Erik Wille
Head of Information Security
Penske
July 2020
Erik Wille started his career at Penske 13 years ago during a time when security was seen as a box organizations had to check. When Wille was tapped to lead information security in 2012, he faced an uphill battle to infuse security into the organizational culture.
Over the last eight years, he saw the organization's view of security shift. Now Wille leads a team that is seen as a business differentiator. In this interview, Wille reflects on his journey as a leader.
What have been your greatest business challenges as an enterprise leader? What’s your advice for overcoming these challenges?
As I look back on my career, one of the biggest struggles is finding ways to build a culture of security. Everybody's focused on running in the direction of the business, making money, selling units, etc., so we must find ways to intrinsically build security into those processes. Traditionally, security has been synonymous with friction and is seen as the “department of no.” Getting away from that mentality has been one of the biggest struggles.
The number one skill a CISO must have is the ability to build relationships.
You do this through listening, understanding the pain points and bringing solutions to the table that will help the business. I know that if we help people now, they will come back to us when they have another issue. By doing that, you create a dynamic understanding of how security is critical to building the business.
In many businesses, people look at IT and think “IT is IT is IT”; they don't understand the delineation of security. When they have a problem, they just send it to the first person in IT they think of. When we get questions sent to us, we do everything we can to answer their questions, and if we can’t answer them, we will find out who can.
Personally, having that mentality has helped me move up through the ranks at Penske. I always say, “I don’t care about my silo, we are all in this together, we have to get things done, so let’s just do it,” and it has served me well.
When it comes to your organization’s response to the COVID-19 crisis, what is one thing that surprised you and what did you learn from that?
The biggest surprise for me was learning that there are a lot of people who don't understand the difference between managing and leading. Those words are used interchangeably quite a bit; they are very different. It is how people lead that really makes the difference.
When things started ramping up with COVID-19, there was a big emotional response, and for the IT team, the natural inclination was to come up with IT solutions. But once we got past the emotions and took a step back, it was clear it was a business continuity issue, and we had to work together.
It goes back to communication and leading versus managing. We had to help the business understand that the metrics we use to measure day-to-day activity do not need to fundamentally change when we work remotely. Transitioning to a metric focused on VPN connectivity — or how long a butt is in a seat — those are not good metrics. All that shows is that someone sat there and was connected for a certain amount of time. That is not monitoring productivity.
We needed to go back to the metrics we were using before COVID-19 hit: cars sold, phone calls returned etc.
Those metrics show that the business is still working, regardless of if someone is in the office or remote.
Just because the setting changed does not mean the business fundamentally changed. It was an interesting mind shift. The business is the business, and we understand our business inside and out. All we are doing is transitioning so people are doing work from a computer inside their house as opposed to the office. Getting the organization to understand that was a challenge at first.
How have you grown as a leader through this? What leadership principles are carrying you through?
It is so interesting to look at the vastly different emotional reactions COVID-19 has caused. It has really forced me to take a step back and lead with empathy. Everyone has different opinions on the situation, as a leader, I had to step back and listen to my team to really understand them so we could move forward as a team. By and large, people just want to be heard and understood, so I have been pausing and listening more than ever.
What are you most excited about for the latter half of 2020?
The first half was a bit rough, but I am looking forward to seeing what happens in the back half. It will be exciting to see the business economy start to come back. I don't think there is a business out there that is going to look the same coming out of the pandemic as they did going into it.
For me, it is exciting to see how the relationship between different business groups have changed. Whether it is marketing, finance, or accounting, I have seen all departments come together and make decisions quicker than before.
At Penske, we always talk about agility and speed to decision. We like to say that we run at the speed of a pitstop. This situation has really forced us to look internally at our agility and our ability to make decisions together. I am looking forward to seeing if we can keep up the pace in the back half of the year.
Special thanks to Erik Wille and Penske.
by CISOs, for CISOs
Join the conversation with peers in your local CISO community.
