How have the roles of CIO/CTO/CISO evolved in regards to security?
Sort by:
I would never join a Series A/Series B company as a CISO. They're the top 10 getting fired if there's an issue, there's no upside. That’s why zero series A funded companies have a CISO. We have to make security not be a punishable offense. And security should never be viewed as a luxury.
Security cannot be a punishable offense. I don't have a CISO in my business model for first hires at least referenceable by somebody external but eventually it does become one of my top 10 hire requirements.
The CTO used to have a very specific role: to drive technology strategy for the company. It could be a technology company or not; the CTO helped them to either adopt technology or grow their existing technology. Now most CTOs are more like evangelists or part-time engineers. They're not true CTOs anymore. For example, the problem with security in a smaller firm is that you need a security architect who can make sure that you think of security from the bones out as you build your platform. But you also need security to look at the human aspect of running the business as well, and in most cases, those two roles are not the same.
The roles of a CTO and CIO have evolved. Both need to understand the role of security in their evangelistic position. If you don't have security top of mind, you're not going to be a great evangelist.
The CTO has evolved to be the one running business operations and the CIO is focusing on the business strategy. Therein lies the gap because the CISO doesn't necessarily have the same seat at the table as the CIO or the CTO. If you only have 10 positions to hire, a security architect might be in your top 2 or 3, but realistically it may not be your highest priority. When I was in a life sciences company, security was part of our project management office. Every project had to have security sign off on it. You couldn't say, "Oh crap, I didn't look at security," a week before going live. That wasn't acceptable in life sciences then. A small company doesn't necessarily have the luxury of a big company in that regard.