them, build a relationship and learn about them and their path and their experience, and they’ll give you some of the understandings of what the obstacles they had to go through because everyone’s got a story, but it’s not often as clean as it’s perceived to be.
So get those lessons learned that’ll help you as a student develop your pathway ultimately towards a cybersecurity career.
Steve Bowcut:
That is great advice. Thank you so much. So Randy, thank you for joining us today and for helping us understand the range of cybersecurity opportunities that are available at Florida International University. It’s been fun. I enjoyed it.
Randy Pestana:
Thank you for having me and it was a great conversation. Look forward to the next one.
Steve Bowcut:
All right. So I think that one of the important takeaways from this conversation is that cybersecurity education is not limited to one type of student or one professional path.
At FIU, students can explore highly technical preparation through undergraduate and graduate cybersecurity programs, but they can also engage with cyber policy, intelligence, risk management, public service, international affairs, and workforce development.
FIU’s cybersecurity ecosystem gives students multiple ways to enter the field, build skills, connect with practitioners as we were just talking about, understand how cybersecurity affects government, industry and society.
So for our listeners, thank you for joining us for this episode of the Cybersecurity Guide Podcast. If you’re considering a career in cybersecurity, we encourage you to look carefully at the different educational pathways available to you, ask how each program connects classroom learning with real world experience, and think about where your own interests and strengths can make the greatest contribution.
We appreciate you listening and we hope you listen again here at the Cybersecurity Guide podcast.