For CIOs, CISOs, and the people who hire for them
Hire a cybersecurity director who builds the operation, not the slide about it
A director role is where security either becomes real or stays a document. The CISO sets direction; the director makes the detection fire, the response run, the engineers ship, and the metrics mean something. I've done that job at the level where you still know how the tools work and can tell when the team's dashboard is lying, and I've done it long enough to know which problems are technical and which are about people who haven't been given authority.
What the role gets from me
Twenty-odd years of hands-on incident response and security operations, and thirty of leading security work. I've built teams, built operations, and inherited ones that needed rebuilding without the business noticing a gap. I can hire, because I know what competence looks like when it's not written on a certificate. I can run a budget without surprises. And I can brief upward in a way that gets the CISO what they need from the board, because I've been on both sides of that conversation.
Concretely, I'd expect to own some combination of: security operations and detection engineering; incident response and the readiness around it; security engineering and architecture; vendor and tooling decisions; and the programme work that turns a strategy into things that happen on a Tuesday.
How I run a team
Clear ownership of each capability, with the person who owns it able to explain it to me and to an auditor. Measures that would embarrass us if they were bad, not measures chosen because they're green. A rule that nobody gets blamed for raising a problem and everybody gets asked why they sat on one. And rehearsal: the team practises the things that matter before they're real, including the uncomfortable parts where the business disagrees with containment.
The honest fit
This works where the CISO wants a director who'll tell them what's actually happening, and where the organisation is ready to give a director real authority over the operation. It doesn't work where the director is expected to be a senior analyst with a better title, or where decisions above a certain size go to a committee that meets monthly. If your incident process needs a meeting to isolate a server, I'll want to fix that in the first quarter, and I'd rather you knew that now.
Where this comes from
I've served as the subject-matter expert for blue-chip companies, startups, NGOs, and governments at every level, and I've run the response when it was live. Most of the detail stays under NDA. What I can say here, I do; the rest we talk about in confidence.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Know Whether Your SOC Is Actually Effective?
- Research How Do You Set a Sustainable Workload for a Security Team?
- Research How Do You Know a Security Control Still Works After a Change?
- Short Who's in charge of an incident when IT and security disagree?
- Short The CISO just resigned. What do we do in the next 30 days?
Related work.
Other ways I'm engaged on the same problems.
- A director of security operations who measures containment, not alert countsLeadership of detection and response: the SOC, the engineers, the playbooks, and measures that would embarrass us if they were bad.
- A programme director who turns the strategy into things that happenOwnership of the security programme end to end: plan, money, people, dependencies, and honest reporting on what's actually done.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CISOs who need a director who can run the operation without being managed hour to hour.
- CIOs in organisations without a CISO who need senior security leadership that understands the business.
- Recruiters with a director, head-of, or principal mandate that calls for operational depth.