As part of our ongoing series spotlighting cyber security leaders within our community, we sat down with Hira Rafiq, who leads a governance, risk and compliance (GRC) and digital forensics team at Trillium Information Security Systems, a leading cyber security firm in Pakistan. We talked about her path into the industry, what creativity means in a field like cyber, the fight to hire and retain women on her team, and the advice she'd give to anyone breaking into, or switching into, a career in cyber.
On not fitting the mold of a developer
Hira leads a team of eight at one of the firms people in Pakistan compete hardest to join, Hira's entry into cybersecurity was not the result of a carefully planned career roadmap. It began with curiosity and a single encounter with a cybersecurity incident.""I started my career at the end of 2020 as a cybersecurity intern. My master's was in information security, but honestly, the knowledge I gained through university felt quite theoretical. I couldn't always connect it to what actually happens in an organisation, and that was one of my biggest challenges early on.
My bachelor's was in IT, and there was one networking subject I was particularly good at. But after graduation, I wasn't sure where I wanted to go. People with a computing background are often encouraged toward software development, but I never felt that was where I belonged.
Then one day I was scrolling through LinkedIn and came across a post about a cyberattack. Something clicked. I became interested in understanding how attacks happen, how they can be investigated, and how organisations can protect themselves. That eventually connected my IT background with my master's in information security."
On ‘jumping’ without a roadmap
Entering cybersecurity can be overwhelming because the field is made up of many different disciplines. For Hira, that uncertainty became an important part of her eventual leadership philosophy.
"When I started, I didn't really know what my career would look like over the next four or five years. I remember listening to experienced people talk and feeling overwhelmed, thinking, how am I ever going to get there?
Cybersecurity isn't one discipline. There are so many areas you can explore, and when you're starting out, you're not always sure which direction to take.
That experience shaped the way I work with people today. I try to give my team the kind of direction I wish I had at the beginning: clarity about where they are, what they need to learn, and what they can work toward next.
You don't necessarily need to have the entire roadmap figured out on day one. But having someone help you understand the possible paths can make a huge difference."
On mentors, and having to be twice as technical
Like many professionals entering a highly technical and competitive industry, Hira found that confidence had to develop alongside technical ability. She credits colleagues, managers and mentors throughout her career for helping her recognize capabilities she had not yet recognized in herself.
"When I was new, I sometimes felt that I had to prove that I belonged. Cybersecurity is still a field where technical credibility matters a lot, and when you're starting out, you can easily question whether you're good enough.
I've learned from many people throughout my career: managers, colleagues, clients and even my own mistakes. I don't think mentorship has to come from one person. You can learn something from almost everyone you work with."
Why technical expertise isn’t what makes a leader
Before anything else, Hira wants to correct a common assumption, that the most technical person in the room is the natural leader.
"Technical knowledge is important, but it only takes you so far. Leadership requires a completely different set of skills as well.
One of the most important skills in cybersecurity is translation: taking a technical finding and explaining what it actually means for the organisation.
In consulting and security roles, you often have to communicate with people who don't work with technical details every day. You need to be able to explain what the issue is, why it matters, what the potential impact could be, and what should be done about it.
Early in my career, those conversations were intimidating. I sometimes felt that the other person expected me to know everything. But the reality is that nobody knows everything in cybersecurity.
The important thing is to be honest about what you know, recognize what you don't know, and have the confidence to go and find the answer."
On purple, and combining facets of cyber expertise
Hira's experience across GRC and digital forensics has given her an appreciation for how closely different cybersecurity disciplines can complement one another..
"GRC and DFIR look very different on the surface. GRC focuses on governance, risk, compliance, policies, controls and improving an organisation's security posture. DFIR is much more investigative and technical.
But the more I worked across both areas, the more connections I started seeing.
A strong understanding of governance helps you understand why certain controls matter. A strong technical background helps you understand whether those controls actually work in practice.
I've started thinking about cybersecurity less as separate boxes and more as connected disciplines. The strongest security professionals understand how different parts of the security function interact.
You also need to understand different perspectives. Defenders benefit from understanding how attackers think, while people working on offensive security can benefit from understanding how defenders detect activity. That ability to look at a problem from another perspective is valuable regardless of your specific role."
On leadership and building trust
For Hira, leadership is not only about delivering projects. It is also about creating an environment where people can communicate openly, ask questions and develop professionally.
"When you're in a leadership position, you naturally spend less time doing technical work hands-on. That means you have to make a deliberate effort to keep your technical knowledge fresh.
Cybersecurity changes constantly, and technologies such as AI are accelerating that change. You can't rely only on what you learned several years ago.
For me, that means reading research, revisiting fundamentals and continuing to work through practical challenges.
I also believe teams should have opportunities to test themselves outside their normal project work. Practical exercises, investigations, assessments and technical challenges can expose gaps that day-to-day work doesn't always reveal.
Learning isn't something you complete. It's something you maintain."
On building safe spaces and leading with the person, not the project
For Hira, leadership goes beyond delivering projects or meeting deadlines. A significant part of it is creating a team culture where people feel trusted, supported and comfortable enough to speak openly.
"The projects are important, but the people delivering them are even more important. I try to understand the challenges my team members are facing, both professionally and personally, and create an environment where they feel comfortable talking to me when they need support.
For me, building that relationship is about creating trust. People should feel that they can raise a concern, ask for help, admit when they don't know something, or talk about a challenge without immediately feeling judged.
I also believe that supporting people doesn't mean compromising on accountability or standards. You can have high expectations while still being understanding of the circumstances people may be dealing with. In fact, I think people perform better when they know that their leader genuinely wants them to succeed.
Over time, that becomes part of the culture of the team. You want people to support one another, communicate openly, and feel that they are part of something rather than simply working on a project.
For me, leadership is ultimately about building an environment where people can do their best work, grow professionally, and know that their contribution matters"
Why learning in cyber never stops
Stepping into leadership came with a tax Hira names plainly: the further you move from the hands-on work, the faster your technical edge dulls, especially now.
"When you're in a leadership position, you tend to forget your technical expertise, because you're not doing it hands-on every day. Cyber security evolves day after day, and with AI it's moving even faster, so you have to keep your basics fresh. Everyone has that imposter feeling of not knowing enough, it happens a lot, even to people who've been doing this for years.
The way I refresh my knowledge is by reading research papers, and TryHackMe has helped me a lot. When I need to bring a basic concept back, I just search it and do the room on that topic. I hold my team to the same standard. Doing projects is one thing; refreshing your technical expertise is another. So every quarter, tied to our OKRs, I set them live challenges to solve, control assessments on the GRC side, investigations on the DFIR side. We call them cyber drills."
On hiring for potential, not credentials
The number Hira is proudest of is a small one: three, the number of women she has personally hired onto her team, in a field where she says hiring women is still treated as a risk.
"In cybersecurity, I don't think we should limit talent to a particular degree, certification, or career path. I've always tried to look beyond someone's CV and understand how they think, how curious they are, and whether they genuinely want to learn.
I've had the opportunity to work with people from very different educational backgrounds, including someone whose degree wasn't related to computing at all. What mattered was their ability to learn, their curiosity, and their willingness to put in the effort. With the right guidance and exposure, they were able to develop into a capable cybersecurity professional.
I also believe we need to challenge some of the assumptions that still exist around who can succeed in cybersecurity, particularly when it comes to women in technical roles. Talent shouldn't be judged by stereotypes. Give people the opportunity to prove themselves, set clear expectations, and evaluate them on their ability and performance.
For me, hiring is about identifying potential and then creating an environment where that potential can actually develop. If someone has the right mindset, curiosity and commitment to learning, technical skills can be built over time."
On stepping in and fighting for her team
For Hira, leadership also means being willing to advocate for her team and ensure that people are treated fairly.
"One of the responsibilities I take seriously as a leader is standing up for my team when I believe something isn't fair. Not everyone feels comfortable questioning a decision, especially when it comes from someone more senior, and I think that's where a leader has an important role to play.
I don't do that only for certain people or based on their gender. Whether someone is male or female, if I believe a team member has been treated unfairly, I feel it is my responsibility to raise the concern respectfully and make sure their perspective is heard.
At the same time, I want my team to know that they can speak up themselves. Leadership isn't about speaking for people all the time; it's about creating an environment where people have the confidence to speak for themselves.
I'm also very conscious about creating a respectful and inclusive environment within the team. Everyone should feel comfortable working with their colleagues, raising concerns and being themselves without feeling excluded or uncomfortable.
For me, that's an important part of leadership: supporting people, encouraging them to speak up, and making sure that respect and fairness are part of the culture we build together."
On being a mother and a leader
For Hira, being a mother and a leader are not competing identities. Her experience has reinforced her belief that women should not have to choose between professional ambition and family.
"I'm a mother, I'm leading a department, and I've built my career while balancing both responsibilities. I don't see being a mother as something that limits what a woman can achieve professionally.
I think women sometimes place limits on themselves because they feel they have to choose between their personal responsibilities and their career. But with the right mindset, support and determination, you can pursue both.
I've always wanted my work to speak for itself. I hope that by building my own career and supporting the people around me, I can contribute to a culture where women are seen for their capabilities and given the opportunity to grow into leadership roles.
Women can lead, build teams, take on difficult challenges and make a meaningful impact. The important thing is that we create the space for them to do it."
On her advice for the next generation of women
Hira has watched too many capable women disqualify themselves before they ever begin, and it's the thing she most wants to change.
"Don't wait for the perfect moment.
If you're interested in cybersecurity, start learning. Build your fundamentals, get hands-on experience, explore different areas and figure out what you enjoy.
You don't need to know everything before you begin.
Cybersecurity is a long journey. Your first role doesn't have to define your entire career. You can move between disciplines, develop new skills and discover strengths you didn't know you had.
Stay curious, keep learning, and don't let the fear of not knowing enough stop you from starting."
One piece of advice on where to start: GRC involves understanding an organisation's risks, controls, processes and security posture, and then being able to provide meaningful recommendations.
“For someone at the beginning of their career, I think it can be valuable to first develop practical exposure to areas such as SOC operations, DFIR, VAPT, network security or other technical disciplines.
That experience helps you understand how security works in practice.
Later, moving into GRC or consulting can allow you to combine that technical understanding with risk management, governance and business communication.
There isn't one correct career path, but building a strong foundation and then gradually expanding your perspective can be very useful."
On the biggest shift she's seen
Zoom out, and the change Hira is proudest of isn't a title, it's a shift in how her whole market thinks about risk.
"Back in 2021 and 2022, most organisations in Pakistan weren’t giving cybersecurity much importance. It was often treated as something that could be addressed later. In many cases, it took a breach for organisations to realise how serious the risks were. They learned it the hard way.
Today, the mindset is very different. Organisations are much more aware of cybersecurity and are taking it more seriously, not just because of incidents, but because they understand the business and regulatory risks involved. The organisations I’ve worked with have also contributed to that shift by putting more focus on assessments, compliance, and security controls.
You can even see the change beyond organisations. Universities in Pakistan are now offering dedicated cybersecurity degrees, which shows how much the field has grown.
Five years ago, cybersecurity was often something organisations reacted to after an incident. Today, there is a much stronger focus on understanding the risks, meeting regulatory requirements, and being prepared before something happens "
We left Hira with one quickfire, industry-old debate.
True or false: the best red teamers think like blue teamers, and the best blue teamers think like red teamers?
"True. They have to. You need to think like the other side. As a red teamer, you need to understand how defenders will respond, and as a blue teamer, you need to understand how attackers think and operate."
Explore how to empower your team on TryHackMe for Business.
Joanna Duffy
