For organisations with a security strategy and not enough of it delivered
A programme director who turns the strategy into things that happen
Most security strategies fail in the middle: not in the thinking and not in the tools, but in the eighteen months where the plan has to survive contact with IT change control, a finance team that wants numbers, vendors that slip, and a business that keeps asking for exceptions. A programme director's job is to own that middle. I've done it with the technical depth to tell a real milestone from a reported one, and the organisational patience to get things through.
What I'd own
The plan, with priorities small enough to finish. The budget, with spend mapped to the risks it's meant to reduce rather than to the invoices that arrived. The dependencies on IT, engineering, procurement, and legal, which is where most security programmes actually stall. The vendors, held to what they sold. The measures, chosen so that "done" means the control works, not that the project closed. And the reporting upward: what's delivered, what's slipped, what's been accepted as risk because it won't be funded, and who signed for that. I've written about why a programme is an operation, not a document, and that's how I'd run yours.
How I work with the CISO and the business
The CISO sets direction and owns the risk conversation with the board. I make the direction real and bring the CISO the evidence. With the business, I trade: I'll move a deadline for a real operational reason, in writing, with the risk re-dated, and I won't move it for a preference. That rule, applied consistently, is most of programme management.
The honest fit
This role works where leadership wants delivery and is willing to hear what's blocking it. It doesn't work where the programme is a holding pattern for decisions nobody wants to make, or where "programme director" means "project coordinator with no authority." I'd want to see the plan, the budget, and the last three status reports before we talk seriously; they'll tell me whether the role is real.
Where this comes from
Thirty years of leading security and building programmes and operations in organisations from startups to national governments, including the ones where the plan had been written three times and delivered none. Most of that is under NDA. What I can say here, I do.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Set a Sustainable Workload for a Security Team?
- Research Your Cybersecurity Gap Assessment Is Finished. Now What?
- Research Should You Buy a New Security Tool or Improve the Controls You Have?
- Short Is our cybersecurity budget enough? How to tell without a benchmark
- Short Who can accept a cyber risk on behalf of the company?
Related work.
Other ways I'm engaged on the same problems.
- Transformation leadership for a security function that has to change, not just growLeading the rebuild: the operating model, the team, the tooling estate, and the governance, in an order that keeps the lights on while it changes.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CISOs who need someone to own delivery so they can own the risk conversation.
- CIOs and COOs whose security programme has a strategy and a budget but keeps slipping.
- Transformation leads who need security delivered inside a larger change programme.