He's being sued for his actions not because of his position - he was responsible for acknowledging the issues internally and not acting on them, he was responsi

He's being sued for his actions not because of his position - he was responsible for acknowledging the issues internally and not acting on them, he was responsible for the language of statements made to shareholders that misled them about the state of security. If he had sent an email to the CEO saying "we have a problem, we need to do something about this" and the CEO had overruled him, the CEO would be being sued directly. It doesn't really matter what his role or how high up he was - he was found standing over the body holding the smoking gun.