---
title: "Angel Liu: Security Teams Must Evolve From Traditional Blockers Into Strategic Business Enablers"
url: "https://authoritymag.co/articles/angel-liu-security-teams-must-evolve-from-traditional-blockers-into-strategic-business-enablers"
publisher: "Authority Magazine"
author: "David Leichner"
authorUrl: "https://authoritymag.co/authors/david-leichner"
interviewee: "Angel Liu"
company: "LinkedIn"
category: "Tech"
datePublished: "2023-04-10T01:24:15.128Z"
dateModified: "2026-11-12T17:07:03.774Z"
tags: "Tech"
---

# Angel Liu: Security Teams Must Evolve From Traditional Blockers Into Strategic Business Enablers

*LinkedIn Head of Governance, Risk and Compliance Angel Liu shares her remarkable journey from Shanghai to Silicon Valley and explains why security professionals must master adaptability.*

> As a leader, I’ve found many hidden leadership lessons in the story, like how the team leader doesn’t always need to be the smartest, but should be able to unite and lead the team through challenges.

---

T*he cybersecurity industry has become so essential and exciting. What is coming around the corner? What are the concerns we should keep an eye out for? How does one succeed in the cybersecurity industry? As a part of this interview series we had the pleasure of interviewing******Angel Liu.*

*Angel Liu is the Head of Governance, Risk and Compliance at LinkedIn, where she is responsible for ensuring the company’s compliance with industry standards and regulations, as well as helping the business managing risks effectively in an ever-changing landscape. Prior to joining LinkedIn, Angel was a senior security engineer on the security architecture team at eBay, where she worked with engineering teams developing and implementing security controls that protected the company’s assets and data. Having held various positions in risk & compliance, third-party security, data governance and security architecture, she enjoys sharing her wealth of knowledge and expertise to help other cybersecurity professionals be more successful.*

---

**Thank you so much for doing this with us! Before we dig in, our readers would like to get to know you a bit. Can you tell us a bit about your backstory and how you grew up?**

I’m from Shanghai, China, and like many in my generation, I’m an only child. Growing up, I had all the attention and expectations on me to achieve good grades academically. My dad was especially enthusiastic about learning English in his young age. Influenced by him, I started learning English when I was little. He always hoped I would study abroad for college, something he never had the resources and opportunity to do, but I ended up getting my undergraduate and graduate degrees in Information Security and Computer Science in Shanghai. My parents were very supportive of my choice of my major, both of which were not very common for girls, especially Information Security. I remember we had a class of 60+ students of which only 10 were girls. I later worked for eBay in Shanghai but felt frustrated with the lack of meaningful work due to my remote work status. So, during a 1:1 with our CISO’s Chief of Staff, I suggested moving to the headquarters for better growth opportunities and was surprised to receive an immediate “yes”. Months later, I moved to California with just two pieces of luggage and started my new life in the U.S.

**Is there a particular book, film, or podcast that made a significant impact on you? Can you share a story or explain why it resonated with you so much?**

It’s tough to choose just one favorite, but I’d like to share a fun Chinese classic called “Journey to the West.” It is very well known and regarded as one of the greatest Chinese classic novels. It has been adapted in various movies, TV shows, of which the most famous one was a TV series in the 80s. It’s about a monk in the Tang dynasty who seeks better translations of Buddhist scripture in the western regions. He acquires three people with unique characteristics, including the famous Monkey King, to help him on his journey. They face many obstacles and evils along the way, but ultimately achieve their mission through teamwork and cooperation. As a leader, I’ve found many hidden leadership lessons in the story, like how the team leader doesn’t always need to be the smartest, but should be able to unite and lead the team through challenges. Watching the TV show again, I can learn more from this “super boss” leadership style beyond just being entertained.

**Is there a particular story that inspired you to pursue a career in cybersecurity? We’d love to hear it.**

Honestly, I chose Information Security as my major in college because I thought it sounded cool and mysterious. I was in the first class of this major at my school 20 years ago, and it wasn’t a widely offered program at the time. After graduation, I actually started my internship in networking and Unix system administration (or now called Site Reliability Engineering). I lucked into my first cybersecurity job through an internship in networking and Unix system administration. When I was finishing up my internship at eBay, the only full-time position open at that time was on the InfoSec org security architecture team and they asked me if I would be interested. I decided to give it a shot. I’ve since moved around to a few different roles in third-party security, was a security technical program manager, and finally landed in Governance, Risk, and Compliance. Each role allowed me to build different skill sets. Although the work in the real world has been very different from what I learned in school, I never looked back, and I’m drawn to this dynamic and multi-discipline space ever since.

**Are you working on any exciting new projects now? How do you think that will help people?**

As head of GRC, I communicate security risks to senior leadership. One exciting project we’re working on is a data-driven risk scorecard using a control validation pipeline. It will provide a holistic view of an organization’s risk posture based on control effectiveness and give leadership visibility and help prioritize resources to address critical risks.

**Ok super. Thank you for all that. Let’s now shift to the main focus of our interview. The Cybersecurity industry seems so exciting right now. What are the 3 things in particular that most excite you about the industry? Can you explain or give an example?**

First, I’m excited about the shift in the mindset of security professionals. In the past, security teams were often viewed as “blockers,” but I see more and more security professionals embracing the culture of being business enablers. This is especially important in fast-paced industries like tech, where security needs to move as quickly as the business. Whether it’s shifting left in SDLC, raising awareness of security risks to executives and board members, or reducing user friction to make security easier, it’s all about enabling organizations to move quickly and securely.

Personally, the second thing that excites me is how dynamic the cybersecurity industry is. Every day there are new challenges to solve and new technologies and tools to help solve them. There’s never a dull moment in this industry!

Lastly, I’m thrilled to see more capable, talented, and passionate women joining the cybersecurity industry. Although there’s still a long way to go to close the gender gap (women currently hold only about 25% of cybersecurity roles), we’ve made a lot of progress in the last five years. I’m inspired by the stories of other incredible women leaders in this interview series.

**What are the 3 things that concern you about the Cybersecurity industry? Can you explain? What can be done to address those concerns?**

In the cybersecurity industry, people, processes, and technology are crucial, and it all starts with people. One of my top concerns is the talent gap, particularly for underrepresented groups. Even though more job openings are available, the talent pipeline isn’t growing fast enough to fill the gap. As an industry, we need to focus more on diversity & inclusion and invest in programs to help people from non-traditional backgrounds to make the choice to embark on a cybersecurity career path. At LinkedIn, we are investing in initiatives like Year Up and LinkedIn’s REACH program to bring in more diverse talent, and we have seen early success.

Another issue is the perceived lack of general security awareness and culture within organizations. Unfortunately, some companies often only realize the importance of security after a security breach has occurred. It’s essential in every organization to create a culture of security and make security everyone’s responsibility.

Finally, technological innovation is moving faster than ever, which can be both good and bad. For example, Generative AI is a hot topic now and can improve people’s lives, but it also comes with security and data privacy concerns and challenges. We as an industry are not new to having to quickly pivot and adapt to emerging technologies, which is even more of a reason to ensure that we remain in constant collaboration with our businesses as they embrace these new technologies.

**Can you share how you are helping to reshape the cybersecurity industry?**

I may not have the power to revolutionize the industry, but I’m determined to make a difference by driving small changes. One of my top priorities is to narrow the talent gap in the cybersecurity field, which is why I’ve built a diverse team with 30% of members from non-traditional backgrounds or early in their careers. These individuals have endless potential and bring valuable skills and viewpoints to the team. In addition, I’m involved in initiatives like WiCyS where I volunteer and mentor aspiring security professionals to help them break into the industry.

**As products, devices and vehicles become connected, this is creating a new and emerging threat vector. How do you think manufacturers and their customers should prepare to be as safe as they can be?**

With the ever-present Internet of Things, products, devices, and yes, even vehicles are relying more on software products and becoming increasingly connected. I feel it’s important to apply similar security principles to building any other software program or application. Some key steps include using secure communication protocols to encrypt and authenticate data in transit between these types of entities, thoroughly testing software for vulnerabilities, and ensuring that fixes for any security issues can be delivered seamlessly to keep the software up-to-date. By implementing these measures, we can drive to achieve more end-to-end security.

**Can you share a story from your experience about a cybersecurity breach that you helped fix or stop? What were the main takeaways from that story?**

In my role as head of GRC, I focus on communicating security risks to senior leadership in the organization, rather than directly stopping or fixing breaches. However, in a previous role as a security Technical Program Manager, I led the response to the Meltdown/Spectre vulnerability. One big takeaway for me was how important it is for organizations to invest in automation and tooling for patching at scale.

**As you know, breaches or hacks can occur even for those who are best prepared, and no one will be aware of it for a while. Are there 3 or 4 signs that a layperson can see or look for that might indicate that something might be amiss?**

For general users, it is important to know how to spot a phishing attempt. Be cautious when receiving emails or messages that ask for confidential information such as passwords or bank account details. If you gain access to data or systems that you normally wouldn’t have, or if you are unable to access systems that you should, report it to the security team. If something seems out of the ordinary, always report it to the appropriate team just to be safe.

**After a company is made aware of a data or security breach, what are the most important things they should do to protect themselves further, as well as protect their customers?**

The first thing I would suggest is to assess the impact and scope of the breach and involve the appropriate teams to contain it. Once it is under control, establish communication protocols to keep stakeholders informed and work with legal and communications teams to notify external parties. After the incident, conduct a post mortem to identify gaps and prevent similar events from happening again. I think it’s very important for companies to have incident response playbooks in place and to make sure the processes are tested regularly to ensure all the important steps to handle a security breach are documented instead of trying to “figure it out” when the real incident happens.

**What are the most common data security and cybersecurity mistakes you have seen companies make? What are the essential steps that companies should take to avoid or correct those errors?**

Basic security hygiene is crucial for organizations, and it doesn’t have to be complicated. Simple steps such as keeping systems patched, enabling two-factor authentication, and providing employee training on identifying suspicious activities or reporting phishing emails can go a long way. Though these feel like basic things to do, many organizations struggle to implement these measures effectively. Conducting regular risk assessments or red team exercises can help identify gaps, but addressing them requires prioritization from the top down and collaboration across different teams. By working together, organizations can ensure a strong security posture.

**Thank you for all of this. Here is the main question of our discussion. What are your “Five Things You Need To Create A Highly Successful Career In The Cybersecurity Industry?**

1. **Stay curious.** In cybersecurity, the industry is always evolving and it’s important to keep up with the latest trends and threats. Maintaining a curious mind will help you adapt to the changes in the field.
2. **Develop effective communication skills**. As you move into senior leadership roles, being able to communicate security risks to different stakeholders is critical. Learning how to communicate effectively to the right people at the right time is a valuable skill.
3. **Build a strong network**. Networking with cybersecurity professionals and attending conferences or events can help you learn from your peers and even land your dream job.
4. **Be compassionate and authentic**. Collaboration and relationships are important in cybersecurity. Being a good listener and seeing from others’ perspectives will help you create win-win situations. Authenticity builds trust and leads to fulfillment and success in the long run.
5. **Embrace a growth mindset**. Similar to my first point, constant learning, including learning from failures and incidents, is crucial in cybersecurity. Conducting post mortems and examining incidents from other companies can help you identify vulnerabilities in your systems.

**We are very blessed that very prominent leaders read this column. Is there a person in the world, or in the US with whom you would like to have a private breakfast or lunch, and why? He or she might just see this if we tag them :-)**

The first person who comes to mind is Satya Nadella. As a first-generation immigrant, the story of how he started as an individual contributor and moved up to become the CEO of one of the most influential companies in the world is extremely inspiring. Moreover, he empowered a culture shift by highlighting empathy, emphasizing collaboration, and helping to show the power of a growth mindset. I admire that he’s not only an incredible technologist but also an extraordinary leader. Plus, as a Microsoft employee, I never had a chance to meet him. It would be cool to meet him in person. :)

**Thank you so much for these excellent stories and insights. We wish you continued success in your great work!**

---

A*bout The Interviewer: David Leichner is a veteran of the Israeli high-tech industry with significant experience in the areas of cyber and security, enterprise software and communications. At*[Cybellum](https://cybellum.com/)*, a leading provider of Product Security Lifecycle Management, David is responsible for creating and executing the marketing strategy and managing the global marketing team that forms the foundation for Cybellum’s product and market penetration. Prior to Cybellum, David was CMO at SQream and VP Sales and Marketing at endpoint protection vendor, Cynet. David is a member of the Board of Trustees of the Jerusalem Technology College. He holds a BA in Information Systems Management and an MBA in International Business from the City University of New York.*

---
Source: https://authoritymag.co/articles/angel-liu-security-teams-must-evolve-from-traditional-blockers-into-strategic-business-enablers (Authority Magazine, Tech). Interviewee answers are first-person statements of the guest. Index of all pages: https://authoritymag.co/llms.txt