The work diary of Parisa Tabriz, Google’s ‘security princess’

Parisa Tabriz used to be a hacker. Now she is a princess.

Tabriz, 36, is a director of engineering at Google, where she oversees its Chrome web browser and a team of security investigators called Project Zero. Several years ago, when Google required her to get business cards, she picked the title “security princess” because it seemed less boring than “information security engineer,” her actual title at the time.

As Tabriz climbed the ranks, the designation stuck — and reminded men in the cybersecurity field that women belonged there, too. “I want them to know that princesses can do engineering and STEM,” Tabriz said.

Chrome is the world’s most widely used web browser — the window through which more than 1 billion people view the internet every day. Some days, Tabriz’s work at Google’s headquarters in Mountain View, California, entails studying furniture design (rounded chairs and felt baskets, she said, helped inspire the curve of Chrome’s tabs); at other times, she studies wonky research papers. One recent challenge: trying to figure out how to keep search queries and other data private, even if multiple users are sharing a single phone for internet access, as is often the case in developing countries.

Often, Tabriz has to figure out how to convey complex concepts like encryption through pictograms so that users around the world can understand them. When a user visited a website over an encrypted connection, Chrome used to show a green lock icon to indicate “secure,” while a red lock indicated the connection might not be private. But some users mistook the locks for tiny purses.

On Twitter, Tabriz describes herself as Project Zero’s “den mom.” The group hunts down unknown vulnerabilities in products made by Google and its competitors and then publicly discloses its discoveries. The group’s work has unearthed widespread vulnerabilities like Meltdown and Spectre; most recently, on Aug. 29, it discovered several security flaws in Apple’s mobile operating system.

We corresponded for a week in mid-June.

Monday

6am My superpower might be that I just wake up at 6am without an alarm. My cats, Darwin and Grace, hear me and immediately start meowing from inside their room for breakfast and freedom. My husband is a light sleeper, so we keep them separated from our bedroom by two locked doors. They’re named after Charles Darwin and the pioneering computer scientist Grace Hopper.

I just built them a new house. We’re planning to build ourselves a container house, which uses prefabricated materials for a quicker and more environmentally friendly construction, but it’s a long process. In some ways I am buying and building cat houses as a way to make me feel like I’m making progress.

7:30am Every work day starts with coffee and a sparkling water. After some inbox pruning, I hold virtual office hours. My team is made up of 375 people spread across 12 Google offices around the world, and anyone can sign up for time to talk face to face. Today, I talk to an engineer in Mountain View, another in Munich and a product manager in Seattle.

11am I go on a walking one-on-one with Ben, who leads the Project Zero team. I try to do walking meetings to take advantage of mild Bay Area weather and get some movement into what can otherwise be a day of a lot of indoor sitting. We talk about his upcoming talk for the security conference Black Hat, which will cover five years of work making zero-day attacks harder and advancing the public understanding of software exploitation.

4pm I meet Jenna, a software engineering intern who joined for the summer and will be working on a feature for Chrome on Android. Twelve years ago, I interned at Google. I keep getting older, but the interns stay the same age.

7pm I get home and compare notes with my husband about our days over leftovers from the weekend. He’s a deputy sheriff and deals with security problems and users in the real world. I finish off the day with Netflix on the couch with cats. I’m an introvert and need the time away from people to recharge.

Tuesday

5:45am Wake up, do morning routine and put on a typical work uniform: black shirt, jeans and sandals. I spend some time with a lint roller before heading out; otherwise, I’d be covered in fur.

7:20am Google Calendar seems to be down. Yikes! I’m left feeling a bit helpless. A lot of my work day is driven by my calendar, despite continuous effort to remove or reduce the number of meetings I’m invited to. As much as possible, I try to solve problems over email or by delegation — pushing decision-making power down to engineers in my team who are closer to the problems and implications. Luckily, my calendar is still cached on my phone, so I can see that I’m scheduled to chat with Alex, Chrome’s lead designer, at 7:30am

7:30am Alex and I talk about a new feature our team is mulling. People complain to us all the time about how many tabs they keep open, and Alex wants to try some new ways to group and display them. We discuss whether we should build a rough prototype to show people in a focus group setting or actually build something more polished to experiment with all Chrome users.

He also asks for some advice about handling interpersonal conflict in our team, and we talk through some things to try. As they say, engineering is easy — it’s the people problems that are hard.

11am Four-hour brainstorming and discussion session about Chrome’s road map for the next year.

3pm I get a direct message on Twitter from @SwiftOnSecurity, a pseudonymous computer security expert and influencer who pretends to be Taylor Swift, with feedback about a new Chrome extension we launched earlier in the day that helps users report suspicious sites. I get a lot of suggestions about security for Chrome, and they come from everywhere: Twitter, work and personal email, Snap, Chrome bug reports, calls from family and friends. I sometimes even get physical mail! I also get a lot of hate mail, rants, job requests and solicitations for ... weird things. I try to respond to as many of the respectful inquiries as I can, but I end up having to ignore a lot.

6pm I drive to dinner, listening to a mix of NPR and Top 40 for when the news gets too depressing. I’m really digging anything by Billie Eilish right now. Dinner is with Chrome leaders from around the world, who are in town right now for a big planning session. As a geeky icebreaker, we go around the table and share our favorite guilty-pleasure website. I’ve been spending lots of time on houzz.com, swiping through modern architecture and interior design inspiration for my container house project.

Wednesday

7:30am Grab my iPhone and Windows laptop for the day. Neither is my primary device, but I like to use them on Wednesdays. Thursdays, I try to mostly use my Mac, and the rest of the week I’m on my Chromebook or my Pixel Android phone. I’m responsible for Chrome across every operating system, so I try to use all the different Chromes each week to catch the subtle and important differences, and give feedback or file bugs if something isn’t working right.

Noon. I see they’re serving Persian food for lunch, and I’m almost tempted to try it but stick to the salad bar. Persian food at work is always a disappointment compared with my mom’s cooking. She’s Polish-American, but she learned how to cook traditional Persian food from my grandma, who would visit from Iran. They didn’t share a common language outside of cooking, but after years of kitchen time, my mom makes an amazing ghormeh sabzi and kuku sabzi.

4:30pm I block off private work time for myself so no one can schedule meetings with me, then work through two design docs, skim a project pitch deck and then walk around campus, snacking and thinking. I need to make a decision on a tricky escalation that will slightly increase security, but at the cost of a phone’s battery life.

Chrome runs on everything from a high-end desktop computer to low-end mobile phones, so a big part of my job is absorbing lots of technical details and input; thinking through subtle trade-offs in performance, security and usability; considering hundreds of people and billions of users that will be impacted by any decision; and then making and delivering a decision. Often under time pressure.

8pm Cereal for dinner. My current favorite is Kashi’s Peanut Butter Crunch cereal. I’m not embarrassed to admit that many weekend and evening meals are cereal. I get plenty of vegetables and food diversity from Google lunches or snacks, and I don’t enjoy cooking.

Thursday

6:30am On the recommendation of a co-worker, I try a new colour-depositing shampoo to brighten my pink highlights. My hair isn’t naturally pink, unfortunately, so it takes some ongoing work and shower cleanup; most of my towels have some pattern of tie-dye pink.

10am Meeting with an executive to talk about new security features for Chromebooks, Google’s brand of laptops. We’re considering a feature that would make changes to secure boot, which helps lock hackers out of the operating system.

4:10pm Weekly meeting with Brea, my admin, to check in on all-the-things and prepare for next week. Brea is constantly on top of my schedule, defragging my calendar to make space for me to do uninterrupted thinking, booking travel and meetings, reminding me to get things done, or helping answer questions on my behalf. She helps keep me sane and efficient at work, and since she part-times as a yoga teacher, she also gives me free stretching and wellness tips.

5pm Read some updated user research from a study done in India. Based on some research published last year, many women in South Asia are expected to share their phones with kids or male family members, which results in a range of privacy concerns and strategies. I don’t share my personal phone with anyone, so these user needs and behaviors were really surprising to me.

6pm Lots more email triage. I’m going to work late since I’m taking Friday off to spend time with three girlfriends I’ve known for over a decade. We actually get email reminders about taking vacation time at Google, and I’ve been getting them regularly since I’ve been accruing lots of time off.

Friday

7:30am Go to Planet Granite, a local rock climbing gym. I’m trying to get back into climbing shape after taking a lot of time off to recover from a shoulder injury. After 90 minutes of bouldering with my husband, my forearms are pumped, I’m covered in chalk, and the skin on my finger pads is sore and swollen, so we head home.

9am Email triage. Technically, I’m off for the day, but during downtime like this, I’ll check my inbox to see if I can handle anything. I’m a terrible role model when it comes to fully disconnecting.

© 2019 New York Times News Service