Alternative Security Leadership Roles

Emily Wearmouth [00:00:00] Hello and welcome to the Security Visionaries podcast. I am Emily Wearmouth and this week is my turn to be your host again. So I'm battling through a cold, which you may be able to hear because I'm really looking forward to this conversation. I'm joined today by two guests and I'm going to start by introducing them to see if you can guess what we're going to be talking about. So first up, Alex Clixby has been working as a fractional CIO since 2021 following a long career, which first saw him as a commissioned officer in the British Army and then led on to a range of full time I.T. leadership positions for Footsie 100 type organizations. Then he set up his own business and is now offering his services as a contractor. Welcome, Alex.

Alex Clixby [00:00:39] Hi. Good morning.

Emily Wearmouth [00:00:41] Ian Golding is an interim CIO, is an executive director and then a board advisor and an investor. I guess that's pretty much the definition of a portfolio career. And through his career as an interim, Ian has worked with a number of private equity backed firms across a whole load of industries, including sustainability, real estate. I might forget one here housing, telecoms. And he's also worked for a number of great British institutions, including the RNLI, lifeboats. For those of you not in the UK and the Natural History Museum. In these roles, he's been accountable for overseeing cybersecurity, among other things. So can you guess what we're going to be talking about today? We are going to be talking about alternatives to a full time CIO or CISO or tech leader. I'm going to be asking what is a fractional or interim CIO? I'm going to be asking, how does it work? What's good about it? And I might even coax them to tell me some of the downsides, too. So let's start with some definitions so that we all know what we're talking about. Alex, can you kick us off with a definition of a fractional CIO?

Alex Clixby [00:01:44] Yeah, sure. Emily. So a fractional CIO or indeed a fractional anything it just means part time ,it's a partial aside part time. So in this respect, it is somebody who works part time for an organization. As a as a CIO, it's a contract role. Generally, for myself, I work anything from from two to maybe eight or ten days per month for for each client, which, which is great because it means I can have a number of clients at any one time.

Emily Wearmouth [00:02:12] Yeah. And. And Ian what about an interim CIO? What's an interim?

Ian Golding [00:02:16] Yes, I probably fit the mold more of an interim. But yeah, know the difference between an interim and a fraction, I would say is that fraction is a brilliant way of getting CIO type thinking without having to bite the bullet and actually fund a full role. So it can be incredibly valuable to help an organization with that thought, leadership, planning and oversight, etc.. I think an interim role is probably more akin to like a full time role for a certain period of time. So therefore, it's not so easy to have other clients, although there might be not exec type engagements around that, which actually can be helpful in the interim role to make sure you're well grounded and connected to what's going on. But I think, yeah, an interim role will probably focus on solving a particular problem or maybe a cluster of problems where an organization just knows something can be better or different somehow. It just needs help to to turn a corner and walk through those changes. Yeah.

Emily Wearmouth [00:03:15] And what sort of size organizations would have an interim CIO role Ian?

Ian Golding [00:03:19] I think it probably suggests a certain size or certain critical mass of a a few hundred people or a certain level of revenues, because otherwise it's a very heavyweight role. I mean, you kind of, I would think, probably an interim CIO role. It becomes more important where there is more complexity in an organization and a more business units, more branches, more products and services, etc., more teams. So probably helping to achieve scale and be more clear about, you know, how to fund initiatives and products and services, etc.. Yeah. So I think I think probably sort of, you know, a level of a few hundred people and upwards, but it can be very varied and some of the engage was done will be helping these interim CIO type thinking to help smaller start ups to grow as well because it's a rich extra, isn't it?

Emily Wearmouth [00:04:06] Alex When you're working with your clients, do they tend to be a certain size within that? Do they tend to have anybody who is already responsible for technology?

Alex Clixby [00:04:17] Yeah. So I think generally small to medium businesses, most of my clients are anywhere between 50 and 500 staff. I think the point Ian made a minute or two ago about it generally is for companies who can't afford to have a full time CIO, whether that's a permanent CIO or whether it's an interim CIO. But [00:04:36]for companies who want the the strategic vision, the board advice, the technical horsepower and some some high level I.T. leadership but can't afford it or just just can't really justify it full time, that's where a fractional role comes in and I think is a very useful tool for these organizations. [17.9s]

Emily Wearmouth [00:04:57] A question for both of you. When these organizations are in. Engaging with you. What is it that makes them realize they need you? Are they aware of the problems that they need you to fix? Or is that a big part of your job of revealing the challenges to them?

Alex Clixby [00:05:10] Yeah, I think I think generally for me, it tends to be for businesses who know they've got a problem, they know something's wrong, but they're not quite sure how to put a finger on it. Or even if they do know how to fix it, they probably don't have the wherewithal to do so. I'm sorry, Emily, you asked me a question in the earlier question, and I didn't quite answer it because you asked whether these organizations tend to have an i.t person in already. Again, i tend to have a little bit of a mixture there. Some of the companies I work with do already have an i.t leader, maybe just a singleton post. Some actually have an i.t team. Generally not very large teams, some have nobody from IT at all and maybe just have a an external managed service provider. So I think it depends a little bit what they've got in there already. If they have got IT leadership in there, I think generally they have a better idea of what's wrong. They maybe just need help prioritizing that and a little bit more experience than they've got in how to fix it for a company. You have nobody in it then, then generally they haven't got a clue. They, they just, they just realize something's not quite working right. You know, it maybe it just doesn't seem very effective. It's not very efficient. Maybe they're paying a lot for IT and not not feeling they're getting a lot of return of investment. So I think that's just generally when someone like myself can come in and help to, to decide and advise.

Ian Golding [00:06:35] I think Alex would probably, we probably have people describe a lot of symptoms that they see don't they get you gave some of those you know another symptom might be in slightly larger organizations might be that it's hard for a head of IT or an IT director or CIO to stay in the organization for a while. And and it may be that it's not entirely the perfect fit for those that previous role or sometimes many roles that come and go. But actually the underlying problem is probably one of culture prioritization and what the organization itself decides it needs. So, you know, I think the experience that we can provide is I'm thinking that in going to the root cause can be quite hard because everyone has a complex areas of functional work to be focused on domain.

Emily Wearmouth [00:07:18] That's an interesting point around culture, how do you as an external pair of eyes really get in and make any different make changes to culture?

Ian Golding [00:07:29] For me, I would say the changes in the culture have to come from the people within the organization wanting that change. Therefore understanding that there are there is a different way or different ways. And the reason I say not just a different way, but there may be different options is I think is really important, like the listening that goes on to understand what's really going on from different perspectives so that people can actually think about what's going on and want something to change and see some benefits to them. And it can be a bit like lining up Swiss cheese. I'll be honest. Sometimes, you know, Swiss cheese and the holes to to line up where you're trying to find a path forwards. There is always a path forwards, I think is very important. It comes from the people in the organization themselves. Let's face it, Alex and I will be metaphorically here today, gone tomorrow. We're trying to help an organization turn a corner so that it can run itself in a way perhaps with a different sense of direction or different priorities. So I think, you know, that's that's the approach that I tend to use is by sort of studying what other people's perceptions are working with them, probably a strong elements of mentoring and coaching that goes into that as well.

Emily Wearmouth [00:08:41] Alex, do you have any thoughts? I love that Swiss cheese analogy, by the way. I've never heard it and I'm determined to use it this week. Any thoughts from you Alex?

Alex Clixby [00:08:47] I agree with everything Ian said. I think we're there as advisors. We're there to guide the business. We will often make a decision in our mind of where we need to go, but ultimately we're recommending the permanent members of staff, the senior management team, the board on the way to go. And really it's for them to accept t