Heather Smith Plays the Long Game Against Cybercrime

There is a deliciously literal quality to the extracurricular life of Heather Smith. The chief marketing officer of a cybersecurity company designs board games. She curls. She never misses Gen Con, where thousands gather to study rules, bluff, collaborate, calculate odds, and occasionally argue about cardboard. Even her leisure has turn order.

This is not a cute detour from the résumé. It is the clearest window into it. Smith has spent more than two decades in technology marketing, work that requires translating systems without sanding off their complexity. At SpyCloud, the Austin company that turns recaptured criminal data into identity-threat intelligence, her job is to help customers see danger that is both deeply personal and largely invisible. A stolen password looks inert. A stolen session cookie looks like nothing at all. In criminal hands, both can become a door.

Smith's response has been to make the door, the stakes, and the next move visible. Her remit now covers global brand, communications, demand, product marketing, and sales development. She arrived in 2019 as SpyCloud's first full-time marketing hire, when the company had about 30 people and worked from a coworking space. By her seventh anniversary, she could write that the company protected seven of the Fortune 10 - and that she had built what she called her dream team of marketers.

The résumé is a strategy map

Smith studied at Penn State's Schreyer Honors College from 2000 to 2004 and left with two degrees: a B.S. in Information Technology and a B.A. in Film/Video. The pairing almost sounds engineered in hindsight. One discipline asks how parts connect; the other asks what an audience sees, feels, and remembers. Her later career keeps bringing the two together.

She began in a corporate marketing department that served companies in several industries. Technology won her attention because it refused to stand still. She has described its pace as sometimes breakneck, both challenging and exciting. The constant demand to learn suited her. More importantly, she wanted to reproduce that cycle inside her teams: learn, grow, make the next hard thing less mysterious.

Her pre-SpyCloud record includes enterprise software company arcplan and Rackspace Technology. At Rackspace, Smith ran events and helped invent the company's first hosted conference, workshop, and retreat program. Rackspace::Solve was not a single big night followed by a tasteful photo album. Over five years, a few dozen gatherings around the world engaged more than 6,000 IT leaders and practitioners.

Smith tells that accomplishment as a story about three women: herself, her boss, and a peer. Other colleagues helped, but those three formed the operating center. What she remembers is trust. That choice is revealing. Marketers are professionally encouraged to put the metric in 72-point type. Smith keeps the 6,000, then points behind it to the relationship that made the number possible.

When you know you have other women “in it” with you, giving their all…you can produce magic.

Heather Smith on the team behind Rackspace's event series

Rules, risk, and a box of cards

In 2016, Smith's name appeared among the designers of two licensed tabletop games. Valiant Universe: The Deckbuilding Game turns comic-book factions and superheroes into a contest for a shifting facility beneath Alcatraz. Vikings: The Board Game, based on the television series, divides play into winters of preparation and summers of exploration and raiding. Both ask players to manage resources, read conditions, and revise a plan when other humans interfere with it. In other words, Tuesday.

Game design is unusually intolerant of vague thinking. A rule either produces the behavior you intended or sends everyone to a forum at midnight. It teaches the difference between a beautiful concept and a playable system. Marketing leadership presents the same test in business clothes: can an idea move through people, tools, incentives, deadlines, and budgets without losing its purpose?

Curling supplies another version. The stone has momentum, the ice changes, and a team has only seconds to read the line and act together. Precision matters, but so does adjustment. Smith's public leadership language favors the same combination. Think boldly. Execute thoughtfully. Measure rigorously. The verbs are active; the adverbs keep them honest.

Hire the unfinished person

Smith's most interesting operating belief concerns what happens before someone joins the team. She rejects the expectation that a candidate should enter a role with every listed capability. She has taken jobs without the complete desired toolkit herself, then benefited from a leader who recognized her potential and supplied coaching.

Now she makes that wager from the hiring side. Smith has said she has hired people who possessed only 25 to 50 percent of the stated skills but brought attitude and adaptability. Some became among her most objectively successful colleagues. This is not romantic management by vibes. Adaptability is a capability, coaching is work, and the eventual outcome should be measurable. The bet simply includes a person's trajectory rather than treating today's inventory as destiny.

Her view of representation follows the same practical logic. Diverse teams, she argues, solve problems more effectively and better reflect their customers. A leadership table also operates as proof: younger colleagues can see that reaching it is possible. Smith does not leave the subject as a value printed in a careers brochure. She has described raising gender dynamics directly with female candidates and explaining the conditions they can expect at SpyCloud.

The expectation that everyone comes into a role with 100% of the experience necessary is, frankly, insane.

Heather Smith on hiring and potential

Make the invisible actionable

The same instinct appears in Smith's product storytelling. In a 2025 essay, she argued that security has defined identity too narrowly, as if an employee were merely the account the company manages. Actual digital lives sprawl across old emails, usernames, personal devices, reused passwords, cookies, and past affiliations. Criminals assemble those fragments. Defenders need to see the whole pattern and act before the fragments become entry.

Her metaphor was a house. Passwords and multifactor authentication lock doors and windows. A more complete approach also needs the neighborhood watch, alarm system, and locksmith, because the criminal may already have copied a key. It is cybersecurity explained without requiring the reader to enjoy cybersecurity explanations.

Smith also helped build SpyCloud's Check Your Exposure tool, which gives people a way to examine corporate and personal risk associated with breaches, malware, and phishing. The project fits her pattern: take a remote threat, put a handle on it, and let someone do something next.

In early 2026, she presented SpyCloud's Supply Chain Threat Protection launch as the result of listening to customers. The advisory board's recurring problem was limited visibility into identity threats at vendors, partners, and suppliers. Her line was neat and useful: “Your supply chain isn't a compliance checkbox. It's an extended attack surface.” The sentence turns an administrative object into spatial risk. You can almost see the perimeter move.

The work nobody sees

Conference floors are designed to conceal labor. Lights are on, screens behave, demonstrations land on cue, and everybody pretends the shipping crate never existed. After a major Black Hat week in 2025, Smith wrote about the hundreds of invisible hours: planning calls, creative work, product launches, documentation, and the collective will required to make the week happen. Then she named the marketers and sales-development colleagues behind it.

By August 2026, that instinct had produced Camp SpyCloud, a Black Hat booth dressed as summer camp. Visitors could direct demonstrations, examine exposure reports, and pick up survival-kit swag. The subject was stolen identities and hijacked sessions; the setting offered cabins, counselors, and campfire language. In a hall flooded with acronyms and artificial intelligence, nostalgia did useful work. It lowered the drawbridge.

Smith's humor tends to be compact. On her seventh anniversary she ended a sober reflection on automated criminals and a worsening threat landscape with her description of the daily task: “make bad people sad.” The phrase works because it gives the mission a human-sized pulse. Cybercrime is complex. The desired emotional outcome, at least for the criminal, need not be.

A board game ends when the victory condition is met. Cybersecurity offers no such courtesy. The board shifts, attackers automate, and yesterday's reliable rule becomes tomorrow's opening. Smith seems energized rather than insulted by this arrangement. Nothing in technology is static, she has said. Learning produces growth. Then the cycle begins again: study the system, gather the team, make the risk visible, and play the next move.