Cyber Work: How to become a Chief Information Security Officer

Introduction 

In this episode of Infosec’s cybersecurity podcast series Cyber Work, host Chris Sienko talks with Joshua Knight, cybersecurity business leader at Dimension Data, about how to become a Chief Information Security Officer (CISO). Joshua has more than thirty years of experience in the technology space, including National Security Agency (NSA) and enterprise experience. Prepare for a rocket ride of insight and information into this highly sought-after information security role!

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Your bio says you like “using life-changing technologies to transform business, culture and society.” What do you mean by this?

As technology evolves, Joshua has enjoyed watching the growth and change of technologies including cloud, virtualization, smartphones and artificial intelligence (AI). All of these can greatly transform business, culture and society. 

How did an interest in technology change into an interest in security?

Joshua got his start tinkering with computers at an early age. At around age 10, he was an at-risk student, so his college professor father brought him into a computer lab to keep him away from trouble and help him explore the technological opportunities the lab had to offer. It was in this lab that Joshua put in his foundational hours with Unix and Linux.

How has the cybersecurity landscape changed since you first got involved?

Joshua has been involved with security since the beginning when he was a white-hat hacker in 2001. He was working with Sprint at this time when he sat down with the head of the FBI and discussed security and how it would unfold in the future. 

Joshua has been involved with every expression of security over the years including network security, internet security, information security and the latest incarnation — digital security.

How did you get involved with the NSA?

During a period of career change, Joshua contacted government agencies for new opportunities. Through Sprint, the NSA contacted him to work with them as a white-hat hacker. 

Later, he worked with both the FBI and DOJ as a penetration tester; at one point, he hacked the information of everyone involved in the Olympics worldwide! Joshua also worked with the Department of Defense but cannot say any more than that about the experience.

What were the major steps and progression of skill sets on your path to becoming a CISO?

When Joshua started, he was an infosec and technology expert coming out of the gates. He first worked as a CISO early out of college because of his expertise and the opportunities in the market space he had. 

When he started working for Sprint, Joshua worked for a CSO (Chief Security Officer), not a CISO. This CSO helped him understand the areas he lacked experience in — governance and physical security, as well as the soft skills. When he made the move over to AT&T, the CISO there acted as Joshua’s mentor and helped him meld all of these skills together. 

Are your milestones still applicable to aspiring CISOs today?

If you want to become a CISO, you need to view it as four major areas: governance, technology, physical security and cybersecurity. 

Frankly, CISO is a reflection of the old world. Things are moving toward the Chief Trust Officer (CTO). The one who knows governance best in this world will be on top, because the buck stops with governance.

What types of jobs and responsibilities is a CISO part of on a daily basis?

Your day-to-day consists of combining operational, relational, technology and governance pieces together with working with the key go-to organization executives. Many lose sight that they need to also be driving revenue, which is what separates the security czars from everyone else. 

Does a CISO work more closely with management or the C-suite?

CISOs work with both. A CISO needs to work with their peers and management to develop a 36-month road map of strategy and need to treat themselves as a center of excellence. Rather than focusing on one of these two groups of important organization designations, CISOs should focus on being easy to do business with, ensuring the state of security and driving revenue.

What are the best and worst parts of being a CISO?

The best part is the community — the global security intelligence community (GSIC). You need constant communication and open dialogue with your peers. Security is security worldwide and thinking otherwise is career-limiting.

What activities should you enjoy?

You need to enjoy professional relationships. The answer to all things is to build a network of relationships inside and outside of the organization. Your career will come to a dead halt without this. It is not that you want to be liked, but that you have to be liked.

What role do you feel certifications play in a security career path?

Certifications can help — Joshua recommends earning CompTIA Network+, Security+ and CISSP for governance reasons. This will help you, as many are afraid of security and certifications break this fear barrier. You also need to know how certifications work together — meeting others in the community can help with this.

What types of companies require a CISO?

Ultimately, all sizes of company require one but not everyone has the resources and size to have a dedicated CISO on staff. For smaller companies, you may have to work as a consultant first; as long as you have the knowledge, you can start low and build up. Above all, you need knowledge, confidence and solid communication skills.

What are some common pitfalls?

Joshua mentions three pitfalls:

• Not listening — to board of directors, CFO or peers
• Not communicating
• Not relevant to the business — not driving revenue, not building relationships

What can you do today to move one step closer to becoming a CISO?

• Get certified — Security+, CISSP
• Find a mentor — CISO or head of security
• Get involved with the GSIC

Where do you see security practices going in the future?

Things are moving toward digital security. As we get more involved with the cloud and IoT, we are moving more towards the digital and things being software-defined, and eventually toward multi-cloud and hybrid.

Conclusion

In this podcast episode of Cyber Work, Chris Sienko spoke with Joshua Knight, cybersecurity business leader at Dimension Data. Joshua provided a wealth of information about both how to become a CISO and where the field is going in the future. Stay tuned for more insightful episodes of Infosec’s Cyber Work podcast!

You can watch Chris's interview with Joshua Knight at the Cyber Work YouTube page.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Sources

1. How to Become a Chief Information Security Officer, Infosec (YouTube)