Leadership Is More Than a Title. This is What Actually Matters | Root To CISO Podcast

0:00Speaker:Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

0:21kris-rides_2_07-28-2026_140723:Hey, everybody. We are back with part two with my good friend Yonesy. Yonesy, thank you very much for joining us again, and thank you audience for coming back. I hope you're back anyway. We promised you some Donald Duck and some talks about, about CISOs and different jobs. We'll get to the Donald Duck bit, a bit later I'm sure, I'm sure. But, um, where we left it off, we were talking about the different type of CISO jobs, whether, you know, some ti- some, some cases they're individual contributors, still hands-on.

0:51kris-rides_2_07-28-2026_140723:Other cases they're more strategic roles. You know, they can be different companies, companies at different stages. And I think when we last sort of left it, left it, we were talking about how job descriptions are and how they can change so quickly. Um, and so I think we, we should talk a bit more about that before we go into your career and, and, and having been a CISO multiple times. But I totally agree. I think we can take a job description from a company that's looking for a CISO, um, and often the, the, the job description they've given us is very different from the one we get when we've talked to them, because they start realizing what they need, not just now, but where they're planning for things to go.

1:31kris-rides_2_07-28-2026_140723:And so we... But even so, we're still recruiting for somebody for what they need now and in the close future. Um, sometimes that can change massively in a year or two years. How does somebody like you keep up with all of those kind of changes and also know when it's the right time for you to say,"I can do that," or when it's the right time to say,"Actually, I can manage that, but I need to bring somebody in to do it"?

1:58yonesy_2_07-28-2026_170723:Yeah, it's a, it's a really good, really good question. So I, I always start before we get into the specifics with, sort of the mantras that you gotta carry day in and day out. So the-- it's great to be back here. But I find that everyone in this field you mentioned in part one, we're well-intentioned. We're all trying to defend ourselves, our organizations, our industries, that creates this community of wanting to help others, which is amazing. same token, when we go into an organization, we tend to wanna raise our hands and say,"I got this." Uh, and sometimes the right answer is to say no.

2:38yonesy_2_07-28-2026_170723:And our people, our security people need to practice Saying no. Small nos in the beginning, because you have to be specific and intentional about the things that you say,"I got this" on. When you

2:55kris-rides_2_07-28-2026_140723:Right

2:56yonesy_2_07-28-2026_170723:those three words, you utter that phrase,"I got this," gotta be sure that it's going to be intentional and it's gonna have the impact that you need. And early on, frankly, you need some early wins. You need low-hanging fruit. So you can't be saying,"I got this," to one of the most critical things that you have to go investigate, l-lean in, may-maybe get external help and consultants,'cause th-that doesn't... So you, you have to be judicious on your usage of the phrase,"I got this." and oftentimes you're gonna get requests that are not gonna align and set you up for success.

3:33yonesy_2_07-28-2026_170723:So I think early on, you just gotta be very judicious, build the muscle within the organization. I think the biggest thing is, listen, if you got this far and you're about to get hired for the role, uh, everybody knows you're competent. The, the background, the back channel that they've done on you, what you've done in the past. You're good at what you do. Trust me. You know, you know what you're doing, It, it's more around can you fit in with the team?

3:57yonesy_2_07-28-2026_170723:Um, are you gonna be a team player? Are you gonna solve for problems? Are you gonna be a CISO of friction or a CISO of solution and, roadblock remover, removal? I, I, I like to call myself the knot untier, the roadblock remover. Like, that's the job, right? So doing that while protecting is key. Early on, you gotta find those low-hanging fruit. So that's, uh, that's, again, context. This is the background that, that you should be thinking along these lines.

4:24yonesy_2_07-28-2026_170723:How am I gonna be the CISO that's not gonna add or create friction? How am I gonna untie knots then remove roadblocks? And, and doing that with the team in mind, because you're the one that's coming in to disrupt. Team's been there operating, right? So you need to understand how the team operates. I like to call it the dance, how you get into harmony, um, the rest of the team, and then go after... At the end of the day, you have mandates, right? How can you leverage those mandates to get what you need accomplished, what's the benefit to others?

5:00yonesy_2_07-28-2026_170723:the main question you should always ask,"What's in it for them?" Now, what's... You already know what's in it for you. You wanna protect, right? So how does that help them? What's in it for them? I think it's the, it's the conversation. Uh, and then I think everything else follows. And if you Do the things we talked about in, in, in the first part, which is, you know, building an ecosystem, a culture where people feel open, supported to do the right thing, to be at their best and to get better.

5:34yonesy_2_07-28-2026_170723:I tell people, uh, so I'm gonna take that back. Better is better than best, right? 'Cause better you're always progressing. If-- I, I don't aspire to be the best. I aspire to be better every day so that I'm always working on it. I'm more working at it. So how do you create an ecosystem where people feel that, that they can do that? And, and frankly, that, I think that's what people want. At the end of the day, they wanna be challenged, they wanna be here together day being challenged and getting better.

6:04yonesy_2_07-28-2026_170723:that's what, gets people excited. we solving problems? I have a great environment to, to do that in? Do I have the support that I need? And are we having fun solving these problems? And let's call them challenges'cause they're not problems, they're challenges. So how do we overcome these challenges? think, for me it's not just the human condition, it's a being... know, one of the things that we all hold in common that we are all alive at the same time.

6:30yonesy_2_07-28-2026_170723:This is amazing, right? Like, this is never gonna happen again, right? So if we can get better and overcome challenges together, I mean, there's nothing that's most precious than like that connection that we all hold, that we are alive at the same time right now and solving challenges. So, not to get too philosophical, but I feel that knowing all these things, if you can then bring that energy, uh into the team, and then be intentional, people, resonate.

7:00yonesy_2_07-28-2026_170723:That resonates, with folks. And, and I think that's how you start

7:05kris-rides_2_07-28-2026_140723:Yeah. Yeah, I do. I agree. I think, I think with all of this sort of stuff, um I think it's, it, it's important to connect with people'cause they're gonna be, you said they're, they're the operators, right? You're leading them. You wanna make things so it's, they're able to operate at their best, uh, or operate in a way that's better for them, right? Maybe we shouldn't say best because you're right. Best, best kinda says that they reach a plateau, and when you reach plateau, that's when people get bored, and so keep challenging them, keep giving them things to reach to.

7:36kris-rides_2_07-28-2026_140723:Makes sense. Now, when you're in a situation where, uh, like, and there must be situations when, when you're, you're in a role and, like, they start giving you things to do which you do have to push back on. And that's difficult'cause cybersecurity teams are often called the office of no, right? And n- and nobody wants to-- We don't wanna be known as that. Uh, we wanna be business enablers. But, but how do you go about managing those times when the answer really is no, you, you shouldn't be taking that risk and, you know, if they're putting it on your shoulders, how do you, how do you do that without buckling and saying yes to something you, you know you shouldn't be doing that for?

8:17yonesy_2_07-28-2026_170723:Yeah, no, I think the, the, the conversation really is about, risk-reward. And I think it's a, it's a risk-based conversation, right? Um, knowing that, listen, at, at the end of the day, we gotta cross this crevasse over here. It's how we cross it, right? And then what does it mean to cross it? 'Cause we need to get across. That there's no risks involved. We can fall in, so many different things that, know, falcon can swoop in. So many things can happen, right?

8:45yonesy_2_07-28-2026_170723:It's how we're gonna go about it. And then that has a gradient of ways that we can do it. We can slingshot ourselves over the crevasse. We can jump over the crevasse. We can, you know, catapult. There's so many different ways of getting over the crevasse, so I think you just gotta be able to present the options. Um, so I don't u-usually say no. I, I li- I bring forth options,

9:05kris-rides_2_07-28-2026_140723:Yeah

9:06yonesy_2_07-28-2026_170723:where no, it's, it's an option of, uh, inaction, which by the way, is also an option.

9:12kris-rides_2_07-28-2026_140723:Yep.

9:13yonesy_2_07-28-2026_170723:For me, that-that's how I like to frame it. I don't like... I'm not a yes and no person. I'm a,"These are the options based on what you've asked me to do or what we have to do,"'cause it's, it's an existential. Sometimes the request you're gonna get when... I find the biggest areas of friction is when a company is asking you to do something that's existential to the business, that needs to happen. Well, when you may have a regulatory requirement, you have, may have vulnerabilities, it could be an architectural thing.

9:39yonesy_2_07-28-2026_170723:So many different things that could be happening, but there's always a way past that. So here are the options based on what we know, what I know, or the experts know on what we could do, and each of which has a resource constraint, cost requirement associated with it. Management, in your infinite wisdom together, let's figure out which of the options that I presented the most sense. And if you have a, if you-- And because again, if someone's gonna tell me no about something, how-- what's your idea of getting over the crevasse?

10:12yonesy_2_07-28-2026_170723:'Cause that's the other way, like you play it out, right? 'Cause it's so easy to bring forth negatives. It's so easy all the time. Just like destroying things, it's like I build a house, it's easy to destroy it. But you know how hard it is to build a house again? So if someone's gonna say no, you're gonna tell me then how, So I tell people all the time,"If you're gonna say no to something that I've presented that I wanna move forward with and, and your answer is no, then how?

10:37yonesy_2_07-28-2026_170723:How else can

10:38kris-rides_2_07-28-2026_140723:Yes.

10:38yonesy_2_07-28-2026_170723:Do this?" uh, i-is my response. So, so that's, that's how I tend to think about th-these things and how I like to prepare myself and present requests that are, let's call them difficult,'cause there's just existential requests that are difficult,

10:53kris-rides_2_07-28-2026_140723:Yep

10:53yonesy_2_07-28-2026_170723:how to go about them. So that's usually my approach.

10:55kris-rides_2_07-28-2026_140723:Even it's funny you say that'cause as you were saying it, Not many people just say no, but when they do say just no, that feeling is almost like a, like there's almost like a jolt, right? It puts you back up. It makes you like,"Well, hang on. Why not? Like, you're not explaining anything to me. You're not giving me options." So you're right. The answer isn't just to isn't to have a no unless you can come and say,"No, these are the reasons why I'm saying no, and these are the things we could do instead," right?

11:22kris-rides_2_07-28-2026_140723:"These are the other options." Right? I, I think the, like you say, the best way to do it is not even to come out there with a no. It's to come out there with,"These are all of the different ways we could do it, and one way is we just couldn't do it at all. We just don't do it, and then this would be the outcome," right? "But this would be the, the, the, the risk that might solve. This is another way we could do it, and this is another way of doing it.

11:42kris-rides_2_07-28-2026_140723:What's the way that's gonna work best for you? What's the west- the way that works best for the business?" And that's something that people can practice. They don't have to be a CISO to practice that, right? If you're an, an individual contributor and your boss is asking you to do something, um, and it can't be done or you don't think it can be done or you think there's other ways of doing it, practice that. "Look, we totally can do that," you know,"This would be the outcome," or,"This is how we would go about doing it.

12:11kris-rides_2_07-28-2026_140723:These are two other ways we could maybe do it. What's the best way for the business?" Give your, your, the person you report into, the leadership you report into before you're a CISO those options and start practicing those skills'cause it is something you're gonna need if you're gonna move into those executive positions.

12:28yonesy_2_07-28-2026_170723:Everything's negotiable. We talked about it earlier, except for death and taxes

12:35kris-rides_2_07-28-2026_140723:Yep. Yeah, indeed. Yep, we won't go into why we were talking about that, but yeah, trust me. Um, yeah, so like, so this was your first CISO gig. You were an individual contributor, team of one. You built that up at that company. Um, first of all, how did you get that role?

12:54yonesy_2_07-28-2026_170723:Hmm. Uh, that, that was a conference, uh, presentation. They, they had a need, the CIO, uh, understood what I was saying, uh, and

13:07kris-rides_2_07-28-2026_140723:And approached you after...

13:08yonesy_2_07-28-2026_170723:myself, or saw me i-in, in the role, uh, being able to talk about difficult concepts, in a way that people understood. So I've always been lauded, for my ability to articulate the situations that, that we're doing in simple, easy speak, is one of the things I have been good at. But it helps that English is my second language, so I had to learn to communicate early on when I didn't master a language. So, um, it's important to be clear

13:41kris-rides_2_07-28-2026_140723:Yeah. Yeah, I love that. That's great. That's a great example, and one that I think is so important because there are so many opportunities of events to talk at, to local events to speak to, to places to go to network that, like, I can't say enough about getting out there and doing that sort of stuff if you really wanna move your career forward, and these opportunities appearing when you put yourself in places. What's the, uh, is it, what's it? Luck is timing and, uh, is it timing meets opportunity makes preparation or something like that?

14:14kris-rides_2_07-28-2026_140723:I can't remember the exact saying, but

14:16yonesy_2_07-28-2026_170723:Uh, uh,

14:17kris-rides_2_07-28-2026_140723:I,

14:17yonesy_2_07-28-2026_170723:I got one that's easier to remember. I tell my kids, uh,"Nothing's gonna happen to you in your house. You gotta get out there." I mean, doesn't knock at your door. You go to where the opportunities are. So opportunity never... I-- whoever said that opportunity does not knock, you need to go out and find it, find that where people are. And if you wanna be in this space, you gotta be where the people are. You know, like, you know, uh, next week, I know this is airing in a few weeks, but, uh, conferences like Black Hat and BSides and DEF CON in the next, uh, week in real time for us, I mean, that's where people are at.

14:55yonesy_2_07-28-2026_170723:So if you're not present... And what do they say? If it-- if there are no pictures, it didn't happen. If there was a conference and you didn't go, then you didn't look for opportunities

15:05kris-rides_2_07-28-2026_140723:Yeah Yeah. I totally agree. Gotta put yourself out there. So then let's go, that was your first CISO gig. Where was that at, by the way? What company was that?

15:14yonesy_2_07-28-2026_170723:Uh, I don't usually like to name

15:16kris-rides_2_07-28-2026_140723:You know when an,

15:17yonesy_2_07-28-2026_170723:a

15:17kris-rides_2_07-28-2026_140723:okay, ma-

15:17yonesy_2_07-28-2026_170723:ma- manufacturing company.

15:19kris-rides_2_07-28-2026_140723:a manufacturing company and then let's... I mean, probably some of this is in your LinkedIn, right? But,

15:25yonesy_2_07-28-2026_170723:It is. If, if you wanna do... I mean, it's so easy. Just look

15:28kris-rides_2_07-28-2026_140723:yeah

15:28yonesy_2_07-28-2026_170723:you can ask one of the Frontier models. They got all the data.

15:31kris-rides_2_07-28-2026_140723:Yeah, exactly. AI will tell you the

15:33yonesy_2_07-28-2026_170723:Spend

15:34kris-rides_2_07-28-2026_140723:answer.

15:34yonesy_2_07-28-2026_170723:Uh, two token credits. Spend some usage credits

15:38kris-rides_2_07-28-2026_140723:When Yonesy was talking about this company, the first place he was a CISO, which one was it? Write the right prompts. Practice your prompt engineering.

15:45yonesy_2_07-28-2026_170723:Exactly

15:46kris-rides_2_07-28-2026_140723:so then you went there, and then after this, what was your next pos- next step after that role?

15:51yonesy_2_07-28-2026_170723:Um, so during that role, I then went into, Had a-- I was at another conference doing a presentation, and, this mentor of mine was like,"Hey, you should, uh, to financial services." And I'm like,"I'm into manufacturing. How do, how does that even happen?" so, so I went into, kind of financial services after that. Uh, did a bit of consulting just to get there, uh and, and then went into, financial services. But it was kind of a, a road back. I like to call it the road back to CISO.

16:23yonesy_2_07-28-2026_170723:Um, and oftentimes-- and I get this question a lot, obviously. Some of the people that I talk to are like,"How do you break into CISO when you, you know, you're moving industries?" And sometimes, you know, I tell folks you have to take a step back, um, be a deputy or something of the sort just to get back in it, just so you get the muscle memory. Uh,'cause you've got to exercise a new set of muscles, specifically different regulators, looking at things differently.

16:49yonesy_2_07-28-2026_170723:Even though I dealt with regulated environments from FDA, ITAR, munitions standpoint, um, DoD, it was a little bit different in financial services. So, so getting that early muscle memory in is important. So from manufacturing to, uh, financial services, you know, I took a couple of detours in education. I took a detour in consulting and as a deputy, prior to, uh, coming back, to the actual CISO role. Um, so it's something that people have to be ready for.

17:23yonesy_2_07-28-2026_170723:And just knowing that the same things that got you to an industry, to the zenith of a, you know, a field in an industry, might not be what takes you on the next one. So I tell folks all the time that you can do the exact same things that I did, and it does not guarantee you're gonna have the same opportunities, because you've got to be part of that, right? Like, that you got to be part of what happens to you. Um, and more often than not, that is in those relationships that you're building, along the way.

17:52yonesy_2_07-28-2026_170723:And I find that you really have to devote time to giving, sharing, uh, collaborating, and being out there. So that's not a chore. It's something-- I think it's necessary. Um, and I, and I think to lead is, is to be able to share a-and help. So if I would say what's one thing that, that has anchored me across six different stints, as a CISO, I, I would say is that, collaboration. You know, what we're doing right now, just sharing, information I think is, is key.

18:27yonesy_2_07-28-2026_170723:And, and helping others, um, when they need it, whether that is, uh, on the field, on thoughts on AI. We talk about-- That's what we get to talk about these days and the precedents that we're seeing, things that are taking place from, from tier models, open weights, et cetera. having an opinion and being able to leverage your opinion help others, I think it's critical. So would say that is the one thread that cuts across those CISO stints is, uh, the ability to, to share and help others.

19:02yonesy_2_07-28-2026_170723:Uh, I find that that has been, at least for me, that's my main truth

19:05kris-rides_2_07-28-2026_140723:Yeah

19:06yonesy_2_07-28-2026_170723:is, how I like to define. And other CISOs may have different trajectories and different pathways, but that's what's, what's worked for me

19:13kris-rides_2_07-28-2026_140723:I, I actually, you've made that a very small part, you've made it sound like a very small thing. N- not, not the, uh, the, the, the managing people and being mo- but, but that gap between your first CISO gig and your next CISO gig. You know, you said,"I did a bit of consulting and I worked in education, and then, you know, and then I think as a deputy, and then I got my next CISO gig." And, and we that, that was, you know, a few seconds of time you spoke about there.

19:40kris-rides_2_07-28-2026_140723:But

19:40yonesy_2_07-28-2026_170723:Mm-hmm.

19:41kris-rides_2_07-28-2026_140723:Actually, I think that's a really important part, of a conversation that we should have and that people should know about. Because there are a lot of people, they get their CISO, their first CISO title, and they think they've made it. And we already said there's different types of CISO roles and then they, you know, whatever happens, and maybe they won't move unless they get another CISO title, or maybe they get laid off. A lot of, lot of companies flattening their structures and a lot of lit CISOs, experienced CISOs that are out there looking for work right now.

20:10kris-rides_2_07-28-2026_140723:Um, and they're maybe only looking for CISO gigs.

20:12yonesy_2_07-28-2026_170723:let's, let's, let's, let's, let's, double-click on that

20:14kris-rides_2_07-28-2026_140723:Yeah.

20:14yonesy_2_07-28-2026_170723:I, you know, I've got, some friends in this space as well, so let's double-click on that. I think, uh, you know, sometimes we tend to, like, fall in love with, uh, destinations. Like, we get, we get, ah, destination CISO, destination X, you know? And it's like the journey is really what's important.

20:36kris-rides_2_07-28-2026_140723:Yeah

20:36yonesy_2_07-28-2026_170723:So know that at each destination, each destination is but the beginning of the next journey, right? And not to get too philosophical here, but I think that's how you have to see it in anything that happens in your life, whether that's getting to your CISO opportunity, et cetera I feel that you have to look at d- a destination as the beginning of the next journey. And I can tell you that, you know, I've had, peers, friends, that have been in, part of those conversations that you just mentioned, uh, and they've almost lost their identity because their identity was being a CISO.

21:11yonesy_2_07-28-2026_170723:And I'm like,"Man," like, your identity is you as the practitioner. So if, if you're falling down that path or moving down that path, make sure that, part of your optimizing yourself as an operator is, uh, that's the beginning of the journey, of your next journey. So, just get complacent because you have the CISO role. and you being in the space that you're in, you, you know exactly how tenuous those roles are at the end of the day someone told me, this is, Robert Jordan, uh, rest in peace, uh, Wheel of Time.

21:48yonesy_2_07-28-2026_170723:Nice quote. I love this quote. "On the heights, the paths are paved with daggers." I gotta tell you, what is it? Game of Thrones too? Like, that throne is thorny, right? Like, it's, it's a bunch of, bunch of swords, right? So and this guy had the-- Robert Jordan had the crown of thorns. You put the crown on, and it's poking your head as you had th-this crown on, and you're walking these heights and all daggers. Like you're walking, literally gotta be careful of where you're stepping.

22:16yonesy_2_07-28-2026_170723:So know that, you know, highly contested chairs, there's only but so many of them. And this is all, by the way, I like to call them the broken cenots. you get to the top, man, there's no easy way down. All the roads down are all fraught with peril. So, just make sure that, you understand that it's, it's just the beginning of your next journey. And having done this six, six times a-already, I, I can tell you that that's how you just gotta start thinking about it.

22:46yonesy_2_07-28-2026_170723:You gotta start thinking about it in the fashion of, as an individual, are you being challenged? Are your teams, you know, are you creating an ecosystem, where you're engendering people to do better, to get better? And are all those things aligned? And, you know throughout my career, couple of years, I tend to look up and say, and take, an assessment, like,"Am I good?" You know? Like, is everybody good around me? Like, are we-- is this thing still it?

23:12yonesy_2_07-28-2026_170723:Is this what I signed up for? Am I still excited the work that I'm doing every day? if the answer is no, then I've gotta start figuring out what the next steps are gonna be. And that's something that's an individual thing, but companies are doing the same as well. Like, companies are also changing and making turns as they go down this journey, right? So I think you just need to have, the wherewithal to understand that, on this journey, you know, everybody's got a stop.

23:38yonesy_2_07-28-2026_170723:Uh, everyone's got, everyone has a destination. yours at? And are you planning, planning accordingly? And I think the fast changes that we're having today, where the human is becoming more of the product, you need to be more than your title. You need to be more than your current destination. So one of the things I would implore is, you know, continue to invest in yourself in your journey, just this destination where you are right

24:08kris-rides_2_07-28-2026_140723:Yeah there are a lot of people, and you are definitely not one of them. Somebody that's been a six-time CISO that doesn't, like some people almost become the title, right? That becomes their whole identity and, and, and it's a shame because what got them there and genuinely the things that get them there, and then the things that tend to keep them there and retain their staff is n- not people following you because you have a CISO title. It's following you because you inspire them.

24:36kris-rides_2_07-28-2026_140723:It's following you because they know you help them get the job done, and that they trust you. And there's all these different elements that make that, and it is unfortunate that some people in our industry get that CISO title, and now they start getting invited to all of these events and they you know, they show off,"I've got this, I've got that."

24:56yonesy_2_07-28-2026_170723:It's like getting merit badges. It's almost like I got a merit badge and here I am, just'cause I, I got the badge on, my ranks. Uh, and it's just like, that's not, that's not it. like to say,"That's not it, chief."

25:09kris-rides_2_07-28-2026_140723:Nope.

25:10yonesy_2_07-28-2026_170723:That's not it, chief

25:11kris-rides_2_07-28-2026_140723:Nope. And I, and, and I know people that are, I know people that are truly leading companies as a deputy CISO, where the CISO's really doing all of the strategic stuff and they're leading the people, they're leading the company. I know people that have gone from CISO to deputy CISO and had a pay rise and had more responsibility, and it be a bigger role in some companies, so, um, and I think anybody that knows our industry knows that. So I do think that people should talk more often about the fact that these jobs will, it will commonly involve a step to the side or a step back to move your career forward.

25:48kris-rides_2_07-28-2026_140723:Um, and we've spoken about with a f- a lot of the CISOs, very few of the CISOs I've had when we start digging into it, have had a normal, like just a normal career ladder that just goes up exactly, you know, the trajectory you'd expect. Very few of them. And and yet most people think that there is a typical traject- trajectory, um, instead of preparing themselves and, and being okay when the role you're in or the step you're making isn't the one you'd expect to be making right now.

26:17kris-rides_2_07-28-2026_140723:Doesn't mean you're not on the right journey

26:19yonesy_2_07-28-2026_170723:Yeah. and I think I wanna link this up to part one. We talked about how varied and how, much entropy there is in CISO roles and CISO responsibilities and, and CISO's job descriptions. So knowing that, right, it, it would... should let the practitioner CISO know that there's no one true and tried journey. Like, they're all gonna be different journeys, and if you're not assessing your specific situation in rel- in relation, in relativity to the ecosystem around you, then you're not doing yourself any good favors for continuing to propel your career, right?

27:01yonesy_2_07-28-2026_170723:So that for me is... I think it, it takes... This is probably one of the roles that requires the most constant updating analysis, self-analysis and awareness than any other role,'cause things are literally changing every day. There's something new. And with the, I like to call it how CISOs are being assailed today, things are changing overnight, and it's actually, uh, entropy has again, has increased. It has not let up. It's actually increased more.

27:35yonesy_2_07-28-2026_170723:So I think it's a, you know it's a time, where CISOs really need to do more of it, not less

27:41kris-rides_2_07-28-2026_140723:Yep. Yeah, 100%. And I actually think you mentioned consulting a little bit there. We've definitely seen an increase in, um, requirements around sort of fractional CISO work and other consulting contract work. We- we're-- That's an area where we've seen an increase over the last couple of years where there's been layoffs and, and that brings a whole lot of opportunities. There's a lot of opportunities to learn a lot, to work in other industries where you haven't before, and to maybe work across a few different clients and build a bunch of extra skills ready for that next big CISO gig, if you even choose to go in there.

28:16kris-rides_2_07-28-2026_140723:Some people become fractional CISOs and love that. They love the fact that they're helping several companies and get to have different challenges with different companies that are doing different things. So, there's so many different opportunities sort of out there. Um, you know, be open-minded, I guess,'cause there's a lot that can still mean you are on that right path to CISO and to where you wanna get. Just be prepared to sort of move around a bit.

28:40kris-rides_2_07-28-2026_140723:Now, couple of questions. Having been a six times, six-time CISO, what-- if you think about challenges, what challenges would you say people should be prepared for, or of, in hindsight, maybe you wish you were more prepared for, or things that you've noticed and you have been prepared, I guess, for them?

28:58yonesy_2_07-28-2026_170723:I think it's, uh, one of the main ones as, as you get more exposure to, clients, and boards of directors specifically, is that, th- they're not all-knowing, uh, in the sense of like there's a level of education you have to do, for them to understand what you're doing, what the estate looks like, and then map that back to their expectations. 'cause I think there's always this expectation of,"Well, the CISO's got it." and that's how things are running or that's how it's supposed to be working.

29:37yonesy_2_07-28-2026_170723:And sometimes you have to undo years, if not decades of, um, you know, opacity, uh, within the organization. And I think that is something that a lot of CISOs go in taking for granted, about the Reality of the debt, specifically technical debt equates to security debt and security And, and I think that would be the one that I would want CISOs to be really critical on. How and what does the board know and, how, how and what's their level of education, on what the debt is?

30:24yonesy_2_07-28-2026_170723:'cause I, I'm seeing a lot of conversations with NACD, with, uh, LACD as well, where, it's just... it's almost like,"Well, we didn't know this was like this," or,"We didn't know it was like that." And you see it, like, when all the breaches that are taking place, I was like,"Well, it seems like based on the post partners, like, this is not anything new. It's been around for a while. These are risks that were accepted. how much of it did you know?" And, like, a lot of the times you l- you look at this, what's in the, in the public domain, you find that, uh, there was a lack of transparency, and that ends up t-turning become-- in turn becoming a CISO issue, that he or she may not know that they have.

31:06yonesy_2_07-28-2026_170723:So I would say, that would be kinda one of, one of the areas of, um... that I would be really keen on. Uh so some things that I ask when I go in for a, for a CISO role, I always talk about, like to see the last two years worth of external assessments, uh the company, for the group, and for the organization, that's taking place. If you're in a regulated industry, any matters requiring attention or, you know, consent orders or things of that nature.

31:40yonesy_2_07-28-2026_170723:Uh, not just in cyber, it's across the board,'cause everything touches cyber, so you

31:44kris-rides_2_07-28-2026_140723:Yeah

31:44yonesy_2_07-28-2026_170723:know, like, what exists out there. Uh, c-clearly if there have been any breaches or things of that nature so you can review the estate looks like. 'Cause otherwise, you, you start coming in and, you know, irrespective of what happened, responsibility, so you need to know, to figure that out. So that, I would say that, you know, through my experience, that's where I would be honing in and focusing on.

32:11kris-rides_2_07-28-2026_140723:Yes.

32:11yonesy_2_07-28-2026_170723:have? What do we have here? What is it? What did I actually sign up for? because it now becomes your problem.

32:18kris-rides_2_07-28-2026_140723:Yeah

32:19yonesy_2_07-28-2026_170723:Um, and i-i-irrespective of how we got here, it's yours, so you should understand what that looks

32:26kris-rides_2_07-28-2026_140723:It's tough to unwind it, isn't it, once you get to that point? I, I know recently, um, good friend of mine, CISO, that I, I have a lot of respect for, took a pretty big role, um, was very public about taking the role, excited, this is what they were gonna be doing, and then, uh a week later then put out,"Oh, actually, we've decided to

32:47yonesy_2_07-28-2026_170723:Th-th-that's our mutual

32:49kris-rides_2_07-28-2026_140723:Yeah

32:50yonesy_2_07-28-2026_170723:friend. of ours. Mm-hmm. Yeah, no, but, but that's probably, again, been around for a while, knows a thing or two about cyber, started asking the right questions, and was like,"Wait a minute." Again, I don't want- I don't know any details, but I can infer based on my own. Like, I've walked into CISO roles, and I'm lit- literally week one, I'm dealing with an incident

33:09kris-rides_2_07-28-2026_140723:Yeah

33:10yonesy_2_07-28-2026_170723:that happened, uh under the previous tenure, but it's now my incident,

33:13kris-rides_2_07-28-2026_140723:Yeah

33:14yonesy_2_07-28-2026_170723:you know? So, so that's why when I speak, uh, about this, I was actually going back in time, to these, uh, pleasant surprises. Because by the way, it's an opportunity for you to showcase your expertise on how you handle it. So I actually, I welcome those situations because it gives me an opportunity to kinda set the record straight, s-start with a clean slate. Well, a plate that's not so clean, you get to clean it

33:39kris-rides_2_07-28-2026_140723:Yeah

33:40yonesy_2_07-28-2026_170723:you know, so you can just kinda clear, the air, on what exists, and then you can move forward. Because what did they say? The hardest, the hardest step, it's not the first step. The hardest step is understanding what we need to do. In order to understand what we need to do, we gotta understand what the problems are and agree on what the problems are. Then you take the step. Then you take the first step to go address it. So for me, I actually welcome it because, listen, there's no better way to showcase your competence, and your ability than by doing it.

34:11yonesy_2_07-28-2026_170723:So I actually welcome these types of situations because, it gives you an opportunity to

34:16kris-rides_2_07-28-2026_140723:Yeah, 100%. And I think I like the one, I like the fact that you, like, you're asking those questions up front, right? So, and I, I think our mutual friend, I'm sure, was asking all of those questions as well, and I think it's brave to be able to say,"You know what? This isn't right," you know, a week in if you know that these things aren't... And, and I don't know the ins and outs, right? And, and, Mm-hmm. talking about that specific situation. But I think first off, asking all the questions so you know what to expect, and then when you get in there, if it's different from what you expect, making a decision whether,"Okay, it's different from what I expect.

34:52kris-rides_2_07-28-2026_140723:I can work with this," or,"It's different from what I expect and this isn't the right thing for me," and making that plug pulled quickly, right? 'Cause tenures, the tenures are tough, right? You know, people don't do this job for a long time, and so knowing whether it's right or not is important. So no, I love that. Um, mate, you're, you're, like, I lo- We're gonna end up with loads of great quotes out of this because you're so philos- philosophical.

35:17kris-rides_2_07-28-2026_140723:You have, you know, you have so much great stuff to say. But also, you're just such a positive person and, and so I love speaking to you, and I, I hope, I I really truly hope that, everybody else, I'm sure, is getting the same vibe, right, from this podcast. Um, I really appreciate you finding the time. And I know we, death and taxes, right? We ran a bit late because of death and taxes. So we, we, we, we're doing this on a different timescale than what we planned, and you were very flexible for that.

35:45kris-rides_2_07-28-2026_140723:So mate, thank you so much for doing this. I, I really appreciate it, from me and from my audience as well.

35:53yonesy_2_07-28-2026_170723:No, I, of course, you know, when we, we-- By the way, full disclosure, I met Kris for the first time last year when we went to, uh, as part of the delegation, Spanish delegation, uh, in, in León, in Spain. And, we were the US delegation from Seattle. We went over to Spain. We got to... We were hanging out for a few days together at this conference where the president of Spain showed up. A couple of our colleagues had presentations and we just, you know what happens when you travel together with folks.

36:25yonesy_2_07-28-2026_170723:It's almost like it speeds up relationships. You get close'cause you're dealing with travel, you're dealing with the time zone differences, language barriers. So you kinda, you create your tribe

36:35kris-rides_2_07-28-2026_140723:Yeah.

36:35yonesy_2_07-28-2026_170723:We had our tribe. We had our tribe

36:37kris-rides_2_07-28-2026_140723:Yeah

36:37yonesy_2_07-28-2026_170723:in our tribe, we had to take care of each other. Um, and there were a lot of, uh, like-minded spirits and souls during that trip. Which by the way, shout out to, to Mr. John Yo. Like, we gotta, we gotta, we gotta, give him a shout out'cause he was actually the mastermind that got us all

36:53kris-rides_2_07-28-2026_140723:Yeah, he did. Yeah

36:55yonesy_2_07-28-2026_170723:Uh, and the Cloud Security Alliance obviously. But it, it, it kinda resonates. And for me, you know, you've got a great followership. I love what you're doing with Root to CISO and I, and I think that again, giving back and helping others. If I can help others be successful, I mean, there's nothing that fills me with joy than to be, be able to help others. And part of that conversation we said we were gonna end on,"One more thing to do. Have to say goodbye everyone." Had to do my Donald impression.

37:24yonesy_2_07-28-2026_170723:Uh, I only bust that out, uh, when, uh, kids are involved. So we had a visitor earlier on,

37:30kris-rides_2_07-28-2026_140723:We did

37:31yonesy_2_07-28-2026_170723:uh, she was able to get, uh, my Donald impression, and then I found out that Kris also does a Donald impression, but he does like the angry

37:39kris-rides_2_07-28-2026_140723:Yeah, I can only do angry Donald.

37:40yonesy_2_07-28-2026_170723:So next time you see us, I am Happy Donald and Kris is

37:46kris-rides_2_07-28-2026_140723:Angry Donald. Well look, there we go. People learned something new about both of us. Um, hopefully not just the Donald Duck impressions. But mate, thank you so much. This has been so enjoyable and thank you everybody for, for listening. Please give me your feedback and reach out, connect with us. We, we're people that love connecting with people, so connect with us on LinkedIn. Um, subscribe and, and make sure you catch the other Root to CISO episodes.

38:10kris-rides_2_07-28-2026_140723:This is season three, so I've had some amazing guests on here. Been very, very lucky. And some really interesting people that have shared their time. And Yonesy, you're such a, such a great guy, so thank you, mate. I really appreciate it

38:24yonesy_2_07-28-2026_170723:See you next week

38:25kris-rides_2_07-28-2026_140723:See you all

38:26Speaker:thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.