3 ms·

I watched a CISO come into a startup and take it from a laughing stock (outright fraudulant PCI audits and zero policies by predecessors) to world class complia

I watched a CISO come into a startup and take it from a laughing stock (outright fraudulant PCI audits and zero policies by predecessors) to world class compliance. There was a lot of bull-dogging, confrontation, arguing, political back-stabbing, fights with nearly every developer. It was chaos. A lot of it was funny if you were the one sitting back eating popcorn. Most of the big fights involved him trying to get shit done while navigating executive level politics and rediculous antics. This guy is a very rash person and can be abrasive if he "thinks you're dumb" but I don't know if it would have gotten done at the level he was able to do it any other way. It was literally war 24/7 for years.

mooreds 5y ago
How did this person not get fired? Did they have board/executive backing? Significant ownership? Was it life or death for the startup to achieve "world class compliance"?
- nebulous_two 5y ago
  This is the million dollar question. I think there are cases where executives take this kind of aggression like it's tough love and so they argue with the warlike technical folks but ultimately concur, like old habits dying hard
- PradeetPatel 5y ago
  Possibly due to this person having exceptional stakeholder management skills. Speaking as someone who works in management. Knowing the difference between key stakeholders that you cannot afford to lose, and ones that are disposable are essential.
- bsder 5y ago
  > Was it life or death for the startup to achieve "world class compliance"? Most likely. Nobody cares about security until they lose actual money because of it. After that, your CISO now has the budget and importance defined by how much money the company got taken for.
- datavirtue 5y ago
  There were factions and he was in one that had his back. The faction that belonged to a new CEO who brought with him a CTO. Most of the antics and cringy back stabbing flowed from the CFO who was brought in by other board members. After we got acquired he started openly insulting management and the new company to their face in meetings in front of everyone. He did it on purpose but it still took quite a bit to get fired.

mooreds 5y ago

How did this person not get fired? Did they have board/executive backing? Significant ownership? Was it life or death for the startup to achieve "world class compliance"?

nebulous_two 5y ago
This is the million dollar question. I think there are cases where executives take this kind of aggression like it's tough love and so they argue with the warlike technical folks but ultimately concur, like old habits dying hard
PradeetPatel 5y ago
Possibly due to this person having exceptional stakeholder management skills. Speaking as someone who works in management. Knowing the difference between key stakeholders that you cannot afford to lose, and ones that are disposable are essential.
bsder 5y ago
> Was it life or death for the startup to achieve "world class compliance"? Most likely. Nobody cares about security until they lose actual money because of it. After that, your CISO now has the budget and importance defined by how much money the company got taken for.
datavirtue 5y ago
There were factions and he was in one that had his back. The faction that belonged to a new CEO who brought with him a CTO. Most of the antics and cringy back stabbing flowed from the CFO who was brought in by other board members. After we got acquired he started openly insulting management and the new company to their face in meetings in front of everyone. He did it on purpose but it still took quite a bit to get fired.