I appreciate CISO's that keep up with the technical side of things. They're hard to get b.s. past them. The measured risk part is important. A place can look l

I appreciate CISO's that keep up with the technical side of things. They're hard to get b.s. past them. The measured risk part is important. A place can look like a shitshow and still have all the right security controls. There are places that fire people for clicking on phishing links or say stuff like "we don't collect logs because it is a liability" (as in, get pwned is cheaper lol). Or an imbalanced/outdated/perimeter-centric mindset. I mention these because it comes from the top, doesn't matter if you hire the best hackers in the world, you're just burning money that way.