DocuSign, Inc. (DOCU) Earnings Call Transcript & Summary

Good day and thanks for joining. I'm Bob Bragdon, Senior Vice President and Worldwide Managing Director of CSO. Organizations of all shapes and sizes have unique stories of resilience to tell about their experiences responding to the pandemic, lessons to reach beyond just the pandemic response and speak to the resiliency of their organizations. Today, we're speaking with Emily Heath, the Chief Trust and Security Officer at DocuSign. At one time or another, we probably all use their solutions, and as a global business, with 500,000 customers and hundreds of millions of users in over 180 countries, Emily has her hands full. Emily, my friend, it is so good to be speaking with you today.

It is an absolute joy and a pleasure as always, Bob.

Emily, please introduce yourself and tell us about your background and what you're up to now.

Of course. So as Bob said, I'm the Chief Trust and Security Officer at DocuSign. I joined DocuSign about 7 months ago or something like that, so fairly new to DocuSign. A little bit about my background, just very briefly. So I haven't always been a CISO. I started my career as a detective in England for many years. I used to investigate fraud. So I used to investigate people like, [indiscernible], the multimillion-dollar investment frauds. I did had a ton of investigations with the FBI and the SEC and people like that. It's interesting because the people in England who I was investigating at the time was stealing money from people in the United States, which is funny that I ended up here. I found myself into a career in technology. There was actually nothing to do with security. It's a cocktail conversation for another day. But I actually used to run ERP teams, developers teams, infrastructure groups, a PMO, and I actually found my way into security more from the compliance side rather than from the kind of more traditional network security side. So I've been a CISO now for many years. Prior to DocuSign, I was at United Airlines. And before that, I was at AECOM, a company that's an architecture engineering construction company.

Excellent. So you've been in the job, like you said, since last October, right? A heck of a time to shift gears.

Yes. I know.

What were your priorities going into the job? And have they changed at all because of the pandemic and its impact on the work environment?

Yes. So coming into any new company, I think any CISO always has their hands full for the first few months, just getting to know the lay of the land, getting to know the landscape. Every company is an ecosystem these days because we've all got so many third parties, and we're connected to all kinds of people and data goes everywhere. So my top priority at any company has been a lot of listening and a lot of observation in the beginning and learning to really get my arms around who this company is and what matters to us the most. So I'd say building off of the great work that's already been done, the amazing thing was there's already great security program at DocuSign when I got here. So it's how I can leverage the platform that had already been built and build that even further so that we can scale. So I think in terms of priorities that comes to me, I use the concept of visibility all the time because it's really important to security professionals that we understand every connected everything to our environment. So understanding the attack surface, understanding where all the assets are and who manage them and who has access, the priorities of that and making sure that we are proactively monitoring our environment so that we could detect evil very quickly, was the #1 priority coming in. And it would be going to any company, to any organization. That's probably the central core of any good program is that you understand what your attack surface is and then try and reduce it as much as you can. So that hasn't changed since COVID came along. It's still the #1 priority, and still the thing that the team is working on. So in terms of the working remote, working at home and the whole COVID situation, that actually didn't change the priorities for us much at all. We have a number of programs that we've decided on prior to this whole COVID world happening, and we're still working on those things. So it really didn't shift our gear very much. I think the planning, I was very fortunate in that, at least I've got a chance to spend a few months in the office and meeting in person because we step up relationships with people. It's hard for folks coming into a new organization who never actually met people in person. I have a couple of people on my team that have hired into my leadership team who I've never actually met in person. It's been fully remote interviews and trying to build teams. That's why it's challenging, but it's taught us to do things a little differently. But the core fundamental priorities haven't changed.

Talk about the new normal.

Yes, really.

So you also run crisis management at DocuSign, and this was certainly the acid test to have responsibility. Talk about your role in managing crises and what you did as the pandemic kicked in.

Yes, absolutely. So my role at DocuSign is a little different than a more traditional CISO role. I have all of the usual cyber stuff, all of the usual kind of information security and governance risk-type stuff. I also have visible security and I also have the crisis management function of physical security and also trust services, which is how we engage with our customers. So it's a multifaceted role. But when the pandemic hit, I very much have to put my crisis manager hat on. So I lead the COVID-19 task force at DocuSign. So the minute this crisis started to hit, which actually was around RSA time. I remember being with some colleagues at RSA, and in the morning, one of the days during RSA, weekend in the afternoon after lunch was just spinning up the COVID-19 task force. So I co-chair it with our Head of People, Joan Burke, who runs our people, in our HR department. And we've been running the task force since February. So we very much brought people in from different parts of the organization, so different levels of the organization as well. But people who have specific subject matter expertise, like the folks that run our events. Obviously, we have to pivot very quickly and do virtual events like this with the other companies. So we took the view from the task force of everything from how it impacts the business, how it impacts our events, how it impacts employees and brought a test force of people together. And at the time, we were meeting multiple times a day when things started to get challenging. And then we continued to meet daily up until, I would say, about a month ago, maybe 2 -- maybe 6 weeks ago, and now we meet twice a week, but it's still the same core task force, and we still keep our eye on all of the illness statistics and how it affects the areas where DocuSign has office locations. So we have got office locations in 22 countries around the world, and we're monitoring each one of these locations to see what the statistics look like and see if there's any possibility of ever opening up anytime soon. So there's a number of things that the task force did. We did a really nice thing for our employees. We gave everybody a DocuSign Care's allowance of $1,000 to go -- do whatever you need to do to make yourself and your family comfortable. If you've only got 1 iPad and you've got 2 kids, go buy another iPad for your kids. So there's been no arguing. If you needed it to go order a new monitor or you needed a new keyboard, then go buy those. If you need to take out for a week because the kids are driving you nuts, then go get take out for a week. We basically let them spend it on anything. And it really helped the employees feel a little love as we were transitioning to closing down the office, everybody working remote and then planning for what the new normal is. I would say for us, we were fairly lucky in that we already were a Zoom shop. We already have Slack. We already have a lot of remote workers. So it wasn't too much of a heavy lift to get on the 4,500-ish people set up and running. Perhaps we had a few more VPN requests and things like that. But for the most part, we were extremely fortunate because I know a lot of companies are not like that. But we're very fortunate that we were pretty equipped to work remotely. I will say it's a lot more challenging to plan to come back to the office, which is what we're doing now.