Root To CISO or not?

A panel of two multi-time CISOs and a recruiter takes audience questions about how security leaders reach their roles. The discussion opens with each panelist's background, from technical operations work to an unconventional first security job, and the moderator frames the session around practical career decisions.

Much of the middle focuses on leading with limited budgets and staying technical. Panelists suggested building trust with engineering teams, partnering with early-stage startups, and keeping staff connected to the mission. They agreed the role shifts toward finance, business strategy and communicating risk, though many leaders keep hands-on skills. Certifications drew skepticism compared with demonstrated ability, and metrics such as risk reduction, return on investment and measured employee competence were proposed for reporting upward. Vendor questionnaires were criticized as weak evidence of real controls.

The closing advice centers on hiring well, defending the team, choosing a manager who advances your career and telling your own story clearly. Internal promotion was described as the most reliable route to a CISO job, since outside applicants face a crowded market.