>CISO - and IS overall - is actually much more people-focused than most realize. You'd think you're hacking away and/or find vulnerabilities all the time Findi

>CISO - and IS overall - is actually much more people-focused than most realize. You'd think you're hacking away and/or find vulnerabilities all the time Finding vulnerabilities is just a specialized type of software QA that sometimes looks and acts more like an internal auditor. I think "the security community" is too caught up thinking that hacking is the end-all-be-all. It prevents them from realizing they're just another category of business analyst who's job is to complain to the development (or ops) team that their requirements should be prioritized over every other stakeholder's requirements.