For organisations whose security leader has left, or is about to
An interim CISO who holds the line while you hire well
When a CISO leaves, the organisation has about a week before the gap starts costing something: a decision nobody makes, a questionnaire nobody signs, a board meeting with an empty chair, an incident with no one in charge. An interim leader exists to close that gap on day one and keep it closed long enough for you to hire properly. A bad CISO appointment made in panic costs two years. A well-run gap costs a quarter. I've written down what to do in the first 30 days without a CISO; an interim engagement with me is that list, done.
What I take on
Full accountability for security risk for an agreed period, usually three to six months, with authority to match. From the first week: the departing leader's knowledge captured before it walks out, every credential and vendor relationship they held secured and rotated, the regulatory designations that named them replaced, open incidents and risk acceptances reviewed, and the team told what's happening by someone who's actually in charge. Then the ordinary work of the role: decisions, the board, the auditors, the customers, and whatever the quarter throws at you.
What you get at the end
A stable function, a written picture of the programme as it actually is, a short list of what the next leader should fix first, and a job description for the permanent role that reflects what the organisation needs for the next three years rather than what the last person happened to do. I'm happy to help with the search and the handover, and I'm not a candidate for the permanent job unless we both decide that early and openly.
Why interim rather than acting
Making the CIO or a senior manager "acting CISO" is the common move, and it usually means the role gets whatever time is left over from their real job. An interim leader has no other job. That's the difference between the function being covered and the function being held.
Where this comes from
Thirty years of leading security and roughly twenty hands-on in incident response and operations, serving as the subject-matter expert for organisations from startups to national governments. I've stepped into live situations more than once. Most of the detail stays under NDA; what I can say here, I do.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
Related work.
Other ways I'm engaged on the same problems.
- A fractional CISO who sets the rules and takes the hard callsSenior security leadership on a part-time basis: direction, the hard decisions, the board, and the questionnaires, with a capable person of yours running the day to day.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CEOs, COOs, and general counsel who've just lost their security leader and need the function held properly.
- Boards and audit committees that want assurance the gap is covered by someone accountable.
- Private equity and portfolio operators with a company between security leaders.