Host Intro (Gene Kim)

One of my favorite presentations from last year was from Fannie Mae, a Fortune 25 company. Kicking it off was Kimberly Johnson, Fannie Mae's EVP and chief operating officer, who spoke about bringing business and technology leaders together to achieve their mission.

It was such a great and clever presentation. She talked about how technology was critical for achieving their short-term objectives, such as responding to the COVID-19 pandemic, and also in the long term, helping them manage the risks of a nearly $4 trillion balance sheet, which is often comprised of 30-year mortgages.

She also presented with a longtime friend of mine, Chris Porter, their chief information security officer. And among other things, he talked about how his team were helping create paved roads to help thousands of Fannie Mae developers get to production quickly, safely, and securely.

So Kimberly and Chris, I am so delighted and honored that you were able to come back and discuss some themes that I thought were so remarkable from last year.

Kimberly H. Johnson

Great. Thank you for having us, Gene. It's terrific to be back.

Gene Kim

Wonderful.

Christopher Porter

Thank you.

Gene Kim

Kimberly, so I learn something in every interaction that we have. So before we begin, could you just talk briefly about the mission of Fannie Mae, your role, and the importance of the Fannie mission?

Kimberly H. Johnson

Excellent. Thank you so much for asking, Gene. I think mission is essential. And for us, the mission of Fannie Mae is really about facilitating equitable and sustainable homeownership and making affordable rental housing available all across America.

I personally think it's really important because having a safe, reliable place to live is kind of the cornerstone for quality of life. So I think about our day-to-day job as making sure that people actually have a high quality of life.

Fannie Mae's role, again, just because you're asking specifically about us and what we do to be able to make a difference in that world, it's really a simple one. As most people know, Fannie Mae's in the housing industry. We don't make loans to people who want to buy houses, but we do purchase those loans from banks and mortgage lenders, and that frees them up to have more capital to make more loans.

We take all those loans, and we package up those payments, and we turn those into securities. We securitize them and sell them out into the capital markets. So we're kind of a middleman that helps the cash flowing from the capital markets into the homeowners who need that to pay their mortgages.

Gene Kim

Awesome. And what is your role in the giant machine that is Fannie Mae?

Kimberly H. Johnson

I'm our chief operating officer, so I have a pretty broad set of responsibilities, but primarily around operations, technology, innovation, strategy, resiliency, information security. A little bit of everything.

Gene Kim

Fantastic. So Chris, you and I have known each other for over a decade, and I've told you that the presentation that you gave with Kimberly and team is one of my favorite presentations ever. I mention it in almost every presentation I give these days.

And you've shared with me how Kimberly Johnson is an incredible person to work for, partly because of her authentic and empathic leadership style. So can you talk about why those characteristics are so important and beneficial to you as leader of the InfoSec organization? Oh, and can you also introduce yourself and your role?

Christopher Porter

Yeah, certainly. So, as you mentioned, Gene, Chris Porter, I'm the chief information security officer here at Fannie Mae. And I'm in charge of all things cybersecurity, end-to-end from access management to architecture, vulnerability management, et cetera. So I've got the full piece. I also run our first-line risk organization, so get a little bit more technical and resiliency risk. That's where SREs will come in at some point as well.

Gene Kim

Wow.

Christopher Porter

So, I've worked for Kimberly now for about five years, and I've got to be careful here so that I don't embarrass her on the line here. But she was our chief risk officer before she became our COO, so I had a chance to work with her in my sort of dotted line capacity and then my full line reporting directly to her.

I think when you have a leader that's going through a digital transformation, and the company going through a digital transformation, there's certain characteristics I think are super important. One is you got to be humble.

Gene Kim

Yeah.

Christopher Porter

And she is very humble. A lot of humility around what she knows, what she doesn't. And that kind of leads into the second factor I think is super important. She's such a voracious learner.

There are times where I'll be bringing something to our team and say, "Hey, I just heard this awesome podcast from Adam Grant last week on psychological safety, and it's so important to us. Hey, I want to share this with everyone." Kimberly's like, "Yeah, I was listening to that, too. That's really cool." And so just constantly, if there's books that I've read, she's then reading them.

And so I think that voracious learning is super important, especially for someone who came from our business side and didn't necessarily have the technology experience. But she's picked it up really fast, let me tell you.

And I think the other thing is she's very team-focused. And I got a chance to see that when she was leading our risk organization, but she's also brought that same sort of visibility to our current team, making sure that we have complementary pieces, always looking at how we as a team can get better and how we complement one another. And I think that's really important.

Sometime ask me about laughter yoga, and we can talk a little bit further about that.

Gene Kim

So actually, in our conversations, you mentioned how sometimes you are the bearer of surprising, maybe bad news. And so it's even more important, right? That it makes it possible to do your job. Did I interpret that correctly, Chris?

Christopher Porter

Yeah, certainly. I mean, CISOs in general, it's rare that we get to bring good news to folks. We're always highlighting some sort of risk. We're usually highlighting how we're the constraint in the organization from getting any work done.

And so there's often times where we have to have really tough conversations around work that we need to get done or work somebody needs to do for us, and those are always conversations that are a little tougher.

And I think she always comes to them with a tough but fair kind of thing and is really looking at it from the broad perspective of how do we continue to protect Fannie Mae, how do we make the right trade-offs in the organization. And she's always looking to do the right thing, which I think is super important.

Gene Kim

Oh, that's awesome. I'm going to put those words tough and fair in a box because I'll bring it up a little bit later. So Kimberly, as you can tell, I loved your presentation that you did with the team so much from last year because, among many other things, it seems like you model so well how we'd want all of our business leaders to behave in a just world.

Chris mentioned to me that among other things you value very highly learning and psychological safety. I'm wondering if you can put that into context for all of us. Can you talk about your leadership philosophy and how you try to model it in your own daily work?

Kimberly H. Johnson

Thank you, Gene, and I am a little embarrassed. I think Chris only gave all the good attributes. We're going to have to get him on another secret recording for the other ones he hasn't told you about yet.

As for my own leadership experience and style, I definitely believe that psychological safety has to underpin everything, right? And it does come from the business perspective that having a business responsibility means you have to be dedicated to winning. And in order to win, you have to have a unique offering, something that differentiates you from your competitors.

And if you're going to differentiate yourself and have something unique, it can't be easy, right? You have to do something hard, either coming up with a complex and complicated answer or stringing together a series of simple things in a way that nobody else has figured out yet. But you have to do something new and innovative in order to come up with something unique.

And again, to do something unique and innovative, you actually have to learn something beyond what you do today. Back to it would just be the same old, same old if you weren't learning. And in order to learn new things, you have to be able to put yourself out there, take some risks, not be afraid to fail. And so I think that's why for me, psychological safety underpins everything I want my teams to do when they come together, because I don't think you can win without it.

Gene Kim

And so when someone hears someone like you in position of authority say psychological safety is important, I think some people might hear, "Oh, Kimberly is just trying to be nice." Can you help connect the dots on how those virtues end up with a more effective team that actually better enables things that you talk about, like winning, which I think people are far more familiar for people in leadership positions to talk about?

Kimberly H. Johnson

That's right. Well, again, in order to be able to do any of those things to put your team in a position to win, I think you have to create a space for your team to work without judgment and without fear of humiliation. And I'll give you a really simple example.

We all go through times when things go wrong, and we go back and we do all kinds of debriefs, and we do all kinds of root cause analysis, and we come back and we try to talk about what went wrong. And we did that for years and years and years and it never felt like we were really getting to the heart of what was going wrong in a way that allowed us to prevent things like that from ever happening again.

And so we took a big step back and we said, "How do we make these retros a little more blameless?" And we totally changed the structure. Now we don't have people standing up in front of everybody else answering about what went not according to plan.

We've really extracted the data and the stories, and we deliver this to everybody in a way that we can ask hard questions and get to the bottom of things without blaming anybody. So now there's no humiliation or shame in making mistakes. And I think that's the kind of thing leaders have to do to put in place the right structures and environment so that that psychological safety can really shine through.

Gene Kim

Wonderful. Chris, I suspected that you might have had a reaction when I suggested that some might interpret Kimberly as just trying to be nice. You used the word tough but fair. Can you help square those two thoughts?

Christopher Porter

Yeah, certainly.

At the end of the day, we have to get our objectives met, and we have to have accountability to do that. So I think what's great is Kimberly sets a really high bar for us to meet. She's talked about these challenges. We don't do easy things here. And we don't make things easy for ourselves either for that matter, especially when you have a lot of legacy applications like we do.

And I love it in "The Unicorn Project," the complexity debt. We're paying down complexity debt at scale right now. It's a lot. And ultimately we have to have that level of accountability. So not only do you have to have psychological safety so that you have the transparency that you need in order to make good decisions. You can't make good decisions if you don't have good information, and you can't have good information if people are afraid to share it with you.

And so I think it's really important that we get that out there because we can make better decisions, we can lead better, we can move the ball down the field faster as we can, but all the while we have to be accountable to ourselves as well.

Gene Kim

Awesome. Kimberly, can you talk about what you look for in your leadership team? How do you build and develop these capabilities that you talk about? In other words, are these things that you are born with, and if you don't have them, you'll never get them? Or can they be learned? And if they can be learned, how?

Kimberly H. Johnson

Yeah. No, I think that's a terrific question, Gene. I don't know if there's one magic answer, but I can say that I think as a leader, you kind of have three important jobs. And one is to build a good team. Second thing is to actually bring out the best in every person on your team. And the third thing is really about creating the right environment where everybody can work together, and the sort of sum of the parts is worth more than the whole, right? So that's the three things that leader has to do.

And when it comes to building a team, I always look for a variety of different attributes, right? You can't have everybody in your team thinking the same way, approaching things the same way. I love building diverse teams, and I don't mean just people of different races or genders. I mean people who have gone to different types of colleges or have different educational backgrounds. People who've worked in different industries and areas.

And making sure you have people who are short-term problem-solvers and people who are long-term dreamers. You need to have a little bit of everything to get the right balance. And building teams like that makes it a little hard to get work done, because when people are not naturally all in complete concert with each other, it does get a little challenging to navigate through those conversations and the problem solves.

But the results you get are so much better if you bring in all those different views. So I'm a huge builder. I believe that work is a team sport and having a good team is the number one thing that determines whether or not you're going to win.

Gene Kim

Chris, you've worked with Kimberly for five years. I trust that those things that she talks about, you've actually seen over the last five years.

Christopher Porter

Yeah, absolutely. I've been on two different teams that were quite different from a diversity of ideas, for instance. When she was running the chief risk officer organization, that's a completely different set of folks that come from very different backgrounds. Diverse from a business perspective as well, but also how they think about risk.

And then you come over to the technology side and you've got a completely different group. Her organization is much broader in the sense of what she's covering when it comes to technology, cloud, security, data, our operations team. It's a wide variety of perspectives certainly. And I like to think that maybe I bring some of that awkwardness to the problem-solving sessions with my differing perspective as well.

Kimberly H. Johnson

That's awesome, Chris. Hey, Gene, I wanted to go back and answer one more thing that you asked about, because I think it's really important. You were asking about whether or not that good leadership is inherent and people are born with it or whether it can be taught. And something Chris said really resonated with me. He said to me, "Kimberly really holds us to a high standard."

And to me, that's a gift, right? High expectations are a true and honest gift to the people that you're giving them to. And I have believed in that a long time.

I once read about a study, it was like a social science study that happened back in the '60s. And I think it was Robert Rosenthal who had done this back with Harvard. And he had gone out to San Francisco and picked out a group of elementary school students, and he gave them all IQ tests. And he randomly sorted a handful of those students, and he went and he told the teachers that these students had aced this IQ test and they had really high potential, and it was their job as teachers to bring out the best in the students.

And these were students that did not have the highest IQ scores. They were randomly selected. And they tracked these kids over the course of their lifetimes, and they actually did have higher and higher IQs and better outcomes, and had terrific life experiences just based on the fact that one teacher, one time in their elementary school years, had focused on bringing out the best in them because they thought they had a lot of potential.

And that just really struck me as an amazing insight, that just believing in people can actually make them better. And so for me, again, high expectations, believing in people, understanding and knowing what makes them tick, and helping them navigate the kinds of things that they can't always control really does bring a true belief in your team being able to achieve high things. And I've found it is the magic ingredient to high-performing teams.

Gene Kim

Oh, so incredible. Well, thank you so much, Kimberly and Chris. I'm such an admirer of everything that you've achieved, and thank you for taking the time to teach this community about leadership. Can you tell everyone how people can best reach you and what in particular you would want people to reach out to you about? Is there anything particular in terms of help that you're looking for? Kimberly?

Kimberly H. Johnson

Gene, thank you for that opportunity. We're always looking for help. We've been on our DevSecOps journey now for about a year and a half, and we are making terrific progress. I am so thrilled with the way that our teams are going through adoption.

But I'd say that it's a big question we have is about scale, right? Doing this across hundreds to thousands of people is something that we are learning as we go along. So if you do have any of your constituents out there who have done some of this at scale, we would love to trade some stories about that.

Gene Kim

Awesome. Chris?

Christopher Porter

Yeah, same thing. Anything around automated security testing. We've also recently developed something called the Security Champions Program, where we're educating developers on security.

Gene Kim

Mm.

Christopher Porter

We've just sort of kicked that off and really excited about some of the initial results that we've had. But if folks want to reach out to me, they can reach out to me on LinkedIn, or they can hit me up on Twitter at cdporter00.

Gene Kim

Thank you. Thank you so much, Kimberly and Chris.

Kimberly H. Johnson

Thank you, Gene. This has been a pleasure.

Christopher Porter

Yep.