The Cybersecurity Defenders Podcast

What makes a strong security team? With Andrew Cook from Recon InfoSec / Defender Fridays [#305]

Mar 27, 2026
Andrew Cook, CTO of Recon InfoSec and former Air Force officer, champions builders who create tooling and automation. He recounts inventing early defensive cyber systems, explains hiring and managing engineers-as-builders, and describes building a capability-driven SOC. Practical tips include scripting, home labs, and designing orgs and incentives that let builders thrive.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
ANECDOTE

Praetorian Hired Engineers Not Ticket Takers

  • At Praetorian Andrew saw a hiring philosophy favoring engineers as builders rather than ticket-driven analysts.
  • Nathan Sportsman framed pen-testers as engineers, cementing Andrew's belief that "you can never go wrong hiring builders."
INSIGHT

Builders Turn One-Off Work Into Machines

  • Builders approach problems by asking if something should be a one-off or turned into a reusable machine.
  • That mindset converts repetitive tasks into automated capabilities that scale when multiple builders collaborate.
ADVICE

Practice Building Even For Quick Tasks

  • Work the "building muscle" by practicing automation even when quick manual fixes exist.
  • Andrew recommends experimenting now with AI, cloud code and small automations because they're faster and strengthen future build speed.
Get the Snipd Podcast app to discover more snips from this episode
Get the app