Asking the right questions: Mary Carmichael on leadership, risk, and women in tech

Mary Carmichael is bathing in light filtering through the window in her Vancouver home. She has a cup of coffee in hand, adjusting the mic to match a new meeting platform. She fiddles with it, keeping good humour. Her morning has long been in process, starting with shuttling her very independent daughter to school. “What I think is interesting about the school,” she says, “is that they’re promoting the girls to speak their minds and be advocates.” 

Mary is struck by how many of the issues coming to light in the workforce today are met head on at her daughter’s independent school. At a junior school level, these girls are being taught how to self-advocate, and not only how to speak up but how to raise an issue respectfully. 

“How do you raise a sensitive or difficult topic, but do so empathetically, with clarity of your point, and with respect? And how do you maintain the relationship when you’re delivering something someone doesn’t want to hear?” It’s one of the many, many questions Mary will ask in the course of the interview. It’s not that she doesn’t have the answer, but that her unquenchable curiosity drives her to dig deeper. 

Mary has fifteen years of experience in strategic planning, risk management, government, and compliance. As the Director of Strategy, Risk, and Compliance Advisory at Momentum Technology, she focuses on strategic planning, governance, risk management, and program delivery. Mary is President at ISACA Vancouver Chapter, a technology professional association serving over 200,000 members in more than 188 countries. The organization provides industry-leading knowledge, standards, credentialing, and education for audit, risk, privacy, and cybersecurity professionals. She is also a proud Ambassador and alumni at the Catalyst, fostering ongoing connections between the Catalyst and its growing community. 

Presently, her niche is technology risk management, a big part of which is strategic risk management. “Part of my job is just having the conversation. I meet with people, and it’s about asking the questions. What needs to be put in place to be successful?” she asks. What do we have? What are we missing? What are the gaps?” Then, Mary develops plans to address them. 

Mary is one of the most technical people you could sit down with, and yet here, she says that human connectedness and communication are the bread and butter. Mary is promoting a new view of risk management; one that is not about loss or property, but something much bigger. Many strategic techniques can help businesses achieve their goals, but Mary insists the key is making it human. Unsurprisingly, she’s trying to turn it into a more positive force. “I found that once you use the term ‘risk management,’ people think of insurance liability, maybe property loss, but really, risk management is all about what we do to become successful in achieving our objective,” says Mary.

Here’s the thing: according to Mary, when you look at a typical IT job, 30% of the skills are purely technical. The remaining 70% are about how you work together as a team. Going back to Mary’s conversations in risk management, she refers to her role as facilitator. What is the thing that makes her a good facilitator? She asks questions. 

“You want to create a culture or climate where people are comfortable sharing information, especially when you look at these digital transformation activities.” These are the skills that Mary says women shine at. So, if the field is disproportionately underrepresented by women, then there is a severe deficit in the focus on that 70%. “I think there is a misconception that the majority of IT jobs are technical,” says Mary. She mentions developers who need to work together as a team. There’s facilitation, talking to customers, and understanding their needs. “I feel that’s something that is overlooked.” 

With deep-felt regret, Mary says that she is one of very few women in the field. Her focus on AI risk management is not very common for women. Mary points to the research. Women enter the field, but then they leave the field, especially in their 30s. There is a point at which they drop off. “Why are women leaving? Why aren’t they staying in it?” asks Mary. From Mary’s personal experience, she found that in the 30’s, when many women were planning to have children, a parental leave impacted their careers. “It was almost as if when they returned to work, it was held against them,” says Mary. “It reveals an unconscious bias.” 

As the President of the ISACA Vancouver Chapter, Mary’s team underwent unconscious bias training as a part of a DEI initiative. In the training, they discussed viewpoints on women taking parental leave. Some of the men said that they gave women a lighter workload so that they could focus on their kids. “But that’s an assumption,” says Mary. “You need to have a conversation first to see what she needs, where she’s at, or what she wants to do with her career.” Mary feels that there are many assumptions or biases regarding women’s level of commitment to work and availability. Her solution: we need to have places where we can have more honest conversation. “That’s another challenge,” she says. “Not many people feel comfortable asking those questions.”

But Mary also holds the standard high for women. There are ways in which women can show up that make a difference, and tighten the gap. In her role with ISACA, Mary encourages women to speak at conferences and participate in panels. She’s noticed that women often hesitate to join a panel. More than their counterparts, they worry about saying the wrong thing. In Mary’s experience, it takes several encouraging conversations to persuade them to join a panel. “It’s important to address and overcome this barrier,” says Mary.  

How do you manage the challenges of being a woman in a top leadership position? It’s a hard question but Mary answers it without a pause. “You’re just strong to it,” says Mary. It’s not without consequences. Mary is breaking the norm in her position as President of ISACA Vancouver chapter. People don’t expect to see a female leader at the mic. 

The first time a stranger came up to her and gave her negative feedback about her presentation, she was really gutted. “It kind of sucked the air out of me,” she says. “Not everyone’s comfortable seeing a woman in such a strong public facing leadership role,” she says. These experiences have given Mary the steely motivation to empower women with effective resilience strategies to handle and bounce back from negative feedback or unfair treatment. 

She has seen it rear its head at the ISACA booth for the She Leads Tech program, where men approach and comment negatively about female leadership. When she talks to women at ISACA events, they confirm this bias. They feel that they are being tunneled towards more project manager roles versus technical leadership. “It could be related to unconscious bias,” says Mary, “you’re assumed to be a mother hen, making sure the group’s well taken care of versus being a technical leader.” Women have confided in Mary that clients don’t feel comfortable seeing a woman leading software development or even being the lead as a software engineer. 

In addition to creating more spaces for honest conversations, Mary is a strong advocate for networking. “Oh, start young,” she says. “I started later in life, maybe five years ago. I should have started sooner.” Mary has felt a change since her early attempts at networking, which is perhaps in conversation with the development she sees in her daughter. Young people are eager to talk, enthusiastic, and Mary enjoys their energy. Her advice is to be clear about your ask. Why are you networking and what are you hoping to achieve? For Mary, it is about learning more about people’s stories and how they can work together. 

In 2024, Mary was awarded one of Top 50 Cybersecurity Experts in Canada. She woke to emails about her achievement and initially thought it was a scam. But after a pause, she realized she was number 17. Humble, Mary says she found this surprising because her following is small. With 3000 connections on LinkedIn, she didn’t think she would be on the panel’s radar. This acknowledgement reinforced for Mary that having a strong personal brand and value proposition on your LinkedIn profile can be a game changer. 

With 3,000 followers, Mary writes about a niche area in cybersecurity, and risk management. She expresses her delight to be grouped with Lester Chng of the Catalyst. “It shows the power of a small, loyal community who supports the work you do,” she says. Mary offers a tip: regularly post about the events you attend, insights from articles, and your support for local tech events and community members. Her routine includes 1-2 weekly posts by reposting and commenting on others’.

The light settles in Mary’s background, the newness of the day gone. Despite her accomplishments, Mary is completely grounded and a realist. “You never achieve work-life balance. It’s more that you manage the unbalance. You try to do the best that you can.” Mary’s outlook is that you have to leave perfection behind. The most important part is understanding what’s important to you and trying to make that a priority. Family is first for Mary. She tries to get outside often, and go for at least an hour walk. “It goes back to what’s important,” says Mary. “But every day, there is always something coming up. So how do you best manage the unbalance of life?” Mary does it well.