How a Weatherman-Turned-Cyber-Pro Spots Threats Before They Hit
It was a quiet evening at KFYR-TV in Bismarck. Countless monitors hummed around the newsroom, fresh coffee trickled into a decanter, and station staff moved to and fro in preparation for the next broadcast. It was a relatively slow news day. Everything seemed as usual.
Josh Kadrmas had just raised his mug toward his lips when a blip on the radar made him freeze. A solid wall of red and purple suddenly began stretching across the screen, growing larger and more ominous by the second. An unexpected storm was bearing down on a region where countless people had no idea what was coming.
Kadrmas set his coffee down with a thud, rolled his chair closer to the monitors, and strained forward toward the screen to make sure what he was seeing was real. He checked the radar again, then cross-referenced the latest observations, wind speeds, and projections, making sure every piece of the puzzle lined up before sounding the alarm.
This wasn’t just another severe thunderstorm. It was a system unlike anything Kadrmas had experienced in a long time, with winds of 80 to 100 miles per hour barreling toward his beloved community—the kinds of winds capable of knocking down trees and power lines, damaging buildings, and turning ordinary objects into dangerous projectiles.
It was the perfect storm, and it was going to be a doozy.
There was no time to waste. The meteorologist sprang into action, gathering the latest readings and bolting to the nearby studio as the clock ticked closer to the evening newscast.
He pored over the information, looking for every detail that could help him accurately explain what was about to unfold across the greater Bismarck-Mandan area. After all, when you’re responsible for telling people something dangerous is coming, getting the message right is just as important as getting it out quickly.
Kadrmas snagged his suit jacket, clipped on a microphone, and planted his feet in front of the green screen, ready to deliver the warning people across the region urgently needed to hear. With the latest projections off to the side and the radar continuing to tell the story behind him, the red light blinked on, and he was live on the air.
Across Bismarck-Mandan and the surrounding communities, thousands of people tuned in as Kadrmas’s arms glided over the forecast screen and listened as he warned them to take shelter. Outside, the skies began to darken, and the wind seized the prairie, rolling hills, and cityscape. People pulled away from their televisions and made their way into basements and storm shelters, gathering children, pets, and supplies as the storm began to intensify.
All the while, Kadrmas continued tracking the system as it progressed, returning to the air with additional updates as conditions changed, and later taking to social media to keep people informed wherever they happened to be getting their news.
In moments like that, forecasting is about far more than predicting the weather. It’s about giving people the information they need to make decisions that can protect their families, their homes, and themselves. By recognizing what was developing and getting the warning out before the worst of the storm arrived, Kadrmas helped people across the region prepare for what was coming.
And as fate would have it, that same skill would follow him into a very different kind of forecasting.
Today, Kadrmas—a Jack of many trades—serves as Senior Manager of Governance, Risk, and Compliance at NDIT, where the storms he’s watching don’t show up on a weather radar. Instead, they appear in cybersecurity alerts, vulnerabilities, risk assessments, and other signals that can indicate trouble is brewing. His job is to help identify those threats early on, understand what they could mean, and put measures in place to mitigate them before they have a chance to cause damage.
The radar is different. The stakes are different. But in many ways, Kadrmas is still doing what he’s done for many years at KFYR, where he still serves as a part-time meteorologist to this day: watching for the storm before it hits, recognizing the signs others might miss, and making sure people are ready when it arrives. In a nutshell, he tracks threats so others know they’re coming well ahead of time.
He’s a storm chaser through and through.
For Josh Kadrmas, chasing storms has always been about more than the thrill. It’s about watching the horizon, understanding the threat, and helping keep people safe.
Forecasting the Cyber Storm
The storm analogy is a fitting one. Kadrmas uses it regularly, whether he’s speaking about cybersecurity at CyberCon, GovRAMP, or for Cybersecurity Awareness Month. His message is always simple: Prepare before it hits.
It’s also a fitting description of his day job. Governance, risk, and compliance (GRC) is the proactive side of cybersecurity, the forecasting. Kadrmas and his team look for trouble before an agency signs a contract with a vendor or goes live with a new system, while there’s still time to do something about it.
It’s an instinct that started when Kadrmas was about 4 years old—in his parents’ basement.
Growing up in Dickinson, he idolized North Dakota meteorologists like Jerry Bartz and Kevin Lawrence. So much so that he built his own miniature studio in the basement, complete with two box TVs, a giant camcorder, and a map of the U.S.
Without a doubt, this kid was going places.
From early on in his career, Kadrmas had a knack for seeing what was coming—and a desire to help people prepare for it.
Varying Conditions
Kadrmas’s education journey was a winding one, but it’s part of what has made him so good at his job.
He began with a year at the University of North Dakota studying meteorology, then returned home to earn a business administration degree from Dickinson State University. Not one to leave things unfinished, he eventually returned to UND, graduating in 2006 with a degree in atmospheric sciences.
Kadrmas’s seven years of college have become a running Tommy Boy quip among coworkers, who joke that he “should be a doctor by now.”
During his second stint at UND, Kadrmas took a part-time help desk job at SEI, an IT services and consulting company that supports McDonald’s point-of-sale systems, menu boards, and back-end computers nationwide. It was there that he was introduced to cybersecurity and the world of IT.
Unexpectedly, he found a sincere love for it.
At the same time, Kadrmas was realizing that broadcast meteorology would be a tougher career path than he had anticipated. After graduation, he took a leap of faith and decided to stay the course in IT, moving through help desk and desktop support roles at UND before eventually landing his first full-time role in state government at North Dakota Health and Human Services (NDHHS) in Bismarck.
Kadrmas never left weather entirely, though. He worked part time as a camera operator at KFYR-TV, which eventually led to his part-time meteorologist gig.
He had no idea the skills he was building in both worlds would eventually converge.
The skies have always captured Kadrmas’s attention, from chasing storms to watching the northern lights over his home state. For him, when it comes to protecting North Dakotans from cyber threats, the sky’s the limit.
From Radar to Risk
When Kadrmas looks back at his career trajectory, it’s as if he was meant to defend North Dakota from cyber threats.
In 2015, he became the Information Security Analyst at NDHHS. Then, after the agency entered the state’s IT unification process in 2019, he began assisting other agencies, too, eventually becoming Cyber Risk Team Lead.
There was just one problem: North Dakota didn’t have a risk program.
“My team and I were kind of the first ones to manage it,” Kadrmas says with a chuckle. He and his four Risk Analysts built the program from the ground up, beginning with vendor evaluations as the state moved toward cloud-based solutions, a crucial and rapidly growing area.
That work led Kadrmas to GovRAMP, a public-sector program that helps establish security standards for cloud providers. North Dakota became the 11th state to join, and Kadrmas now serves on its National Approvals Committee. Since 2022, his team has assessed more than 500 vendors.
The threats have continued to evolve, too, particularly around artificial intelligence, which has given threat actors new ways to automate attacks, create more convincing scams, and adapt their tactics faster than ever. As the technology has advanced, Kadrmas and his team have had to stay ahead of the curve.
They’ve pursued training. They’ve attended conferences. They’ve even begun sharing information with other states through the Joint Cyber Security Operations Center, staying up to date on the latest threats and best practices across state lines. Kadrmas also helped shape NDIT’s AI guidance, eventually presenting to the North Dakota Legislature’s Artificial Intelligence and Data Center Committee.
The work has required the same mindset that has guided Kadrmas throughout his career: Pay attention, stay curious, and be ready for what’s coming next. In cybersecurity, just as in weather, that preparation can make all the difference.
Kadrmas knows that protecting people starts with preparation, and that often means taking the message to the airwaves, especially for Cybersecurity Awareness Month, and especially at a place that feels like home: KFYR-TV.
On Cloud Nine
Ask Kadrmas what he loves about his work at NDIT, and he’ll point to the constant change.
“There really isn’t a typical day,” he says. “I love that.”
He also appreciates NDIT’s culture, particularly the way it supports work-life balance. Outside the office, Kadrmas enjoys spending time with his family. He and his wife stay busy traveling for their daughters’ soccer schedules.
That balance matters. The flexibility of his work allows Kadrmas to be present for his family while still giving him the opportunity to pursue work he genuinely enjoys. It’s part of what makes NDIT feel like more than just a place to clock in.
Kadrmas also knows the culture is working when teams across the agency ask the right security questions on their own instead of simply waiting for someone else to raise the alarm. People are steadily gaining a cyber sense, and it’s largely thanks to his team.
Behind every great storm chaser is a support team who’s there when it matters most. For Kadrmas, that’s his wife and two daughters.
A Bright Forecast Ahead
After years of chasing storms, Kadrmas is still watching the radar. It just looks a little different.
Because sometimes the storm isn’t dark clouds and howling winds. It’s a cybersecurity alert, a vulnerable system, or a threat taking shape.
Regardless of what’s on the horizon, it’s good to know that North Dakota has a storm chaser standing watch.