I’m a seasoned cybersecurity professional with a career dedicated entirely to cybersecurity consulting—spanning both large and small firms, and covering a wide range of cybersecurity domains across public and private sectors.

I’m now actively exploring internal senior-level cybersecurity roles such as Director of Cybersecurity or Deputy CISO. While I aspire to grow into a CISO role eventually, I believe I still have more to learn before taking on the full weight of that responsibility.

This is the first time in my career that I find myself between roles, and I’m seeking guidance from those who have made the transition from consulting to internal leadership positions. Any advice on how to approach this search, position myself effectively, or identify the right opportunities would be greatly appreciated.

Thank you in advance to the CISOs and cybersecurity leaders willing to share insights.

We know what a perfect security person should do, and oftentimes we’re not that person.

—

CISO Series’ “Confessions” are purposefully sensitive questions posted to reddit for all cybersecurity professionals. Given this platform’s usual anonymity we hope redditors will feel more comfortable divulging embarrassing and errant behavior. We want to know your stories.

Efforts like patching servers, fixing software bugs, and implementing policies for remediating vulnerabilities identified are often resource-intensive. Considering standardized scores such as CVSS is not really an optimum way of prioritizing the vulnerabilities. Seconize Contextual Risk Enumeration System (SCORES) is a free risk scoring tool for vulnerabilities. You can create contextualized risk scores for vulnerabilities based on your organization and Asset context using proven decision science techniques. Check out SCORES at SCORES: Seconize Contextual Risk Enumeration System (riskscore.info)

CISOs can elevate their careers by joining the board, but most CISOs don't know how to get from point A to point B. These insights talk about transitioning from totally technical to well-versed in comprehensive corporate risk management. https://www.cybertalk.org/2023/07/27/top-strategies-how-cisos-can-become-board-ready/

One of your listeners mentioned an old comment of mine made it into you "Defense in Depth" podcast episode, "Why Is There a Cybersecurity Skills Gap?"

Great discussion observed!

Hi all,

I’m a cyber security engineer at a big firm, and I’m trying to find a solution to a problem I’m dealing with around vendor security questionnaires.

Would love your input on a few quick questions:

• When do questionnaires escalate from email to Zoom/Teams meetings?

• How much time are you or your team spending on vendor follow-ups?

• What’s the most frustrating part of the process for you?

• Which tools do you recommend to help with this?

Even short replies would help a lot - thanks so much!

With business continuity, CISOs must navigate a complex mix of security, business priorities and operational resilience — often without clear ownership of the process. How should they go about this?

This article had some thoughts... https://www.csoonline.com/article/3855823/how-cisos-can-balance-business-continuity-with-other-responsibilities.html

We have 15 chapters across the US, and is invite-only for CISO's, CIO's and AI/Cyber SME's. More details at https://www.cyberbreakfastclub.com/join-today Our next DC chapter is 19 June (745-9am EST via zoom)

On the 19th, Dave Crawford from CGI Federal is giving a discussion on today's cyber threats and best practices re. CIS 18 (Critical Security Controls) (https://www.linkedin.com/in/crawforddavide)

Please RSVP with us with a simple DM back and the zoom link/invite will be sent to you by me and/or Michael Walsh.

As you prepare for summer fun, come have some coffee and spirited cyber discussion via zoom on the 19th.

https://www.cybertalk.org/2022/06/23/the-overlooked-keys-to-success-within-the-mature-ciso-role/

Are you doing board presentations? Do you have an idea of what's useful and what's just for the technical folks?

"Successfully engaging with the board may not make or break a CISO’s career, but it’s becoming an increasingly important skill — particularly as risk-conscious boards seek strategic security insights."

It could be a signal that you’re missing something. Maybe the question should be how long is too long to go without an incident?

----

CISO Series’ “Confessions” are purposefully sensitive questions for cybersecurity professionals. Given this platform’s usual anonymity we hope redditors will feel more comfortable divulging embarrassing and errant behavior. We want to know your stories.