Breaking Into Cybersecurity By Starting With What You Already Know | Root To CISO Podcast

0:00Speaker:Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

0:21kris-rides_1_07-29-2026_121508:Hi, everybody. Yes, welcome to season three of The Root To CISO podcast. I am very, very excited here. I've got AJ Debole with me. Thank you, AJ, for joining us

0:33aj_1_07-29-2026_151508:Thank you, Kris, for having me

0:34kris-rides_1_07-29-2026_121508:Um, now this is interesting'cause a lot of the guests I have on here I've known for years and years, and so I have some idea of their background. I usually learn a few new things about them when I'm doing it. But in this case, we met through Lynn Dome, who is the amazing executive director over at WCIS. Um, she connected us, so thank you, Lynn, if you're watching. Um, yeah, so, like I would love probably first of all we should talk about WCIS a little bit'cause I know you're involved with them.

1:03kris-rides_1_07-29-2026_121508:Um, and then we'll talk a bit about what you're doing currently. But, uh, but yeah, can you tell me a bit about your involvement with WCIS?

1:10aj_1_07-29-2026_151508:Sure. I actually just joined. Um, so I've only been to one of the executive forum meetings so far. Uh, but so far the, the programming is, is outstanding. They're talking about relevant things in the security industry and having substantial conversations about AI security, which I really appreciate'cause sometimes it can be hard to find meaningful substance with all of the noise out there, so

1:34kris-rides_1_07-29-2026_121508:Yeah. You're kind of... I, I, I totally understand. A lot of the conversations I'm, I'm having with, especially with leaders is like how much of this stuff is really scary stuff that I should be scared about, and how much is stuff that I don't even need to know about and it's, you know, been blown out of all proportion? So,

1:50aj_1_07-29-2026_151508:Yeah, the

1:51kris-rides_1_07-29-2026_121508:Yeah

1:51aj_1_07-29-2026_151508:thing about the group is there's a lot of practitioners there, so people are speaking from experience and things that they've done, which definitely reframes the perspective and makes it a lot more helpful and exciting to hear about what people have actually done rather than what they might do. 'Cause then you can learn about what works and what might not, and all of the gotchas and things like that, so it's really cool

2:10kris-rides_1_07-29-2026_121508:Yeah, I like that. I like that about our industry anyway, right? We're really lucky to have an industry where people do come together and they share a lot of information. And, Lynn was actually on, I've known Lynn for a few years now, but she was on my RSA panel a couple of years ago, and we connected a lot over that when we were planning and going through that stuff. And then it now seems like every conference we go to, we always bump into each other and don't arrange it.

2:33kris-rides_1_07-29-2026_121508:So we're like,"Oh, Lynn, how you doing? Kris, how you doing?" So she's amazing. Um, I actually, we were talking, we last bumped into each other and we were talking about the executive forum, and I was explaining that, um, for me, I've had a lot of guests on here, and, being a, a, a, a daddy to a daughter, uh, I know how important it is to see other women that have made inspirational moves and are doing great jobs as CISOs. At my, my company, Virtual CISO, Jenai Marinkovic, I've known for 12 years, so we've got a female virtual CISO, and I really wanted to have more, more, more female CISOs on the podcast.

3:10kris-rides_1_07-29-2026_121508:And I was saying that to Lynn, and Lynn was like,"We've got an amazing executive forum. Got some brilliant people on there. I'm gonna make some connections." And that's actually how me and AJ, have met. So, and I'm excited to learn all about your background and how you've got to this now. So again, thanks for joining us. Um, I guess briefly, like what is it you're currently doing?

3:31aj_1_07-29-2026_151508:Sure. I'm currently a field CISO at Oracle Cloud. Um, so working, we're customer facing, so we're working with a lot of our customers to help them rise to the occasion of this AI moment in terms of security and understanding how to implement, these AI systems and deployments securely, uh, particularly in Oracle Cloud or across multi-cloud estates for those big enterprises that are operating in, you know, across a variety of environments.

3:57kris-rides_1_07-29-2026_121508:Great. And and I find this quite interesting because it's only been the last few years we've seen this field CISO position sort of come about. And I, I, I, I've had people talk very positively about it. I've had people talk quite negatively about it and so I guess in some respects it might be controversial. Uh, it's not very con- controversial in terms of where I come from, because a lot of the great field CISOs I know are multi-time CISOs like yourself, right?

4:23kris-rides_1_07-29-2026_121508:And have been and sat in the, the seat itself and understand when they're connecting with other CISOs some of the trials and tribulations that they go through, right?

4:34aj_1_07-29-2026_151508:Absolutely. Yeah, and it's interesting you said that'cause I've met a lot of field CISOs and CTOs recently, and there's such a variety of experience levels and backgrounds. Some groups are under consulting or marketing or sales or engineering, so there's incredible variety, across the role depending on the organization and their requirements.

4:54kris-rides_1_07-29-2026_121508:Brilliant. Well, look, I think let's get-- I'm gonna take you way back. Okay? So, we're gonna go way back. So, um, not that way back. You look very young, so I don't know why I'm saying that. It sounded very rude of me. How dare me. But I wanna go take you back to college, because I, I think when we-- our audience is a real mix, so we have people from early stage practitioners, even people that are at college that are, are nowhere near becoming a CISO yet, right up to people that are currently CISOs or people that are trying to get their first CISO gig.

5:23kris-rides_1_07-29-2026_121508:And so when I like to go through all of this, I like to talk about, um, you know, people and how they started into the industry and what they studied at school even. So should we go back to, to sort of college times?

5:34aj_1_07-29-2026_151508:Sure. Um, I was a political science major, and you would not catch me near a computer. I like to be outside. I like to do outdoor activities, like to ride bikes, go sailing, go skiing. I probably couldn't send an email till, well into college. Um, and I just, I didn't see the appeal, I guess. I saw it as something standing in between me and going outside. So I majored in political science because I really enjoyed learning about history, especially the Cold War, and then, media and the rising role of social media in elections.

6:11aj_1_07-29-2026_151508:So I really enjoyed, um, learning about that. Took a lot of philosophy courses. I loved those. Um, so, definitely a liberal arts degree. I don't think I took any math or science in college. I th- I think I took, like, one statistics class. But that, that was really it

6:26kris-rides_1_07-29-2026_121508:And then how, what was your first job then coming out from there?

6:30aj_1_07-29-2026_151508:That's a great question. I could knock out one. So I, yeah, yeah, I was like, I was like,"Well, college is expensive. I wonder if I can find a way to get out in three years." And with the help of my parents, we figured it out. We cracked the code to save, you know, a year's worth of tuition. And I ca- and I had the privilege of graduating college in 2008, and there were not a lot of options. So that was a really bad time to be looking for a job. And in order to stay on my parents' health insurance, my mom was like,"Hey, why don't you go to law school?" Because my parents had gone to law school, and that's where they met.

7:03aj_1_07-29-2026_151508:so that's what I did. I lived at Mom and Dad's house, and I commuted to law school to try to, you know, grow up a little bit and maybe figure out, what to do and hopefully gain some knowledge and maturity in the process, which I needed a lot of both

7:18kris-rides_1_07-29-2026_121508:I, I think we all do at that age though, right? I, uh,

7:20aj_1_07-29-2026_151508:Yeah

7:21kris-rides_1_07-29-2026_121508:it's really funny to like see people coming out and they've done all this studying in a particular area, and what they've generally learnt over the four years, or maybe if they've got an internship, is they don't wanna actually do that job, or they don't wanna work in that industry. Um, and so, and so yeah, I think there's a lot to be said to be going back. And actually I think in the current climate, right, where it's really tough for a lot of the people that are coming out and, and, and graduating right now, I think there will be an awful lot of people in similar situations where they may be looking to go back to college.

7:49kris-rides_1_07-29-2026_121508:So you went and studied law with the plans to become a lawyer or what, what were you...

7:54aj_1_07-29-2026_151508:had no plan. I had no plan at all. I was excited, like maybe someday I would get a job doing anything anywhere. Like that, that was the dream. So, my future was not looking super bright. I wasn't, you know, I, I started law school young, and again, I wasn't very mature. So, I wasn't the best student, and I came out of law school, and it was tough to find a job at the time, um, in about 2011.

8:18kris-rides_1_07-29-2026_121508:Mm-hmm.

8:18aj_1_07-29-2026_151508:Was also very young, and a mentor at the time, you know, I... he was doing very well. He was an older person that I knew, and he was a very successful attorney, and I never asked him for a job'cause I felt kinda icky. But I did say like,"I live at my mom and dad's house, and I drive my mom's car. Like, how do you go from me to, like, you, a very successful person with a beautiful home and, like, a rewarding career? Like, how do I do that?" he gave me a pretty, like, harsh dose of reality that I really needed.

8:47aj_1_07-29-2026_151508:It was an act of kindness.

8:49kris-rides_1_07-29-2026_121508:Mm-hmm.

8:49aj_1_07-29-2026_151508:and he said,"You're, like, 22 or 23, and people hire an attorney to handle business or bankruptcy or divorces or real estate transactions, and they want people with not just legal experience but also life experience, somebody who they can depend on and understands what they might be going through, and that person is not a 22 or 23-year-old. So if you wanna figure out what to do, and how to make your way in the world, you gotta do something different." So, uh, that was really great advice, and it was kismet because that exact day, I remember I went home, and I was like,"I don't know what that means, but,""uh, like, I hope I get a job someday." And I went out, hanging out with my friends, my friends who were still local, and, one of my friends was like,"You'll never believe what I did today." And I was like,"What, what'd you do today?" And she's like,"I joined the Army." And I was like,"What?

9:45aj_1_07-29-2026_151508:Why would you, why would you join the Army? Like, what made you do that?" And she's like,"Well, I get to fix helicopters." That sounds different, doesn't it? So the next day, I went to the recruiting, office, and I was like,"How do I join the Army?" You know?

10:00kris-rides_1_07-29-2026_121508:I bet they were like,"I can't believe this. We've got somebody who's been through law school and, you know, all this background, understands bits about the Cold War. Great."

10:09aj_1_07-29-2026_151508:It, yeah, it was so, at, at first they were concerned. They're like,"Have you done any research about this?"'Cause they're like,"Oh, maybe you should be an officer." And I was like,"I don't know what that is." And, I remember the recruiter, he was probably so disappointed in me at first. Um, he, he was like, uh,"It means that, like, you, like you get paid a little bit more'cause you have a college education." And in that moment I realized you got paid in the Army, and that made the deal a lot sweeter for me.

10:35aj_1_07-29-2026_151508:So I didn't know. I didn't know. So I was like,"Oh, cool." You know? So I signed up for the Army Reserve, and after that year of initial training I had some job experience and some life experience, and I was fortunate to interview at a few local telecom companies and I got a few offers. And, I took one, and then the other ones I think some of my friends from law school took. So it felt really nice to finally get that full-time salary job that I had been dreaming about for, since 2008.

11:07aj_1_07-29-2026_151508:It took me till like 2013, but I got there eventually. Um, and then to be able to help my friends out, that, that was really cool. That

11:14kris-rides_1_07-29-2026_121508:It's nice. Um, well, I, I guess after all that hard work, you appreciate the opportunity more, right? I want to stop for a second'cause that's a, a little bit of a different start to a lot of the CISO conversations I have, and I think alternative paths are gonna be so important for the people that are coming through now. So, so you spent a year in the National Reserve. What were you doing there? What-- I mean, I, I, like, you know, you can probably tell I'm originally from the UK, so I've been over here a long time now.

11:42kris-rides_1_07-29-2026_121508:Um, but you know, even for me, I want to know what does that entail for a year? What do you do?

11:47aj_1_07-29-2026_151508:Well, when you start off, you do, basic training, and then I went to Federal Officer Candidacy School, OCS at Fort Benning, and then, you know, learned my job. I was-- I started off as a human resources officer. And I was in a unit that spent our two weeks every summer at West Point, helping train the cadets on all kinds of ranges, doing all kinds of things. So it was a really cool first role in the Army, and it was a lot of fun. Um, the unit had a lot of great people, and it was nice'cause I got to be outside, so you know, that's what I wanted.

12:17kris-rides_1_07-29-2026_121508:That's good. And did you have the opportunity to then sign up and stay longer or what was the, like, how does it work after that year sort of thing?

12:24aj_1_07-29-2026_151508:Yeah, so that's a good question. Um, I'm not sure how the active duty contracts work. I think they're like three-year contracts for active duty, and then it's like different, like if you're active or reserve and then if you're enlisted or officer. But the, the contract I signed was a six and two, so six years of active reserves and then you can do two years of inactive reserve. And then if you wanted to you could resign your commission and get out or you could, you know, return in some capacity.

12:46aj_1_07-29-2026_151508:Um, I'm not exactly sure. I never got to that point. I, I don't know if you get another contract or, or how that works out, but I'm sure there's a process for it.

12:54kris-rides_1_07-29-2026_121508:Yeah, I'm sure. There's process for everything, right? And, um, s-

12:57aj_1_07-29-2026_151508:yeah, absolutely.

12:58kris-rides_1_07-29-2026_121508:so then what was the first role when you left there, what was the first job you were in? And by the way, I, I'm, I'm assuming that you're still doing the reserves stuff as well, right? C- that continues.

13:07aj_1_07-29-2026_151508:I got

13:07kris-rides_1_07-29-2026_121508:Okay.

13:08aj_1_07-29-2026_151508:in 2020 or 2021,

13:10kris-rides_1_07-29-2026_121508:Okay.

13:10aj_1_07-29-2026_151508:around

13:11kris-rides_1_07-29-2026_121508:your first job you were still doing both, right? You're still having to-- You still have breaks and you go off and do the reserve stuff as well, right?

13:17aj_1_07-29-2026_151508:Exactly. Yep

13:18kris-rides_1_07-29-2026_121508:And so what was your first, what was your first actual job then, the first full-time one?

13:23aj_1_07-29-2026_151508:Yeah, I did site acquisition for a telecom company. So sending notices, to renew leases and, um, taking photos of various areas where they might wanna build a cell tower, handling local zoning hearings. So a variety of activities, mostly revolving a lot around land use and building permits.

13:43kris-rides_1_07-29-2026_121508:Great. And then how does that, how do you go from that into secure what was that path like?

13:50aj_1_07-29-2026_151508:Well it was a good job and, and I enjoyed it, and I worked with a lot of cool people that I learned a lot of good stuff from. But I was kind of looking at my income and my future career growth and what everything costs, including my student loan payments, and the math didn't look how I had envisioned it. Um, and so I'm like,"Well, gosh, I gotta figure out something different." So I mean, that, that's kind of the theme, I guess, isn't it? So I did what any rational adult would do.

14:21aj_1_07-29-2026_151508:Um, I didn't get an extra job or take in a roommate or anything like that. Instead I YOLO'd into cannabis stocks in about 2014. wish I was joking. I wish I was joking, but no, no, I really did that. I really did that. And, it worked out. And, and then I had a few months of my mortgage payment, and then I was like,"Okay, so now, like, now I have time for critical thought, and, you know, how am I gonna do a really good job at work and maybe become a project manager someday?

14:50aj_1_07-29-2026_151508:Um, how am I gonna maybe learn new things, get my project management certification?" Something like that. That's the path I wanted to go down'cause I had some supervisors that I definitely looked up to a bit. And, I don't know how I came across it, but somebody was like,"Oh, have you heard about Bitcoin?" So I, you know, I dabbled a little bit, and then over the years, I remember it was December of 2017. At the time, I had gotten a job through a friend at a state organization doing, you know, logistics and public procurement work.

15:19aj_1_07-29-2026_151508:And I was at my mom and dad's house for the Christmas holiday, and I opened up my Coinbase account, and there was a new asset that was added. 'Cause back in the day, Coinbase only had Bitcoin,

15:30kris-rides_1_07-29-2026_121508:Yeah

15:30aj_1_07-29-2026_151508:could only buy and sell. There was no lending. I mean, Bitcoin, I don't think you can stake it. Um, and Ethereum got added, and so I thought,"What is that?" So I looked it up, and it had all this stuff about smart contracting, and I'm like,"That's really cool. Like, I wonder how that works." And so I went downstairs, and I told my mom and dad, like,"Hey, there's this thing that exists now, and it can automate a lot of contracts using cryptography and computers, and that sounds really cool to me." And my mother just looked at me horrified.

16:03aj_1_07-29-2026_151508:she's like,"Your work is adjacent to contract law, so you're, like, awfully enthusiastic about something that is going to replace you. Like, do you think that's a smart idea?" And I was like,"No, but I'm gonna do it anyway." So

16:19kris-rides_1_07-29-2026_121508:'cause you got

16:20aj_1_07-29-2026_151508:Ethereum.

16:21kris-rides_1_07-29-2026_121508:your job and the investment, right? You're playing both sides.

16:25aj_1_07-29-2026_151508:I think investment is a generous term, for what I was doing in my 20s. Um, so yeah, I bought a bunch of Ethereum. I think it was, like,$8 a token, and I, I thought this... So back then, crypto was different. It attracted, people who were kind of alternative and very into, like, um, altruism. Um, kind of like the... Like, less formalized than the current effective altruism movement we're seeing in AI safety,

16:54kris-rides_1_07-29-2026_121508:Yeah

16:55aj_1_07-29-2026_151508:but people who just wanted to be... They wanted... They were a little cyberpunk, wanted to make the world a better place, help the little guy, that kind of thing. So that really drew me in, and I remember you were either a scammer or, like, a really good person, and there was nothing in between. I remember order to participate in, like, an ICO back then, I couldn't figure out how to sync the blockchain to my computer with my other wallet or something like that, and somebody who I hadn't even met yet was like,"Send me your, you know,$500, and I'll buy it for you." And I did.

17:23aj_1_07-29-2026_151508:I sent this person$500, and they bought the tokens for me and then sent them back minus the transaction fees. So it w- it was a different world back then. So

17:33kris-rides_1_07-29-2026_121508:It was a different era Yeah

17:33aj_1_07-29-2026_151508:I, I fell in love with the technology, and then, um, I, I just... I really loved learning about cryptography. And then I wanted to talk about it, at, with my Army friends on the weekends, and then one of my mentors said,"Hey, you seem to like computers a lot. There's a new cyber unit over in the Massachusetts Guard. Do you wanna go check them out?" So that's how I pivoted.

17:52kris-rides_1_07-29-2026_121508:Nice. That is such a random pivot and not one that I've ever come across, so that's amazing. Um, wow. Okay. And so that got you into cryptography and then into cyber. And so you, you were still, your day job was still not cyber, but the National Guard work was cyber-related, is that right?

18:10aj_1_07-29-2026_151508:Yes, I was able to join a cyber unit. It was really tough. It was, it was super tough. I think we had... We did, like, a Security+ bootcamp, and we had, like, one week to pass Security+. It was it was tough. But, um, yeah, I, I was super lucky. I'm guessing a lot of your interviewees probably have better contemplated, uh, more intentional, uh, avenues to the industry than I did

18:33kris-rides_1_07-29-2026_121508:Do, do you know what? The, the weird thing is they don't. And that, and that's the, that's the great thing about it is that like most of them, and I realized this quite early on, the, the, this is season three. In season one people were like,"So I didn't take the typical path." And I'm like most people start with,"I didn't take the typical path," which means there isn't really a typical path, and it's actually... I mean, this-- but having said that, they didn't take the, the National Guard YOLO into cannabis stocks and then getting into cry- getting into crypto way either.

19:03kris-rides_1_07-29-2026_121508:So there you go. This is a f- this is a first f- for me for sure. Um, the interesting thing is, very few. The most unusual thing I come across are people that have a very typical like ladder pro- process. You know, they're, they, they were very thoughtful. They went into the industry and they gradually worked their way up. The way that most people think, very few people ever actually have that happen to them. And there's actually some pros and cons when it does happen that way, right?

19:32kris-rides_1_07-29-2026_121508:Some cons you wouldn't think of, in terms of the missing out on opportunities and not learning about things that are related to business or related to life

19:41aj_1_07-29-2026_151508:Mm-hmm.

19:41kris-rides_1_07-29-2026_121508:because it's gone so easy for them, right? So

19:44aj_1_07-29-2026_151508:Yeah

19:45kris-rides_1_07-29-2026_121508:when things continually seem to go so easy, when there's a problem put in front of you, you often then have to learn and you're not used to, you don't do as well as some other people would do despite you maybe having quite a big title already at that stage. Um-

19:59aj_1_07-29-2026_151508:it's really interesting you said that'cause, it seems like a lot of the prevailing sentiment for people who wanna get into, um, InfoSec is to start off at help desk. to, to your point, I, I think that I have a smaller sample size in terms of how I understand people getting into the industry. I feel like you're the, you're the expert on that. But I have also found very few people that have worked their way up from the help desk. Um, not that it's, not that it's uncommon.

20:23aj_1_07-29-2026_151508:I mean, it's... I've worked with some awesome people in IT who have worked their way up from the help desk, and they're CIOs, and they're super squared away. But I guess it's interesting we have this dichotomy. We have so many people that didn't do it that way, and then so many people advising those who want to enter the industry to take that pathway. So I'm gonna have to think about that. That's really interesting.

20:45kris-rides_1_07-29-2026_121508:Yeah, it's a weird one'cause I think some of the best people and the greatest people have life experiences outside of the typical come through IT and go that way. I do think that help desk opens up doors and you're in IT, so you're closer to cyber, and maybe that's probably why it seems an easier... Plus, people hire more help desk people, right? There's a lot more of those people. I don't know what will happen as AI impacts those kind of jobs, right?

21:12kris-rides_1_07-29-2026_121508:It's all gonna be interesting. But I'm sure, you know, we'll probably end up talking a bit more about that, I would have thought. So, so, so what, um, so how, when did that cyber turn into a full-time job in cyber?

21:27aj_1_07-29-2026_151508:That's a good question. Um, so I did some... I started the Army, like, pipeline, getting ready to send in my packet to become a cyber officer. So I went to this program, it was Common Core Training, CCTC, and it was three months in Pittsburgh. And why- while I was in Pittsburgh, I was applying to jobs. It was like spray and pray. Just any job that looked like I could take it, I applied to it. So after that, I came home, and I went back to my regular day job, and two really interesting things happened.

21:56aj_1_07-29-2026_151508:Um, well, actually, one of them before I left Pittsburgh. I got a call back at the Commonwealth of Massachusetts for a deputy CISO role. And it was really interesting because I had applied to jobs that report into the deputy CISO, and I had never gotten even an interview. Um, and at this point, I did have experience, meaningful experience, in the Army, but nothing, not full-time, so I was at a disadvantage there,

22:20kris-rides_1_07-29-2026_121508:Yeah

22:20aj_1_07-29-2026_151508:of competing for jobs. So I was shocked that, I got an interview for the deputy CISO role. I also did not know what that meant, so I had to ask some of my classmates, and they're like,"Okay, you really need to prepare for this interview." And I, I did. I probably spent 40 hours preparing for my initial interview. Um, so I started going through that process, and then I got home and continued going through the multiple rounds of interviews. And then when I went back to my day job, there was something wrong with my computer, and so I reached out to the help desk.

22:52aj_1_07-29-2026_151508:they're like,"We don't think anything's wrong with your computer." So I had learned some commands and stuff. So I ran some commands, and I noticed some open ports that really shouldn't have been open. I noticed that I had administrator, and I wasn't supposed to have administrator. I knew that for a fact. Um, so I submitted a report to them, and I was like,"Please, like, send this to your security team." So then the security team called, like, my landline in my office, in my, well, my cubicle.

23:16aj_1_07-29-2026_151508:And so they're like,"Hey, can you come up here?" And so I was like,"Okay, sure." So I, I went, and, I met their CISO. And he's like,"I did not expect a report about this. Um, you know, I'm looking to, uh..." It was a deputy director role. And he's like,"Like, are you interested?" And I was like,"Yeah, I am." So it was interesting because when I was getting that deputy CISO opportunity, I was also getting that opportunity where I was currently working.

23:42aj_1_07-29-2026_151508:So something that I had been so hard... Like, I had been trying so hard to get my first role doing anything, even as an analyst, for at least two years, um, before anybody gave me time of day. And then when it happened, it was for two leadership roles at once, so that f- that was very exciting for me. And then I, I finally felt like, for the first time in my adult career, I was really doing something that I had wanted to do.

24:09kris-rides_1_07-29-2026_121508:Wow. And what-- that, that's like so unusual to be like sort of fighting to get that sort of full-time opportunity. But obviously you had the commercial, the, the, the army sort of commercial sort of National Guard, uh, experience. But so what-- So I'm just trying... So, so what do you think it was that like, uh, you know, luck is preparation, right? Um, means timing or whatever. I literally did this quote the other day and screwed it up as well, but you know what I mean.

24:37kris-rides_1_07-29-2026_121508:Um, what were the things that, that made that suddenly happen? 'Cause what were you doing in the business at that point,

24:43aj_1_07-29-2026_151508:Um, I was like a deputy director of procurement and logistics. So it was, it was tech adjacent'cause we were

24:48kris-rides_1_07-29-2026_121508:Right

24:49aj_1_07-29-2026_151508:PeopleSoft and a lot of IT systems to handle, you know, inventory and, you know, accounts payable and receivable and stuff like that. Um

24:57kris-rides_1_07-29-2026_121508:And you were a leader. You had people reporting into you at that stage as well, right? At that level

25:01aj_1_07-29-2026_151508:Yeah. So for my civilian role and then, as, you know, the part-time officer in the Guard or Reserve. So

25:07kris-rides_1_07-29-2026_121508:Yeah.

25:07aj_1_07-29-2026_151508:Did have those things going for me. Um, for the deputy CISO role, I actually was not their first pick. They picked somebody who had previous, ISO or ISM experience from the Air Force, but, um, he was-- he had better offers, so he took one of those. So I think I-- he's the only one I know about. There might have been one or two people that they preferred over me. Um, but I was very happy to have gotten that opportunity, but I did not understand what it would turn into because it was in healthcare for HHS in the Commonwealth of Massachusetts in 2019, May of 2019.

25:42kris-rides_1_07-29-2026_121508:Okay. Wow. Yeah

25:44aj_1_07-29-2026_151508:I didn't know, uh, what future awaited me. I, I had no idea.

25:48kris-rides_1_07-29-2026_121508:S- so let's stop there. So you, and you end up with both those opportunities, and then you turned down the one within the business and went for the external deputy CISO one, yeah?

25:57aj_1_07-29-2026_151508:Yes

25:58kris-rides_1_07-29-2026_121508:was the, decision-making process sort of between those? 'Cause obviously you're already within that business, so you know that business quite well. What, what made you sort of take one over another?

26:08aj_1_07-29-2026_151508:One of them I could drive and they had parking, and that was very exciting for me. So it was going to be less... So I was commuting to Boston and I was taking the train, and it was two hours each way door to

26:19kris-rides_1_07-29-2026_121508:Oh, no. Yeah, yeah

26:20aj_1_07-29-2026_151508:this way it was only an hour and a half each way door to door, and I got to be in my car. So it, it felt nice to have my personal bubble a little bit, and to have that freedom to sort of come and go as I please. 'Cause it's one of those things if you like, if you leave five minutes late, you miss the train, and then you have to wait for the next hour. So I, I love trains. I do enjoy taking the train. Um, it's just that sometimes when it's, when it's raining or it's inclement weather or it's super hot, um, it's really nice to be in your own car.

26:50aj_1_07-29-2026_151508:And also just carrying stuff. Like, you know, I, I, I eat a lot, so I carry like a big lunch thing and I couldn't really do that working in Boston. But then with my car I could have like a cooler in there, like with all kinds of, with all kinds of good food. So I guess part of it was all the little things, and part of it is I understood that deputy CISO was like a really exciting opportunity for me. Um, and I wanted to, I wanted to give that a go.

27:13aj_1_07-29-2026_151508:I knew that it was a big risk. I knew it was a big job, but was ready to have a bigger impact

27:21kris-rides_1_07-29-2026_121508:It's, um, and it's funny because I would imagine, not only did things change rapidly being that it was 2019, but it probably changed-- the commuting thing changed quite a lot. And by the way, I should say I know this very well because I was running, Tiro. We we started my company in 2012, but I was working on a startup with a friend of mine, and we were launching a company. It's called Commute, and it was, focused on, you know, one of the things I'd realized over all of the years of looking at retaining staff and hiring staff, all those things go together.

27:54kris-rides_1_07-29-2026_121508:People were leaving because they were fed up of their commutes. They were fed up of the traffic. They were fed up of waiting around missing trains or trains being late and all of that sort of stuff. And so we put together this business and we built some software, and what we were doing was, we were putting together a piece of software that would give reports to companies that would highlight risks of people risk, of people leaving because of their commutes, how the companies could help them, um, what the companies could do to make these sort of things better.

28:24kris-rides_1_07-29-2026_121508:So that's what I was doing in 2019, and it was about to launch in March 2020. So big change for, for around that time. Um, and I'm sure hopefully everybody remembers that there was a massive pandemic. Um, and they're, they're now thinking what went on in 2019, um, 2020 even. But yeah

28:46aj_1_07-29-2026_151508:were building that tool,'cause on one hand it sounds like super cool from the employee perspective, but when you were like researching and thinking about building it, did you, were you optimistic that a lot of employers had a genuine interest in that data set?

29:02kris-rides_1_07-29-2026_121508:100%. We'd, um we'd already gone through and interviewed a whole bunch of chief people officers for, like, huge companies. And they were like, you know, at the time everyone's software as a service, they were like,"Great, we would like want it to link in with this." And like some of the bigger companies were putting on coaches and buses for for if they realized they had a lot of staff in certain areas, they could put on coach services for them so they didn't have to drive.

29:27kris-rides_1_07-29-2026_121508:They could have, like, Wi-Fi on them. And so, it was all these things, like we were always also looking at, like some of them would be able to almost like lobby or work with local government to make sure like bus stops were close or see where they were investing in transport, transportation. So there's so many different ways that this, this thing was gonna go. Um, and then everybody went remote because part of it was also the recommendation of, um, right, who like, you know, who do you, who's at risk?

29:57kris-rides_1_07-29-2026_121508:Like, and could they work remote? These are the days when the traffic's worse. Could they work remote those days or could they come in later? Could you be sort of more proactive in offering like opportunities for them to make their life easier to, to, and to continue them wanting to work where perhaps they might not, right? So yeah, it was sort of all around. But this is not the Root To CISO for Kris. But yeah, it was, th- that's what we were working on and it was, you know, it was interesting times.

30:25kris-rides_1_07-29-2026_121508:Um, I, I can't wait to hear how working for in, in healthcare, um, in, at this time is, is like, uh... Do you know what? I think this is probably the ideal time to stop part one actually, because I feel like this is gonna be, like this is gonna be an interesting thing to go into because I'm sure there were huge changes and the job that you accepted was very different to the one you were doing a few months later, right?

30:51aj_1_07-29-2026_151508:Absolutely, yes.

30:54kris-rides_1_07-29-2026_121508:Well look, thank you. Thanks everybody for joining us. That went so quick, by the way. W- we will be back next week with part two. Everybody here knows that we're just gonna continue recording it, so we will continue onto part two now, but you won't get to hear this until next week. So thank you for joining us for part one. Thank you AJ for sharing your journey so far, and I'm excited to, to connect onto the next part

31:17aj_1_07-29-2026_151508:Sounds good. Thank you so much

31:20Speaker:thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.