In this interview segment, the speakers discuss how modern cybersecurity leadership must expand beyond pure technical expertise to make security a shared responsibility across all business functions and a strategic partner that adds competitive advantage. They highlight chronic resource constraints, requiring leaders to influence budgets and collaborate with HR, finance, engineering, and IT. The conversation stresses the need for strong communication skills to translate security value into business terms. It also examines the common career trajectory of technical experts promoted to managerial roles, noting the difficulty of letting go of hands‑on work, the importance of delegating, and allowing team members to learn from mistakes. The speakers argue that while the industry produces strong technicians, many leaders still cling to technical tasks, which hampers their ability to lead effectively in the 21st‑century business‑focused security landscape.
Chapters
where security becomes everybody's business. Security awareness is not just for the cybersecurity team, but it's for people in HR or people in finance, people across the entire organization. And also kind of turn the security function in such a way that it enables business. It becomes a partner to all of the other functions across the entire organization. I think we need to do that more and more and more because I'm sure that has been your experiences too. Except for the Navy, everywhere else I have been, Resources are always a problem. There is a constraint. We don't have, you know, enough money for you to do whatever you need. So you need to do a lot more with less, right? And that's where I think your leadership skills are really going to come in and your ability to influence other people from other departments where you may need to borrow a budget from HR or from engineering or IT in order to do things in security that's going to benefit the entire organization. You need to be a better communicator, right? So people need to, understand what you mean and how your security program is going to help them, right? What's in it for me type of thing. So you need to show how security adds a competitive advantage to all of the other business functions and working together to accomplish the end goal and the mission of your organization. So I think in the 21st century, security leaders have to be much, much more than just a technical expert. They definitely need to be more business-minded.
So, you know, you had mentioned those three things: technology, leadership, and then business knowledge. If we look over the past 15 or 20 years, right, people coming up through the leadership in security, cybersecurity, and whatnot.
Yeah.
What area do you think has been kind of the strongest suit of those leaders and what areas are kind of the worst? For the leaders we currently have in place?
Yeah, I think in the industry, it's been technical. We have a lot of very, very strong technicians. And sometimes some of the CISOs I've had, they still want to be hands-on for some reason. I don't understand that. They shouldn't have time to do it. But I think even me, when I became a manager, it was very, very difficult for me, right? Because usually when you are selected for management, it's because you are good at what you do. You're an outstanding individual contributor. So you're doing it so well. Now the business thinks, okay, we need to promote you so you can help other people do it. But then you're like, these other people don't do it as well as I do. And they're going to mess up and they're going to need time to learn. Let me just do it. So that is one thing I really, really had to learn as a leader, to really delegate and let go. But even if they make mistakes, that is okay. They need to learn through their mistakes and they need to learn how to do it to the quality versus the standard of the
