Hiring is still a human process, no matter how much AI gets injected into it. In this episode of Secured, Cole Cornford sits down with Kim Acosta, Managing Director at UCentric and former Amazon talent acquisition leader, to unpack how AI is actually changing recruitment and where it is quietly breaking trust.

They explore how candidates are using AI in applications and technical assessments, why misuse often damages long term employability more than failing an interview, and why recruiters and hiring managers are responding with stricter controls, in person assessments, and AI detection. Kim shares what she is seeing across data, analytics, and AI roles, where demand is growing, and why human judgment, rapport, and credibility still matter far more than perfect answers.

The conversation also covers embedded recruitment and RPO models, why soft skills matter more as teams get smaller, and what the next hiring cycle is likely to look like as big tech contracts while smaller companies continue to grow. For candidates, hiring managers, and founders alike, this episode is a grounded look at why shortcuts rarely pay off and why trust is still the real signal.

00:00 – Intro

01:24 – Meet Kim Acosta and UCentric

02:06 – From Amazon to starting a recruitment consultancy

04:19 – Data engineering demand vs AI hype

05:31 – What data engineering roles actually look like

07:27 – Adapting business models to real market needs

10:04 – Where AI genuinely helps recruiters

11:09 – Custom GPTs and interview preparation

13:43 – One way interviews and candidate slop

15:09 – Technical assessments and AI misuse

17:19 – Trust, failure, and reapplying the right way

18:29 – Spotting AI generated answers in interviews

20:19 – Rapport, eye contact, and human signals

22:19 – Hiring for values and team fit

23:52 – Agency vs internal vs embedded recruiters

27:59 – RPO models and cost tradeoffs

28:47 – Layoffs, market shifts, and salary reality

30:57 – Where hiring is still strong

33:10 – Why hiring and podcasts still need humans

🐙 Secured is grateful to be sponsored and supported by Chainguard.

Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Report at https://dayone.fm/chainguard

The Protective Security Policy Framework is meant to guide how government manages security risk, but constant updates make it harder to implement than to understand. In this episode of Secured, Cole Cornford is joined by Toby Amodio, Practice Lead at Fujitsu Cybersecurity Services and former senior cybersecurity leader across Australian government, to break down what actually changed in the latest PSPF update and why it matters in practice.

They examine the growing focus on personnel security and foreign interference risk, the inclusion of AI guidance that adds little beyond basic risk assessment, and the long overdue recognition of Secure Service Edge and SASE as compliant gateways. The conversation also explores why deny lists and centralised risk sharing sound sensible on paper but are far harder to enforce in reality, and why most security failures still come down to behaviour, accountability, and how technology is actually used rather than what policy says.

00:00 – Intro

01:18 – What the PSPF is and why it exists

02:49 – Annual updates, directives, and policy advisories

04:19 – What actually changed in the 2025 PSPF update

05:36 – AI in the PSPF and why it adds little value

08:14 – Tool hype vs implementation risk

10:32 – The AI policy advisory and trusted vendors

14:25 – Directive 3 and clearance disclosure risks

17:21 – Personnel security and enforcement reality

19:41 – Secure Service Edge and SASE recognition

23:39 – Commonwealth Technology Management directive

25:28 – Deny lists, transparency, and security through obscurity

28:05 – Centralised risk sharing and assessment overload

29:52 – Policy wonk or policy gronk

31:12 – Final takeaways and closing

🐙 Secured is grateful to be sponsored and supported by Chainguard.

Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Report at https://dayone.fm/chainguard

Mentioned in this episode:

Download your free CVE Reduction Assessment

Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk.

December 2025 - Chainguard

Call for Feedback

Most security architects are not actually doing architecture. They are doing assurance work, following checklists, and hoping standards will save them. But as systems get more complex and attackers get faster, that approach is no longer good enough.

In this episode of Secured, Cole sits down with Ken Fitzpatrick, founder of Patterned Security and creator of securitypatterns.io, a resource built during the lockdown years that has since grown into one of the clearest frameworks for designing meaningful, context-aware security architecture.

Ken shares why so many architects fall into the trap of compliance thinking, how security design becomes a tick box exercise, and why threat modeling without understanding context is pointless. They unpack the four foundational steps every architect should follow, why traceability matters more than ever, and how modern teams can stop copying best practice and start solving the real problems in front of them.

The conversation also digs into secure by design in different industries, why the term has lost its meaning, and how modern defensible architecture is resetting expectations for what good looks like. Cole and Ken also dive into AI and its impact on the architecture function, separating hype from reality and exploring which roles are at risk as AI improves.

If you work in engineering, architecture, AppSec, risk, or are building a product and want a practical way to think about secure design, this is an episode you should not miss.

00:00 – Intro

00:48 – Chainguard Ad

01:20 – Meet Ken Fitzpatrick and Patterned Security

02:19 – How a cancelled Canada trip sparked securitypatterns.io

04:08 – Why architecture needs practical guidance, not more frameworks

05:18 – The four step method for real security architecture

07:23 – Moving beyond box ticking and why engineering experience matters

09:39 – Teaching architecture fundamentals and selecting the right controls

11:37 – Traceability and making defensible design decisions

13:14 – Architecture vs assurance and who securitypatterns.io is for

16:31 – Embedding secure by design into PMO processes and scale up use cases

19:58 – What secure by design means across different industries

23:05 – Inconsistent definitions in security and the need for clarity

23:50 – Modern defensible architecture and Zero Trust guidance

24:44 – AI’s role in architecture and which tasks get replaced

28:25 – AI in AppSec and reducing false positives with context

30:24 – AI sales bots, hype cycles, and the loss of human reciprocity

33:28 – Ken’s call for collaboration on repeatable architecture patterns

34:28 – Closing and how to connect with Galah Cyber

🐙 Secured is grateful to be sponsored and supported by Chainguard.

Chainguard is the trusted source for open source. Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Report at https://dayone.fm/chainguard

Mentioned in this episode:

Chainguard is the trusted source for open source.

Get hardened, secure, production-ready builds so your team can ship faster, stay compliant, and reduce risk. Download your free CVE Reduction Report now!

December 2025 - Chainguard