The Convergence of CIO & CISO Roles

0:00:01.6 Max Havey: Hello and welcome to another edition of Security Visionaries, a podcast all about the world of cyber data and tech infrastructure, bringing together experts from around the world and across domains. I'm your host, max Havey, and today we're talking about the roles of CIO and CISOs with our guest, Jadee Hanson, CISO At Vanta. Jadee, welcome to the show.

0:00:21.2 Jadee Hanson: Thanks for having me.

0:00:22.4 Max Havey: So to get things started here, can you share a little bit about your career background? I know you've worked for a number of companies and done a lot of different security leadership roles over the years. Can you give us a little bit of a background here?

0:00:31.8 Jadee Hanson: You bet. Yeah. I got into cyber pretty young. I actually started doing cyber work at my high school, believe it or not, worked for the technology coordinator at my high school. We did all sorts of different things for the school. He had me putting together computers in order to save money for our school district, which was sort of like my entry into the world of tech and the world of cyber. I started my career at Deloitte doing pen testing, security audit work, and this is when I moved into my first management role. I then moved over to Target Corporation where I decided to be part of every function of the cyber team there. When I finally decided I didn't want to travel that much anymore and move into more of a startup role, I moved over to Code 42. At Target I got an intro into the startup world because I did a lot of due diligence for some of the companies that Target Corp bought.

0:01:35.0 Jadee Hanson: We actually purchased a few small Silicon Valley based tech companies when I was at Target. And so got a little bit of a intro into the startup world that way and really enjoyed the culture of the startup world, how fast paced it moved and decided to join Code 42 and was at Convery two in the CIO CISO role for about eight years and then recently moved over to Vanta. And Vanta we're also a security software company and we're really building a product that changes how people think about the governance risk and compliance section of a security program.

0:02:18.6 Max Havey: Absolutely. So I know in your past role you talked about having both sort of a CIO and a CISO role. Can you tell us a bit about what it was like navigating that sort of dual role operating on both sort of the technology and the security side of things? I know they can often be opposing forces, so can you tell us a little bit about how that functioned?

0:02:34.7 Jadee Hanson: Yeah, I think many of the listeners probably know that CIOs are sort of like always pushing new technology investments while the CISO role is cautiously bringing up risks with new technologies. And so my running joke was that holding both roles, I was able to have an internal argument with myself every day, but CIO roles and the CIO role that I held is really a strategic business leader role. And I think that is how my boss saw me while I was at Code 42 leading the security team. So while I was the CISO at code 42, I was reporting directly to our CEO and I had a chance to be part of many of the strategic business decisions being made. And I think my leader at the time saw me beyond a cyber leader and recognized that I had a strong business sense and that is what ultimately ended up getting me the CIO role. And I do think that the CIO role and the CISO role are more alike than they probably are different both c-level roles in an organization. And in that regard, both roles should be focused on having that strong business sense and the strong ability to evaluate risk to make sure that you're making the right technology decisions for the organization.

0:04:01.5 Max Havey: And so I think I maybe was a little bit leading in my question before, but so in taking on both of those roles then, did you run into that sort of opposing forces the way that technology teams are trying to optimize for performance a lot of the time or securities trying to make sure there are proper controls around it? Were you running into those sorts of issues as you were doing those two roles concurrently?

0:04:19.9 Jadee Hanson: Yeah, I mean I think it's trade-offs, it's 100% trade-offs and understanding and evaluating each technology decision from like a cost benefit analysis, risk outcome analysis to really make the best decision and having both roles report directly to me. I think that certainly helped bridge that gap at Code 42 and then as well at Vanta, I do have the IT teams reporting directly to me, and I think it's a model that a lot of CISOs in smaller companies have in place today that certainly I think works really well