For executive search consultants with a security leadership mandate
For recruiters and search firms: what I'm a fit for, and what I'm not
Recruiters are busy and so am I, so here's the page I'd want if I were on your side of the call. The roles I'd seriously consider, the organisations where I'd do well, the situations where I wouldn't, and what to send me so I can give you a real answer in a day rather than a polite one in a week.
Roles I'd consider
Chief information security officer. Director or head of security, security operations, or security engineering. Programme or transformation leadership for a security function that has to change. Interim and fractional versions of any of those. Senior advisory roles for boards, investors, or executives. And roles in government or with organisations serving government, where I've spent a good part of my career.
Where I do well
Organisations where security is close to the licence to operate or the product: regulated sectors, critical infrastructure, public institutions, anything with serious data or serious adversaries. Leadership teams that want the uncomfortable truth and will act on it. Roles with real authority: a path to the board, the right to stop work, a budget that can't be quietly reallocated. Teams that need to be built or rebuilt. Incidents that aren't over.
Where I'd be the wrong candidate
A security function that exists to produce compliance artefacts and nothing else. A role reporting through someone measured on delivery with no route to the board. An organisation that wants its security leader to confirm that everything's fine. A culture where decisions get made in corridors and rehearsals are seen as theatre. If the mandate reads like any of those, save us both the call; if it reads like it might but the client wants to change, tell me that and I'll listen.
What I bring, briefly
Thirty years leading security; about twenty hands-on in incident response and operations; a PhD in computer engineering centred on cybersecurity, AI, and the criminal use of technology; a law school education; and a long run as the subject-matter expert for blue-chip companies, startups, high-net-worth individuals, NGOs, and US and allied governments from the municipal level to the national. Author of Boxing Einstein. Much of the work is under NDA, and I don't publish employment chronology, locations, or clearance detail; we'll cover what's needed privately.
What to send me
The role, the reporting line, the authority that comes with it, the size of the team and budget, the reason the role is open, and the three things the first year has to deliver. With that I can tell you quickly whether it's worth your client's time. Without it, I'll ask for it.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
Related work.
Other ways I'm engaged on the same problems.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An interim CISO who holds the line while you hire wellFull accountability for security for a defined period, so the search can take the time a good hire needs.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- Retained search consultants with a CISO, director, or head-of mandate.
- In-house talent partners at organisations hiring senior security leadership.
- Boards and CEOs who'd rather skip the intermediary and talk directly.