Gergana Karadzhova-Dangela wants to send the ladder back down to the next generation of incident responders

Monday, July 10, 2023 08:07

Gergana Karadzhova-Dangela is used to being with users during some of their toughest moments.

Today, she spends much of her time responding to active cybersecurity incidents with Cisco Talos Incident Response, helping customers work through active attacks, many of which put personal data or sensitive information at risk.

And while admittedly less high stakes, her first job in IT at Mount Holyoke College in a small town in Massachusetts prepared her for this.

There, she had an information technology support job with the college where she would help service students’ computers — many showed up in tears worried they’d lost the entirety of an important project or paper.

“It was 2008, back then, cloud was not as prevalent,” Karadzhova-Dangela said in a recent interview. “So if your laptop crashed, you were in trouble. We’d try to save the paper if possible and help them reset and get on their way.”

A decade-plus later, she had no idea she’d be working with Talos IR, let alone living in Switzerland. She was born and raised in Bulgaria, and her first time out of the country was to attend Mount Holyoke College and take that IT support job while she completed her bachelor’s degree in German and Russian studies.

Karadzhova-Dangela’s family put her on a plane to Massachusetts without a return ticket and it wasn’t until the IT job gave her enough disposable income to afford plane tickets back and forth to Bulgaria that she could see her family. Still, the opportunity to attend college in the US was nothing short of a miracle in her life. Her mother worked as a babysitter in the U.S. when she was younger and told Karadzhova-Dangela stories about America, which made her want to go to school there and explore the broader world.

While in undergrad, she studied abroad for a year in Potsdam, Germany and traveled to Poland, France and England. All that travel pays off today when she’s working with a global client base — she can speak six languages, though she jokes that she can only speak “a little bit of French.”

Back home in Bulgaria after graduation, she started considering a career in data analytics, so she returned to school in Germany. While there, she became interested in cybercrime and using data analytics and digital footprints to track bad actors, which eventually brought her to Talos IR as a consultant.

“I was 26 when I started [the digital forensics collegiate] program, and I remember telling my friends and they were all like, ‘Oh my God, you’re going to be 31 when you graduate,’” she said. “With the learner that I am, I knew I’d need a structure to gain these skills, so a traditional degree was the right path for me.”

Many of the interpersonal skills any IR professional needs she had to learn on the fly — but it came naturally coming from a large family in Bulgaria where she was used to having a large support system.

“You grow up empathetic with a large family,” she said. “And in college, I had to write a lot, I had to present a lot and learn to just be a communicator.”

These are all important skills when you’re in a high-pressure cybersecurity incident, she says, especially when she’s working on-call. During these stretches, she said she has no control over how her “average day” looks because she’s answering questions on the fly from the customer or working with the customers’ team in the trenches to resolve the incident as quickly as possible.

“[Customers] have so many projects going on at the same time, and defenders have limited resources for these projects,” she said. “So, they’re being overwhelmed by the tasks they have in front of them. There’s so much awareness of the risks involved in cybersecurity but only so many resources to dedicate to those risks.”

Karadzhova-Dangela sees first-hand how few women are in the cybersecurity and IR fields, so now that she’s established in her career, she wants to empower other women to enter the field. She spends a lot of her time outside of the office working with non-profit organizations and events that specifically cater to females and other populations with limited resources to teach them security skills.

Part of this is using Cisco’s “Time2Give” program which enables employees to take time off from work to help the various non-profits and causes they support.

In early June, Karadzhova-Dangela and Yuri Kramarz, her IR colleague, hosted a “Discover Cyber Workshop for Women” along with Cisco Qatar and the University of Doha for Science and Technology. Just a week later, a similar workshop took place in Berlin in cooperation with ReDI School of Digital Integration. Both workshops gathered several speakers from the security field to share their stories and encourage women to enter the field.

Karadzhova-Dangela and fellow IR colleague, Harpreet Singh, at ReDI School of Digital Integration in Berlin, where they taught a month-long class in networking foundations class to underprivileged students.

“Women of various backgrounds come to the Discover Cyber Workshops to hear stories from real cybersecurity professionals. The good, the bad and the ugly truth about working in the field. Then they can think about if it’s a good professional path for them,” she said.

Karadzhova-Dangela is also part of the internal Cisco Women in Cybersecurity Community where she’s leading the pillar responsible for bringing more women into the field.

“In general, I really love teaching. And so few women consider cybersecurity as a career, or they just don’t have contacts with other women in security,” Karadzhova-Dangela said. “But I try to tell them that the work is interesting, you’re surrounded by smart and cool people, and you’re always working toward a better society.”

It’s that aspect of helping people that drives Karadzhova-Dangela into the next phase of her IR career. The incident that she feels most proud of is an active attack against a public agency in Germany that “could have potentially affected millions of people.”

After spending many years studying there — and having a husband who’s German — Karadzhova-Dangela said it was personally important to her to help resolve the issue.

“Being able to be a part of this group effort to help this customer get back on their feet, and help citizens, for me it was very meaningful,” she said.

If your organization would like to work with Gergana or one of her fellow Talos IR team members, you can reach out to them here. Talos Incident Response offers a range of proactive services for security teams, including hands-on tabletop exercises, a state-of-the-art cyber range for training and much more.