Bob Turner's path from UW-Madison CISO (2014) to Penn State CISO (2024)

Two announcements, ten years apart

Bob Turner's move from one university CISO role to another can be traced through two hiring announcements. The University of Wisconsin–Madison published the first on December 16, 2014. Penn State published the second on September 17, 2024. Read together, they show what each institution said it was hiring for and what Turner did between the two posts. Each announcement is written by the hiring university, so the comparison below rests on how each school chose to describe him at the time.

The 2014 hire at UW-Madison

The UW-Madison announcement says Turner came to the CISO role from the private sector, where he had already been doing similar work. It describes him as having been hired after serving for several years in a similar role as a cybersecurity consultant and compliance manager for a private firm.

The announcement defines the scope of the job in one line. It states that the post covered campus-wide security resources as well as the central IT division.

The university's chief information officer at the time, Bruce Maas, framed the hire around risk and compliance. In the announcement, Maas says Turner has a strong background in that work. Maas also tied the role to a reach beyond the single campus, saying Turner would help meet needs at UW–Madison and across the wider system.

The announcement describes Turner's stated priorities in cost and risk terms. It says he planned to focus on cost-effective approaches to protecting key data. It sets his start date as January 7, following the December 2014 announcement.

What sat between the two university jobs

The Penn State announcement fills in the career around the UW-Madison post. It looks back on his Wisconsin tenure in concrete terms, describing a campus-wide program spanning 34 divisions.

It then lists private-sector work, including a vendor role focused on schools and universities. Penn State describes him as having held a field CISO title for education at Fortinet, working with internal teams and with education customers. The announcement also names consulting work at Booz Allen Hamilton across several sectors.

At the time Penn State hired him, Turner held a role at a virtual CISO firm, according to the announcement. The Penn State announcement does not give dates for the Fortinet, Booz Allen Hamilton or Cyber Hero roles, so their order relative to the UW-Madison post cannot be fixed from these two documents alone.

Earlier in his career, Penn State says, he served in the military in both enlisted and officer ranks. On credentials, the announcement lists a bachelor's degree and a master's degree in information assurance from Capella University. It also notes a long-held security certification.

The 2024 hire at Penn State

Penn State says it filled the role through a national process, with a start date of September 23, 2024.

The announcement describes a scope that spans the whole institution. It says Turner would work across every unit, college and campus. It adds research security and regulatory compliance to that mandate.

The seat had an interim holder before Turner arrived. Penn State states that Kyle Crain had served as acting CISO for more than a year. The announcement says Crain would go back to his previous security architecture role rather than leave the team.

Two senior officials are quoted. David Horton, Penn State's vice president for Information Technology and chief information officer, and Sara Thorndike, senior vice president for Finance and Business/treasurer, both spoke to the hire.

Turner's own quoted aim at Penn State centers on culture. He says he wants security to feel approachable to the people he serves.

How the two job descriptions compare

Both announcements describe a role with institution-wide reach. UW-Madison described security resources campus-wide plus the central IT division in 2014. Penn State described a remit across all units, colleges and campuses in 2024.

The emphasis shifts between the two texts. The 2014 announcement leans on risk, compliance, cost and service availability. It says Turner and his staff would also work to keep systems available to the university's many user groups. The 2024 announcement adds research protection and regulatory frameworks, and Turner's own quote there links security to how systems are built.

How each school described his background also changed. In 2014, UW-Madison cited several years as a consultant and compliance manager at one private firm. In 2024, Penn State described him as having long experience in higher education leadership and board roles.

What the path shows

Based on these two documents, Turner's route between the two university CISO seats did not run straight from one campus to the next. The Penn State announcement places a vendor role focused on education, consulting work, and a virtual CISO firm in his background, and it lists the Cyber Hero role as his current one at the time of hire.

The documents also show that his prior university CISO post was treated as a central credential. Penn State's announcement names the UW-Madison role and gives it a measurable scope, the 34 campus divisions, while describing his private-sector positions as education-facing in the Fortinet case.

Finally, the Penn State hire shows how the seat was handled during the search. A nationwide search ran while an acting CISO held the role from June 2023, and that acting leader returned to his architecture post once Turner was named.