For organisations hiring senior security leadership without a geography constraint
A senior security leader who works remotely, and has for years
Security leadership has been a remote job for longer than most jobs have. Incidents don't happen in the office, operations centres run around the clock across time zones, and the people you need on a bridge at 3 a.m. are wherever they are. I've led security work for organisations I was rarely in the same building as, and I've learned what has to be true for that to work and what has to happen in person regardless.
What works remotely, and what I come to you for
Nearly all of the role works remotely: the operation, the incident bridge, the vendor and tooling decisions, the hiring, the metrics, the one-to-ones, the written briefings. The parts that don't are the ones where trust is built or tested: the first weeks with a new team, the board meeting after a serious incident, the walk through a plant or a data centre, the hard conversation with an executive who's resisting containment. I plan for those and I travel for them. The agreement up front says how often and when.
How I lead a distributed security function
Written decisions, so nobody has to remember what was said on a call. A cadence the team can rely on, with a standing time when I'm available for anything. Decision rights that are explicit, so the person who sees a problem at midnight knows what they're allowed to do without waking me, and knows I'd rather be woken than find out later. Rehearsals run remotely, because the real incident will be. And an operation instrumented so that I can see what's happening without walking the floor, which is good discipline whether or not the leader is remote.
The honest limits
Remote leadership fails in organisations that equate presence with commitment, or where the culture settles decisions in corridors. It also fails if the leader treats remote as an excuse for absence. I'd want to understand how your executive team actually makes decisions before either of us commits.
Where this comes from
Thirty years of leading security, about twenty of them hands-on in response and operations, for organisations from startups to governments, much of it across distance and time zones. Most of the detail is under NDA. What I can say here, I do; the rest we talk about in confidence.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
Related work.
Other ways I'm engaged on the same problems.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- A fractional CISO who sets the rules and takes the hard callsSenior security leadership on a part-time basis: direction, the hard decisions, the board, and the questionnaires, with a capable person of yours running the day to day.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- Organisations hiring a CISO or security director whose best candidate isn't in commuting distance.
- Distributed companies whose security function is already remote and needs a leader who knows how to run one.
- Boards and search firms weighing remote leadership for a senior security role.