Random Access Memories

Monica Verma has been a hacker, a three-time CISO, a founder and one of the more outspoken voices in cybersecurity.

But she wasn't always comfortable being heard.

She was bullied throughout school, describes herself as an introvert and spent years working in organisations where speaking your mind wasn't always particularly welcome.

Then one day, after writing an article about cyber warfare and resilience, she watched a group of executives decide it was too controversial to publish. Nobody even bothered asking for her opinion.

She was furious.

This week on Random Access Memories, I sat down with Monica, founder of Monica Talks Cyber, to talk about finding your voice, challenging authority and why some people simply refuse to fit into the boxes they're given.

We get into her journey from technical hacking and penetration testing to becoming a CISO, building her own businesses and using her platform to challenge an industry that often seems more interested in titles and appearances than genuine leadership.

But this conversation gets considerably more personal.

Monica opens up about her cancer diagnosis, the fear of sharing her story publicly and what it means to be given a second chance at life. After surgery and treatment, she had to learn to walk again. Something as simple as walking outside became a milestone that took months to reach.

We talk about how that experience changed her relationship with work, ambition and the things that actually matter.

There's also a pretty uncomfortable conversation about women in cybersecurity, diversity initiatives and whether we're sometimes so desperate to demonstrate representation that we forget to recognise people for what they've actually achieved.

And we get into AI. Not another conversation about how amazing the latest model is, but whether we're building technology that genuinely improves people's lives or just creating more expensive rubbish while ignoring some fairly serious societal consequences.

We finish on resilience, both personal and technical, and why preparing for the worst is far more important than pretending you can prevent everything.

Monica has a phrase that stuck with me: "Resilience is not built in crisis. It's built beforehand."

That applies just as much to surviving cancer as it does to surviving a cyberattack.

And I think that says quite a lot about this conversation.

In this episode...

• Why Monica refuses to define herself by job titles, despite being a three-time CISO
• How her father's unconditional belief in her shaped her confidence and ambition
• Why the hacker mindset is about constantly adapting, experimenting and finding another way forward
• The moment executives silenced her opinion and why she decided she would never accept that again
• How someone who was bullied at school became an outspoken public speaker and industry leader
• Why being an introvert doesn't mean you can't become an influential voice
• The difference between challenging authority and simply being difficult
• Why CISOs who aren't willing to challenge executives probably shouldn't be in the room
• Her cancer diagnosis, the fear of sharing her experience and what a second chance at life really means
• Learning to walk and lift weights again after cancer treatment
• Why being different should be an advantage rather than something you apologise for
• The uncomfortable reality of diversity quotas and being invited into rooms simply because you're a woman
• Why Monica believes much of the current AI industry is producing products with little genuine value
• The risks of AI companions, emotional dependence and technology changing human relationships
• What personal resilience can teach us about building resilient security programmes
• How preparation and network segmentation helped during a real cyber incident

Most cybersecurity professionals spend their careers trying to become a CISO. Mike Privette got there, decided he was more interested in something else, and eventually walked away to write a newsletter.

Which sounds like a terrible career decision until you hear how it happened.

This week on Random Access Memories, I sat down with Mike, founder of Return on Security, to talk about why he traded a successful cybersecurity career for something he'd originally started as a hobby.

Mike spent years working his way through security engineering and leadership, but somewhere along the way became fascinated by the business of cybersecurity. Why were investors throwing money at certain companies? Why did some startups succeed while others disappeared? And why was nobody properly tracking what was happening?

So he started collecting data, writing about it and sharing what he learned. His first personal blog post took six months to get through corporate communications. Six years later, he'd built something valuable enough to become his full-time career.

But this conversation isn't really about newsletters.

We talk about the fear of walking away from a career you've spent decades building, why people become trapped chasing the next promotion, and how moving his family from America to the UK changed Mike's perspective on money, success and what actually makes a good life.

There's also a fascinating discussion about the financial side of cybersecurity. Where the investment money is going, whether we've created too many AI startups, why Mike wouldn't rush to invest in application security, and whether founders are building businesses to solve problems or simply hoping someone will buy them.

We get into something I think a lot of people struggle with, particularly when they have young families. The years when your career demands the most from you are often the exact years your children need you most.

Mike's decision to build something of his own wasn't just about doing work he enjoyed. It was also about having more control over his time and being present for his family.

It's a conversation about taking risks, finding curiosity again and recognising that the career you've built doesn't have to be the career you finish with.

Because sometimes success isn't another promotion, a bigger salary or a better job title.

Sometimes it's having the freedom to do something completely different.

In This Episode...

• Why Mike walked away from being a CISO to build Return on Security
• How a personal hobby became a cybersecurity market intelligence business
• Why his first blog post took six months to get approved by corporate communications
• The fear of abandoning a career you've spent years building
• Discovering that building a business was more interesting than running another security programme
• Moving his family from America to the UK and reconsidering what success looks like
• Why the American obsession with bigger salaries, houses and cars isn't necessarily a recipe for happiness
• The uncomfortable relationship between career ambition and spending time with your children
• Why Mike wanted more control over his life rather than another senior leadership position
• Where cybersecurity investment money is flowing and why Europe is becoming more important
• Whether AI cybersecurity startups are solving genuine problems or simply wrapping existing models
• Why Mike would be cautious about investing in application security
• The problem with founders building companies purely to get acquired
• Why a profitable business might be worth more than a billion-dollar exit
• Mike's advice for anyone who's lost interest in their career but is afraid to try something different

Jason Cenamor didn't set out to build one of cybersecurity's most active CISO communities. In fact, the CISO Society was supposed to be a side project while he built an entirely different business.

That business didn't work out. The money ran out, Jason went back to full-time employment, and he assumed the community would eventually disappear.

Instead, it grew.

In this episode of Random Access Memories, Jason joins Jake Bernardes to talk about building the CISO Society, the business behind it, and why genuine relationships have become one of the most valuable things you can invest in during your career.

We get into how the community started, why Jason deliberately avoided turning its members into a product, and the difficult balance between building something valuable for CISOs and making enough money to keep it running.

There's also a fairly uncomfortable conversation about how cybersecurity vendors approach communities.

Too many companies still see CISOs as logos, budgets and potential sales opportunities. They spend enormous amounts of money on conferences, dinners and sponsorships, then wonder why they can't immediately attribute revenue to the investment.

Jason argues that they're missing the point. Relationships take time, trust isn't something you can buy, and sometimes the most valuable outcome of an event is a conversation that doesn't turn into business for another year.

We also talk about why so many security professionals underestimate the importance of their networks, particularly when they're looking for their next job. Jason admits he spent years avoiding the networking side of the industry before realising how much he'd underestimated it.

And we explore something I've experienced throughout my own career: the people willing to introduce you to someone, challenge your thinking or offer advice can have a far greater impact than another certification or another impressive company name on your CV.

It's a conversation about entrepreneurship, community, trust, mentorship and the importance of putting yourself out there, even when it feels uncomfortable.

Plus, we somehow manage to spend an unreasonable amount of time discussing pizza ovens, expensive bicycles and Jason's alternative career as a Formula 1 driver.

In this episode...

• How a side project became one of cybersecurity's most engaged CISO communities
• Why Jason's original business failed while the CISO Society continued growing
• The importance of building a community that belongs to its members, not its founder
• Why Jason decided against charging CISOs membership fees
• How to monetise a community without turning its members into a product
• Why CISOs increasingly trust their peers over analysts and traditional industry research
• The thinking behind Confide Group and helping CISOs navigate an increasingly noisy vendor market
• Why Jason thinks traditional cybersecurity conferences and panels are fundamentally broken
• The problem with conferences where speaking opportunities depend on sponsorship
• Why smaller, experience-led events are often more valuable than traditional conferences
• Why vendors need to stop measuring every relationship against immediate pipeline and revenue
• The importance of saying no to sponsors, even when they're offering significant money
• Why your professional network could be the most valuable asset in your career
• How mentoring creates opportunities for both the mentor and the person being mentored
• Why getting into the room is often the hardest and most important step

Juan Rodriguez grew up watching his mother go door to door selling stuffed animals in Mexico. When the family moved to America, she was still knocking on doors, but this time handing out business cards for her own company. Decades later, Juan founded Whistic. And unlike many first-time entrepreneurs, he wasn't particularly afraid of starting a business; he'd watched his mother do it his entire life.

In this episode of Random Access Memories, Juan joins Jake Bernardes for a deeply personal conversation about entrepreneurship, leadership, fatherhood and the uncomfortable realities of building a company.

This one is particularly personal for Jake, who worked alongside Juan at Whistic and credits him with fundamentally changing Jake's own approach to leadership. Juan explains why he gives employees enormous freedom while deliberately pushing them outside their comfort zones, why he wants people who challenge him rather than agree with him, and how the principles he uses to raise his children are remarkably similar to those he uses to run a business.

But building a company isn't always about growth, ambition and success. Juan opens up about the pain of laying off employees who had done absolutely nothing wrong, the responsibility he feels for the families affected by his decisions, and why he once offered his resignation rather than avoid accountability. He also shares how losing his brother-in-law during COVID brought him closer to walking away from Whistic than anything he'd experienced professionally.

Then they explore the complicated relationship between founders and CEOs: what Juan learned from handing leadership of his company to someone else, and why he would make a very different decision if he could start again.

And of course, they get into football, parenting, AI, why boredom might be essential to creativity, and Juan's seemingly impossible ambition to take an actual holiday.

Ultimately, this is a conversation about what leadership looks like when you genuinely care about the people you're responsible for. Because as Juan learned from reading Radical Candor, you can't hold people accountable if they don't believe you care about them.

But sometime the best thing a leader can do is simply be kind.

In this episode...

• Growing up in Mexico and America, and how Juan's entrepreneurial mother shaped his attitude towards risk
• Why Juan believes high expectations only work when they're accompanied by unconditional love
• What coaching children taught Juan about effort, failure and leadership
• Why the best leaders give people freedom to become uncomfortable
• How boredom and uncertainty create opportunities for genuine creativity
• Why Juan deliberately hires people who are willing to challenge him
• The emotional reality of laying off employees who have done nothing wrong
• How losing his brother-in-law during COVID nearly made Juan walk away from Whistic
• Why founders must take responsibility when their decisions affect employees and their families
• What Juan learned from working alongside a CEO with a completely different leadership style
• Why he would choose to become CEO from day one if he could start Whistic again
• The difference between taking risks and calculating risks differently
• Why AI-generated code could threaten creativity and the development of future engineers
• The leadership lesson Juan discovered in Radical Candor
• Why kindness and accountability belong together

We hear the advice to build a personal brand all the time, and everyone wants to know the how. But Ayoub Fandi is a walking, (pretty) compelling argument that you might be asking the wrong question.

Ayoub went from working relatively quietly in GRC to becoming one of the people most closely associated with GRC Engineering, building an audience of tens of thousands, relationships with security leaders and founders across the industry, and a career where opportunities increasingly started finding him instead of the other way around.

In this episode of Random Access Memories, Ayoub joins Jake Bernardes to unpack how that actually happened, and refreshingly, there was no master plan to become an influencer. He started writing because writing forced him to understand what he actually thought, chose a very specific niche, kept showing up long after consistency stopped being exciting, and used the audience he built as a doorway to real relationships rather than treating follower count as the goal.

We get into Ayoub’s surprisingly sophisticated content engine, why the people behind his ideas matter more than the content itself, how to find an unfair advantage that actually fits who you are, and why “follow your passion” might actually be terrible career advice.

Ayoub’s alternative is much more useful: passion often follows competence, but you have to stay with something long enough to become good before you can know whether you actually care about it.

Most importantly, Ayoub makes the distinction between becoming visible and becoming valuable. Influence can create leverage, but the point is deciding what you want that leverage to be for.

In this episode

• Why writing publicly can make you better at your actual job
• How Ayoub became synonymous with GRC Engineering
• Why consistency mattered more than trying to manufacture virality
• The content system behind hundreds of ideas and more than a thousand posts
• Why your audience should become relationships, not just followers
• How to “niche down twice” until people associate one thing with you
• Finding and exploiting your genuine unfair advantages
• Why passion often follows competence instead of preceding it
• What visibility, influence, and access are actually useful for
• Why knowing your personal “why” matters before you start chasing reach

At some point in your cybersecurity career, the skills that made you successful stop being the skills that move you forward. And according to this week’s guest, Adam Arellano, some of us may be a little more attached to our “technical” identity than we'd like to admit.

Adam is Field CTO at Harness, a longtime security practitioner, humanist, former social worker, leader, unapologetic wearer of kilts and heels, and one of the more unconventional thinkers you'll find wandering around a cybersecurity conference.

In this episode of Random Access Memories, Adam joins Jake Bernardes for a conversation about what happens when you stop following the career path you're supposed to follow and start figuring out what actually makes you different.

They talk about Adam's decision to be visibly weird and queer in an industry that still has plenty of sports coats, why representation can sometimes mean becoming the person your younger self needed to see, and why standing out isn't really about what you wear. It's about understanding the perspective, experience, and abilities you bring that nobody else does.

And then things got uncomfortable. Are senior cybersecurity leaders actually still technical?

Adam argues that technical expertise ages along with the technology you learned it on. If your hands-on expertise comes from 2006, calling yourself technical in 2026 may require an asterisk. And as practitioners move into leadership, Field CTO, Field CISO, and other positions of influence, the ability to communicate, understand people, and translate complexity may become far more valuable than staying the smartest person at the keyboard.

The conversation moves from punk rock to personal branding, social work to cybersecurity leadership, why disagreement is essential to good teams, and why surrounding yourself with people exactly like you might be one of the worst career decisions you can make.

And just when Jake thinks he's safely wrapping things up, Adam delivers some unsolicited therapy about success, anxiety, and our obsession with controlling outcomes.

Oh, and apparently Maui is a Disney princess…he makes a compelling case, trust us.

In this episode

• Why Adam intentionally chooses to stand out
• Being the representation your younger self didn't have
• Why following the standard cybersecurity career path isn't always the answer
• Finding the thing that's uniquely yours—and building around it
• RSA vs. Black Hat and BSides: has cybersecurity become too corporate?
• Punk rock, selling out, and why being effective can matter more than being righteous
• Why senior cybersecurity practitioners may not be as technical as they think
• What happens to technical skills as your career moves into leadership
• Why communication becomes a critical technical-adjacent skill
• Learning human interaction the same way you'd learn a new technology
• Why you should surround yourself with people who aren't like you
• How complementary strengths can create extraordinarily effective teams
• Why disagreement isn't dysfunction
• Understanding the person receiving your message instead of simply changing how loudly you deliver it
• Letting go of success anxiety and the illusion that you can control every outcome
• The definitive argument for Maui as a Disney princess

Most leaders spend their careers trying to prove they're good at their jobs. But Assaf Keren does something different, he teaches his managers how he's failed.

The current CSO of Qualtrics and former CISO of PayPal has spent more than two decades in security, but some of his strongest beliefs about leadership didn't come from the things he got right. They came from burnout, bad decisions, difficult feedback, and learning to let go of the need to be the smartest person in the room.

In this episode of RAM, Assaf joins Jake Bernardes to talk about the stories behind his book and the leadership philosophy they created.

That includes asking employees to tell him when he's wrong, telling leadership what he intends to do instead of constantly asking permission, and an annual ritual his team has learned to dread: Assaf publicly grading his own performance. One year, he even went to his boss and asked to be rated lower. But some failures cost more than a performance review.

Early in his PayPal career, Assaf was working across Israel and the United States, essentially working two shifts every day. Good nights ended around 1 a.m. Bad ones at 3 or 4. Then he'd wake up and do it again.

He did that for a year.

Eventually he was physically ill, emotionally reactive, unable to think clearly, taking 15-minute power naps between meetings—and closer than he realized to leaving cybersecurity altogether.

Compounding that experience was something else he'd carried quietly for years: PTSD. During COVID, Assaf learned that an employee with PTSD was afraid to disclose what they were experiencing. So Assaf wrote a message to a PayPal Slack channel with roughly 40,000 people explaining his own experience.

Then he stared at it, for three days. His extended family didn't know. His colleagues didn't know. He worried his leaders might see him differently.

Eventually, he pressed Enter, shut his laptop and walked away. Looking back, he says: “That was the moment I started healing.”

Memory 006 is a conversation about failure, burnout, vulnerability, mental health, ego and what it actually means to lead people through a profession built on uncertainty.

In this episode:

• Why Assaf calls English a low bandwidth language, and what it taught him about giving feedback
• The year he worked two full shifts a day, Tel Aviv mornings and US nights, until his body forced him to stop
• Why he asked his own boss to rate his performance lower than expected
• The Slack message to 40,000 people that he sat on for three days
• What a submarine commander's book taught him about intent based leadership
• Why he believes the entry level security career is disappearing, and what that means for the next generation of leaders

Rinki Sethi has spent nearly 25 years in cybersecurity, with stops at Walmart, eBay, Intuit, Palo Alto Networks, IBM, Rubrik, Twitter, Bill.com, and now Upwind.

But one of the most important moments in that career came when she almost walked away from cybersecurity entirely.

In this episode of Random Access Memories, Rinki joins Jake Bernardes to talk about the mentor who changed the trajectory of her career, why the people around you can matter more than the logo on your résumé, and what great leadership actually looks like when the goal isn't just building better programs, but building better people.

They also dig into a question cybersecurity is going to have to answer sooner rather than later: What happens to the next generation of security leaders when AI automates the jobs where so many of today's CISOs learned the fundamentals?

From the rise of the “builder” CISO to technical fluency in an AI-first world, Rinki and Jake explore how the role is changing, and why knowing how to ask the right questions may matter just as much as knowing how to write the code.

Then, they look beyond the CISO seat. Rinki shares why she co-founded Lockstep, what she's learned from investing and working with founders, and why she believes security practitioners should sit at the center of the cybersecurity ecosystem instead of simply being sold to buy it.

Her biggest lesson after decades in the industry is also one of the simplest: Don't just chase the company. Chase the people.

Because the jobs change, the titles change, and the technology definitely changes but the relationships you build along the way can change everything.

In this episode

• The Walmart mentor who kept Rinki from leaving cybersecurity
• Why great careers aren't necessarily built by chasing prestigious company names
• What separates a true leader and mentor from someone who's simply managing people
• Why tomorrow's CISOs may need a builder mindset
• Whether AI actually makes everyone technical — or just makes it easier to build the wrong thing
• What happens when SOC, GRC, AppSec, and pentesting entry-level work gets automated
• How the CISO role is shifting from technical architect to business leader, communicator, and influencer
• Rinki's move from traditional enterprise security into hypergrowth security at Upwind
• Why she co-founded Lockstep and what investing taught her about the cybersecurity ecosystem
• Why practitioners should have a bigger stake in the value they help create
• The importance of understanding equity, cap tables, vesting, and startup economics
• Why networking and community aren't side quests — they're often where the next opportunity begins

What happens after you finally get the CISO job you've spent your career working toward, and realize you want something different?

Tim Chase made the move from operational CISO to Field CISO because he loved something specific about the job: talking to other security leaders, understanding their problems, sharing what he'd learned, and helping them find better answers.

But becoming a Field CISO introduced a different kind of pressure.

In this episode of RAM, Tim joins Jake Bernardes to talk about what the role actually looks like when you strip away the conference stages and LinkedIn posts: defending whether you're still a "real" CISO, pushing back when companies treat Field CISOs like salespeople with impressive Rolodexes, and trying to remain credible when your paycheck ultimately comes from a vendor.

They also get into the part of the job that's harder to see: the cost to your family.

It's a theme that came up with last week's guest, Avani Desai, too. Avani talked about one year when her career meant she saw her infant son only 50 days. For Tim, it's the conferences that overlap with the first week of school, the travel squeezed between kids' sports and date nights, and the guilt of knowing that being present somewhere often means being absent somewhere else.

Different careers. Same uncomfortable question: How much of your life are you willing to give your job?

Tim is a father of four with a working spouse. Being useful in the field means customers, conferences and teams constantly compete for his time. But every yes somewhere is a no somewhere else.

Sometimes that means squeezing family life between trips. Sometimes it means sitting at a hockey game feeling guilty because his wife is home putting four kids to bed. And every year, Black Hat somehow lands during his children's first week of school.

For Tim, being a great Field CISO isn't about being everywhere. It's about knowing where you're actually valuable, and having the discipline to say no everywhere else.

This is a conversation about trust, credibility, career identity, burnout, family, and why sometimes the best thing a Field CISO can tell a customer is: Don't buy our product.

In this episode

• Why Tim left an operational CISO role after spending years getting there
• Whether becoming a Field CISO is a progression, a lateral move—or a step backward
• Why some security leaders don't consider Field CISOs "real" CISOs
• Whether Tim would ever return to an operational CISO seat
• The misconception that Field CISOs are salespeople with CISO networks
• Why lived experience gives a Field CISO credibility with customers
• Why solving the customer's problem has to matter more than selling your product
• Times Tim has told prospects that his own company wasn't the right solution
• Why trust matters more than the product pitch
• The travel and visibility expectations that come with being a Field CISO
• Balancing conferences and customer commitments with four kids and a working spouse
• Why Tim refuses to become a "road warrior"
• The guilt that can come with being present professionally and absent personally
• Why saying no is part of staying effective
• What burnout looks like in a Field CISO role versus an operational security role

Avani Desai once believed she had to make an impossible choice: be a good mother or become an exceptional executive.

Today, she's CEO of Schellman, and she's building the kind of workplace she wishes she'd been able to see earlier in her career.

In this episode of RAM, Avani joins Jake Bernardes to talk about growing up as the daughter of immigrants, beginning her career as one of the only women in penetration testing, and eventually becoming one of fewer than ten women leading a top-100 CPA firm.

But this isn't really a story about becoming CEO.

It's about what happened along the way.

Avani opens up about being afraid to disclose her first pregnancy because she worried it could affect her next promotion, seeing her newborn son fewer than 50 days during his first year, and ultimately leaving a job she loved because she refused to sacrifice the kind of mother she wanted to be.

Then an opportunity at Schellman changed the equation.

Now, as CEO and mother of three, Avani is trying to make sure the people coming behind her never feel forced to make the same choice.

It's a conversation about ambition, representation, parenthood, leadership—and redefining what having it all actually means.

In this episode

• Why Avani's father moved his family to America specifically to create more opportunities for his daughters
• Going from penetration tester to privacy, marketing, president, and ultimately CEO
• What it feels like to be the only woman—or woman of color—in the room
• Why Avani was afraid to tell colleagues she was pregnant
• The impossible choice she felt forced to make between motherhood and her career
• Seeing her son fewer than 50 days during his first year
• Why she ultimately left a job she genuinely loved
• Finding a company where parenthood and ambition didn't have to compete
• Why 70% of Schellman's executive leadership team is female
• Why Avani believes representation isn't about celebrating being “the only”—it's about making sure you're not the last
• Her approach to being fully present at work and fully present at home
• Why Schellman shuts down for three weeks every year
• Why “rest is not a reward after burnout. It is part of performance.”
• Building a leadership team strong enough that the CEO can make herself “irrelevant”

Chapters

00:00 – Meet Avani Desai
01:54 – Her hero: the father who sacrificed everything for his daughters
02:42 – Growing up as the daughter of immigrants
04:34 – Reinventing yourself without changing companies
06:35 – Being a female penetration tester in 2002
06:52 – Becoming one of the few women leading a top-100 CPA firm
07:34 – Why being “the only” isn't something to celebrate
08:04 – Being afraid to disclose her pregnancy
09:00 – The impossible choice: executive or mother?
09:47 – Seeing her son fewer than 50 days in his first year
10:18 – The opportunity that meant she didn't have to choose
10:55 – Building a leadership team that's 70% women
12:35 – Why Avani talks publicly about the good and the bad
13:12 – Can you actually “have it all”?
14:00 – Protecting the hours that belong to her family
21:38 – Why Schellman completely shuts down
22:26 – Why she rejects unlimited PTO
24:12 – “My job is to make me irrelevant”
24:30 – Why exhaustion shouldn't be a badge of honor
24:50 – Rest is part of performance

Everyone remembers the headlines, but very few know what happened after the cameras left.

Former Uber Chief Security Officer Joe Sullivan and his wife, Prathiba, join Jake for an honest conversation about what it was like to navigate one of cybersecurity's most public legal battles—not as a security leader, but as a family.

From media scrutiny and online speculation to preparing their children for the possibility of prison, Joe and Prathiba share the conversations that happened behind closed doors and the resilience that carried them through.

This isn't another breach retrospective. It's a story about marriage, community, parenthood, and what happens when your hardest professional moment becomes your family's burden too.

If you've ever wondered what leadership really costs, this episode is for you.

In this episode

• What life looked like behind the headlines of the Uber incident
• How public scrutiny affects spouses and children—not just executives
• Navigating fear, uncertainty, and the possibility of prison as a family
• Why community became their greatest source of strength
• Teaching resilience, honesty, and courage through adversity
• How hardship ultimately strengthened their marriage and reshaped their purpose

The Emotional and Strategic Resilience of a CISO: Insights from Tim Brown

In this episode, Tim Brown reflects on his extraordinary journey through one of the most high-profile cybersecurity breaches in history, his health scare, and how these experiences reshaped his outlook on leadership, community, and the future of cybersecurity.

Main Topics:

• The human side of cybersecurity leadership and managing personal health amid high-pressure incidents
• The importance of community support, compartmentalization, and resilience in crisis situations
• Lessons learned from a major breach and regulatory challenges, including navigating SEC cases
• The evolving role of the CISO in strategy, AI, and business impact awareness
• The benefits of pivoting careers and fostering innovation within the cybersecurity community

Timestamps:

00:00 - Introduction to Tim Brown and episode overview

01:09 - Tim’s background, heroes, and personal interests

02:25 - Handling a major breach and personal health during crisis

04:00 - Managing work-life separation during high-stress legal and public scrutiny

06:00 - Lessons from a prolonged SEC case and their impact on mindset

07:24 - Decision to fight SEC charges and the importance of integrity

09:00 - Recognizing physical health signals amid stress

10:37 - The role of recovery versus stress and mental well-being

12:36 - How the incident changed life priorities and outlook

14:36 - Reflecting on advice for cybersecurity professionals before a crisis

17:02 - Factors motivating the decision to fight legal battles

19:20 - Post-crisis career pivot and current roles with Team8

22:24 - Trends and challenges in the cybersecurity community, including AI and future skills

28:18 - Resilience, design, and strategic thinking in the evolving security landscape

36:44 - The importance of visionary thinking beyond immediate technical solutions

37:22 - Final reflections: whether to avoid hardship or embrace growth

38:46 - Closing remarks on community, leadership, and future directions

Resources & Links:

• Team8
• CISO Village
• Tim Brown on LinkedIn
• Book (The CISO Journey)

Connect with Tim Brown:

• LinkedIn
• Twitter

Tim emphasizes the importance of community, strategic thinking, resilience, and integrity in cybersecurity leadership. His journey highlights how personal experiences can reinforce professional purpose and community contribution.