Beyond CISSP and CISM: executive education and academic affiliations on the path to CISO

What the documents cover

This explainer draws on four documents. Two are biography pages hosted by a university security institute. One is a university alumni newsletter dated December 19, 2024. One is the public certificate-holder directory of a business school's executive education unit.

Together they show three kinds of credentials outside the usual security certifications:

• Graduate business and government-management programs, such as an MBA and a CIO certificate.
• Professional doctorates in information assurance.
• Fellowships and affiliations with policy and academic institutions.

They also show that a sitting CISO can sit inside an academic institution's orbit without any degree from it.

A government-and-business mix: Alicia Lynch

The fullest record in the set is the National Security Institute's profile of Alicia Lynch. The profile says she is Global CISO for TD SYNNEX and has more than 25 years of cyber experience across commercial, federal, defense and intelligence settings.

Her career began in uniform. According to the profile, she retired from the US Army as a Colonel in 2012 after serving as both an intelligence officer and a cyber officer.

The profile then lists earlier commercial roles, including CISO at SAIC and Deputy CISO at Accenture Federal Services.

Her academic credentials run along two tracks:

• Business school. The profile says she holds an MBA from the University of Maryland's Robert H. Smith School of Business.
• Government IT leadership. It also lists a CIO Program Certificate from the College of Information and Cyberspace at National Defense University.

The profile adds a policy fellowship. It describes her as a graduate Fellow of the Women's Global Leadership Program at the Center for Strategic and International Studies.

Only after these items does the profile mention her security certification. It says she also maintains the ISC2 CISSP.

The order is worth noticing. The business degree, the government CIO certificate and the policy fellowship come first, and the technical certification is presented as something she keeps current alongside them.

Professional doctorates: the University of Fairfax alumni

The University of Fairfax's Fall 2024 newsletter shows a different route: a practitioner doctorate in information assurance.

Its alumni spotlight features Dr. Christopher Carter. The newsletter says Carter was named chief information security officer at V2X after serving as a vice president at SAIC.

The newsletter does not name the degree Carter earned there. It lists him only as an alumnus and refers to him as Dr. Carter.

A second alumnus, Dr. Jorge Llano, is listed with the DIA designation. In his own words in the newsletter, he works as a chief security officer and also teaches at a technical college.

Llano's case pairs an executive security role with a teaching post. The doctorate there runs alongside practice rather than replacing it.

The same newsletter lists the university's doctoral programs offered online. These include business administration, information assurance and software development.

It also lists shorter graduate certificates in security practice.

The newsletter shows academic advisory work as another kind of affiliation. Among new faculty, it lists Dr. John Giordani, who holds a DIA and a CISA, as a member of a university cybersecurity advisory board.

Institute affiliation without a degree: Chris Castaldo

The National Security Institute's profile of Chris Castaldo shows a third pattern. It lists no degree, executive certificate or fellowship. It says he is CISO at Crossbeam.

The career it describes is built on operating roles. It says he built security organizations at several companies and worked at the National Security Agency.

The profile also points to authorship and advisory work. It names him as author of a book on building security into a company from founding to exit.

It says he mentors and coaches executives and board members on cybersecurity.

In his case, the academic link is the hosting institution itself. The institute describes its mission as finding practical answers to national security law and policy questions.

Being profiled by a law-school policy institute is a form of academic affiliation in its own right. It sits apart from any credential the person has earned.

The executive-certificate route: MIT Sloan

MIT Sloan Executive Education's directory shows how one business school structures non-degree credentials for working executives. It offers executive certificates in four tracks.

It also offers two advanced certificates, one of them focused on AI and digital business.

The formats range from on-demand online courses to two-week programs on campus.

The public certificate-holder directory showed 3,186 entries when it was captured.

Each entry gives only a name, an employer and a country. Several entries list security vendors or government security agencies as employers. Because no job titles appear, the directory cannot show which holders are CISOs.

What the records show side by side

Read together, the documents point to several patterns.

• Business and management credentials sit beside technical ones. Lynch's MBA, National Defense University CIO certificate and CSIS fellowship appear ahead of her CISSP. MIT's certificate tracks are organized around management, strategy, digital business and operations rather than security.
• Doctorates appear in practitioner form. The University of Fairfax names two CISO-level alumni and offers an information assurance doctorate. One of those alumni, Llano, combines executive security work with teaching.
• Shared employer history shows up across separate sources. Lynch's profile and Carter's newsletter entry both list senior roles at SAIC before their current CISO posts.
• Some affiliations involve no credential at all. Castaldo's institute profile rests on operating roles, a book, advisory board service and mentoring of executives and boards.

When reading a CISO's background, these records suggest three useful questions to ask:

1. Was the program a degree, a certificate or a fellowship?
2. Was it in business, government management or security?
3. Is the academic tie earned, or is it an affiliation through a profile, advisory board or teaching post?

The four documents give examples of each.