The Blumira team has expanded during COVID, leaving them with a Zoom compilation for a company photo.

How does someone build a career in successful startup exits 5 companies deep in a smaller and still emerging tech hub like Ann Arbor? Ask Jim Simpson, who has done just that in the burgeoning security startup scene in Ann Arbor with startups including Duo Security and Arbor Networks. Now new security startup Blumira, whose alumni include people from Duo Security, Censys, Groundspeed, Deepfield by Nokia and the NSA, has just hired Ann Arbor security startup veteran Jim Simpson as VP of Product as the company heads into its next building phase. Blumira has closed on $2.6 million in funding in the last year and recently doubled its team of about a dozen to two dozen, hoping to double that again in the next year to 50. We chatted with Simpson this week about the company's rapid growth and how Blumira is working with the dynamics created by COVID-19 instead of against it to build success.

Whom is Blumira Security Serving?

"We work with the small and medium sized business market, where a lot of companies have a hybrid tech stack," Simpson explains. "We are focused on getting customers up and running more quickly on the cloud. Companies of all size are looking to move infrastructure to AWS or Azure, so we're looking at the security posture of those services as well. Clients need to look at cloud services to be cost effective, but may not be aware of security issues." Blumira's approach for increasing adoption of their security services is to advise clients on which services might work well for their situation, and then to help them monitor security issues within that setup when they don't necessarily have a large staff to handle security issues.

"People know what they need to some extent, but we can say you can also automate and condense your security management," Simpson says of the many business customers they have approaching them about needing better security management as workplaces become blended with remote work and face different ongoing security risks.

Jim Simpson is new VP of Product at Blumira Security in Ann Arbor, where he has worked for 5 security startups that exited successfully.

Security Trends in Business Customer Needs

"Key concerns among customers include the migration to different cloud services, because customers are expediting their plans from 1-2 years in the future to this year because of COVID. Clients are looking for ways to solve problems, but also want to have advisors to do this quickly," Simpson says.

Just as biotech startups in Ann Arbor have pivoted to embrace opportunities brought on by the urgent need for COVID testing or inflammation treatments during the pandemic, companies like Blumira are assisting the numerous smaller businesses who need a cost-effective way to address the security issues of remote work and cloud migration, and need a solution much faster than they were originally planning. But it's not just a question of right business at the right time. Simpson is a key hire for Blumira because he's built this kind of company before.

Blumira Is In the Building Stage

"Startups have these phases of growth, from founding and getting the right key technical hires, to building product, then scaling and operation," Simpson explains. Blumira is now in the building stage. "We have the founding team, great product that is resonating with customers. We have great players. Now we're figuring out our hiring strategy for next year as we bring the product to market. A lot of great people are looking to solve harder security problems in modern ways," he says. "But this is the best startup experience I've had so far."

So what's the key beyond product-market fit and knowing how to build a startup? Simpson says this time it's about bringing best practices on the people side. "It doesn't matter if you have a great product. You still need the team to sell it," he says. He gives this example: "A lot of people say insurance is great but most of the time they're thinking why do I have to pay for this? How do we take that feeling out of this?" Simpson says he wants people to feel relief that they have a workable security solution during hard times, not to wonder what they're paying for. And with smaller businesses that have smaller staff to monitor security issues, that means a lot of hand holding to walk through what is needed, why, and how a company like Blumira can take the worry and pain out of ongoing security management.

"When I was at Duo, we were working initially with customers to understand [why they should] want to use multi-factor authentication, because end users increasingly understand that is increasing end user security," Simpson explains as a parallel. "At Blumira, you know you have trusted advisors to help through incidents. There are new unknown threats. People are becoming more aware this will affect them. We try to approach it not from fear based but saying it's going to be okay. The last year has been bad news for people, so saying we can solve this problem in a positive way helps. Remote working has accelerated security concerns companies already faced because the surface area has magnified so much. The corporate network is now everybody's house."

The Blumira team last time we checked in with them, at about a dozen hires.

The Next Security Issue Facing Businesses Post-COVID

It's hard to predict the future, but we asked Simpson what other trends he sees coming down the pike that businesses need to be aware of regarding security. He says it's not just about the security of remote work, but how colleagues collaborate. "How do you collaborate, and securely?" he says he's asking himself lately. "There is a huge opportunity there. The way we work is going to shift after COVID. Other shifts are coming along, too. We will have new things to secure. How do we do that? What are the security challenges?"

Next trends to watch? "It comes back to people and culture," Simpson says. "I don't think we can be 100% remote, but we won't go back to how we worked. We can work remote, but is that good for us as people? Building trust is the foundation of collaboration. Can you be 100% remote and have that? I'm thinking about blending the best of both. Companies will probably emerge post-COVID with a reduced office footprint, but when we are in the office it will be more oriented toward working together. From the security side of things, we have to figure out what to do with this in/out of office working style. We can't just throw money at it."

The Blumira dashboard for monitoring security issues.

Does Ann Arbor Have Enough Security Talent?

Blumira's plan is to create a longterm blended workforce, which allows them to draw on widespread talent for key roles. We asked Simpson if security startups in Ann Arbor really have enough talent to draw from, as the security startup boom has happened more quickly than the general expansion of local talent, however excellent that pool is. "A lot of early internet technology came out of the University of Michigan," Simpson explains, "so there has always been a quiet group of people working in Ann Arbor all along. Dug Song at Duo wanted to make Ann Arbor a place known for this, so it became intentional. In the early days at Duo, the first sales team at Duo had no background in security. Now at Blumira, Duo people are immediately effective. Duo attracted people to the Midwest, and we sponsored people into the industry. That's the cost of being inclusive. Now there is an ecosystem in Ann Arbor."

Does that mean it's already too late for tech talent wanting to get into security locally who don't have a background? In a few key roles, possibly, but the number of new security startups addressing different market niches is blossoming and with it the opportunities for security jobs in Ann Arbor and Detroit. It would be a good time to get into the security field, if you're interested. Just like AR/VR companies locally, security companies are having to create their own ecosystems to reach critical mass. Blumira doesn't have hiring info ready to go yet except for half a dozen open positions at the moment, but keep an eye on the company over the next few months for new security job opportunities as the startup expands. We hope you find something that fits your skill set.