In my earlier post regarding security leadership, I talked about how success in the CISO role often has less to do with technical mastery and more to do with soft skills — storytelling, negotiation, empathy, and the ability to teach security in a way that resonates.
But that conversation sparked something deeper for me.
A colleague recently asked:
“If you walked into a room full of security professionals, how would you pick out the CISO?”
It’s a deceptively simple question — but one that gets at the heart of what differentiates security leadership from security execution.
After some reflection, here’s my answer:
You’d find the CISO having a comfortable, intentional conversation with someone. They’d be asking questions — not to test knowledge, but to understand context. And when the conversation ends, the other person would walk away having learned something new. Not just about cybersecurity, but about how it affects their role, their risks, their responsibilities.
Over the years, I’ve come to believe that leadership in this field is about mindset as much as anything else.
The best security practitioners I’ve worked with are deeply knowledgeable. But the ones who grow into leadership do something more:
They turn knowledge into trust, and trust into alignment.
They’re the bridge between technical teams and business units. Between the boardroom and the SOC. Between what needs to happen and what people are willing to do.
Here’s what I look for — and try to cultivate — in security leaders:
They’re not always the ones with the deepest technical résumé.
They’re often the ones listening the most, guiding discussions, translating risk into relevance, and making others feel heard.
They can walk into chaos and create clarity — not just with tools, but with presence.
If you’re in security and eyeing leadership, I’ll share the hardest truth I’ve learned as a CISO:
This job is 80% communication, 20% configuration.
And that’s not a complaint — it’s a responsibility.
You don’t have to be the smartest person in the room. But you do have to be the person people trust when it matters. That’s what separates a security technician from a security leader.
And in this landscape, trust is your most critical control.
Find out more about CISO Support Services here.
When people think of a Chief Information Security Officer (CISO), they often picture someone deeply technical — an expert in threats, tools, and frameworks. While technical acumen is certainly important, ...
