Lee Stephen Pitman
Current Employer/Organisation Name
BreachQuest Inc
What have you been doing since leaving Exeter, and what are you doing now?
Immediately after graduating I commenced work with KPMG as a graduate in their London Cyber Security practice within Risk Consulting. This was after completing a successful internship in the summer of 2011 in London with the Cyber practice, which I managed to get on after attending an insight day in person in the Canada Square office. I spent 5 fantastic years at KPMG, which I will forever cherish and be grateful for, having risen from intern to Manager in 4 years. I then spent 2 years at Ernst & Young, within their Cyber team in FSO Risk (EMEA Financial Services Risk Consulting). My roles in the Big 4 were incredibly varied, ranging from setting up database security monitoring at a Oil & Gas supermajority, to providing dedicated digital forensic and incident response services within the cyber insurance industry for AIG insureds. At this point I decided to go my own way and setup my own company here in the UK, providing risk consulting services for clients. This was also incredibly interesting, and was a real challenge in terms of all of the different aspects that go into running your own business. I managed to get a number of clients, and turned over a healthy profit for the year or so I did this. One of the interesting things with a career in cyber security consulting is how small the pool of people that do this is, and so the connections you make tend to last a lifetime. I had a phenomenal offer to join Kivu Consulting in 2019, where a close contact of mine was setting up their EU operations in delivering incident response and recovery services within the cyber insurance industry. Talk about a niche within a niche! Frankly, I got an offer I simply could not refuse, and I have not looked back since. I founded, setup and ran the Global Remediation Team at Kivu for over two years, taking the service from inception to a $10 million dollar per annum business in that time, with a team of 20 in house consultants and over 50 resources available globally. Earlier this year, I was approached by BreachQuest, a start-up based in Dallas, Texas, to come and setup a new Response Services business within the Cyber Insurance industry. This was a big risk for me given I had such a lucrative role at Kivu, but the offer to run my own P&L and join the C-Suite from the onset appealed to my wild side, and I am incredibly happy I have taken on this challenge. My colleagues include Malware Jake, the former NSA analyst who broke the Stuxnet story and was subsequently outed by the Russians. Our investors include the founders of Tinder, so I am fortunate to be in such stellar company! As the SVP – Global Head of Response Services, I oversee all DFIR and Recovery services globally for BreachQuests clients. Its fair to say this keeps me very busy, but I love the challenge and the people I work with. I am incredibly lucky to have a phenomenal team under me, who have been loyal to me since my time at Kivu. I could not have done all of this without them, and this is a fact I cannot overstate enough.
Why did you choose this career? And what do you enjoy most about your work?
As with many things in life, its a mixture of luck, timing and seizing an opportunity when it presents itself. I knew I wanted a career that was focussed on people, and as such, the Big 4 immediately appealed to me, particularly on the Consulting side. I have also always been a bit of a dab hand technically, so when I attended an Insight day at KPMG HQ in Canary Wharf in 2011 and met the Head of their Cyber Practice, it was a match made in heaven and we hit it off instantly. To be perfectly honest, I have not looked back since that day! My career is of course incredibly challenging, and the hours I work are often extremely long, random and very demanding. I often do not get weekends to myself and will regularly have my evenings interrupted. Clients who have experienced a breach always need emergency assistance immediately, and so I can’t pick and chose when this happens. Threat actors also tend to like striking out of office hours, so I guess you could say they like making the good guys life as hard as possible as well! With all this said, I could not ask for a more interesting and varied career. I have travelled the globe, met countless people and every day is different. There is also immense satisfaction in helping clients contain, investigate and recover from cyber attacks. I am on the front line of cyber security, and whilst this does present immense challenges, it is also incredibly rewarding.
Please tell us if you were a member of any societies, groups or sports clubs?
I was heavily involved in the Football Club (EUAFC).
What did you enjoy most about your programme and what was the biggest highlight?
I enjoyed the breadth of studies and the global perspective it helped to engender in my psyche. Some of the political studies were also very philosophical in nature, and as a deep thinker (I think far too much to this day), this was perfect for me in terms of asking deeper questions about the world around me, the society construct we live in, and the human condition in general. I might appear sporty and outgoing on the outside, but inside I am a bit of a secret nerd and introvert, so the studies complemented that side beautifully whilst on the other hand I played football at a high level regularly. I also love History, so I cannot remember a single lecture that I wasn’t engaged and interested in. I guess a highlight would probably be studying Strategic Bombing with the infamous Richard Overy, as well as The History of Politics in the UK with the excellent Richard Toye. Fascinating subjects with world renowned professors makes for a most perfect concoction.
What did you enjoy most about studying here?
The location, the quality of staff and the culture amongst its students. I feel Exeter is one of the friendliest Universities you can go to, and remember this standing out on my visit before deciding to join. It had a much friendlier feel than other Universities, and this very much rang true when I joined full time as well. The staff are amongst the best in the country, so learning from these incredibly talented people was phenomenal. The location in the South West was also perfect for me, as I reside in Dorset. Exeter was perfect for me in pretty much every way.
Why did you choose to study at Exeter?
The University has a fantastic reputation and is of course part of the Russel group. For my areas of study (History & Politics), the University was ranked in the top 5 and top 10 respectively, so I was aiming high from the onset. This combined with the location made it a perfect fit for me. I continue to be a country boy at heart, so studying somewhere in my beloved South West (I still reside in Dorset), at such a fantastic institution was a no brainer.
What skills and experiences have been most useful for your career?
People skills, emotional intelligence, and communication skills hands down. I cannot emphasise how important this is in a consulting career, you cannot get ahead quickly if you don’t excel in these areas. I am still only 30 years of age (which might seem old to some students, but it really isn’t, I promise!), and have got to my positions so quickly because of these skills. There are many people out there who are more technically proficient or possibly academically smarter than I am, but I have not encountered very many people that can match my emotional intelligence and ability to read and influence others with effective communication. If you are considering a career with any emphasis on people (like consulting), I implore you to focus most on your personality and interactions with others. You will go far if you have any sort of adroitness with communicating with other people!
What advice would you give to a current student who wishes to pursue your career?
Be prepared to make sacrifices, and focus most on your people and communication skills. You will also need to decide if you want to focus more on your managerial pathway, or a technical SME path. They have different skillsets, and I have seen many peers struggle to grapple with this, especially the more technical they are. There is no easy answer, as it really depends on the individual. All I will say is that if you chose to get more senior more quickly, the managerial path will make that easier. as over time your technical skills become less important, and business acumen and leadership take over. There are people out there that are phenomenal technical SME’s as well, but this path will focus much more on technical proficiency with certifications, training and thought leadership. In terms of initial steps, I would look at joining a major consultancy (like the Big 4) early on in your career. They will give you access to training, provide you a foundation for a top notch work ethic, and give you access to acquire well rounded skills that other people simply won’t ever have the luxury of learning in their lifetimes. You will be tested, you will work long hours and you will be challenged. But, you will learn more than you could possibly imagine, and when you come out (I always recommend getting to Manager and spending 5 years in there), you will be leaps and bounds of anybody else on the market. If you are financially driven, lets just say I have had no problems negotiating my comp packages after leaving the Big 4. People want you, and you stand out in the best ways possible.
What are your plans for the future?
I intend on growing BreachQuest and helping the company get to its IPO on the US stock market. Transparently, I hope to be able to ‘Semi-Retire’ after this, and focus my time on hiking, sports, and building a family. I am not very good at switching off, so I will most likely also focus my time helping charities, volunteering and giving back to people in some way. I have also considered going back into Education to learn on my own terms for the sake of learning new knowledge, as I enjoy the natural beauty of acquiring knowledge and studying. I may even find my way back to Exeter or other institutions to help shape the careers of the next generation (its scary to think about this given it only feels like yesterday that I was a student!). Ultimately, I think after a high octane 15 years as a Cyber Consultant, I will need to slow down a tad and reflect a little bit more on life.
