I worked as VP of Engineering (we had no CTO) with a CISO at a hypergrowth unicorn startup. When I started we were 30 employees (series A), when I left we were

I worked as VP of Engineering (we had no CTO) with a CISO at a hypergrowth unicorn startup. When I started we were 30 employees (series A), when I left we were 350+ (series D). He did many things well but the best thing he did was be pragmatic about what we can tackle today to move the needle. He did not come out with a 70 page document saying this needs to get done period. He understood that product still needed to be built, and he understood what to attack first to satisfy auditors and B2B enterprise clients. A shitty CISO would have collapsed under all that pressure. It was 14 months of hard work and living in god forsaken google docs of rules after rules after rules.