Buyer to vendor: what changes when a CISO joins a security vendor

What the four announcements cover

This guide draws on four company announcements about security leaders who joined vendors. GitLab announced Chaim Mazal as CISO on June 9, 2026. Entrust announced Adam Dimopoulos as CISO on May 13, 2026. Cyberhaven announced Chris Bates as Chief Security Officer on January 23, 2025. SoSafe announced Andrew Rose as Chief Security Officer in a release with a Cologne dateline of February 7, 2024.

These are company press releases, not interviews or studies. Everything below is what the companies and the executives say about themselves. The documents do not describe an average enterprise CISO role, so the contrast in this guide comes from what each announcement says the vendor role includes.

Two jobs in one seat: the company and the product

The clearest difference in the documents is scope. GitLab's announcement says Mazal "leads GitLab s global security organization, overseeing the security of GitLab as a company and as a platform." The announcement therefore puts internal security and product security under one leader.

Entrust describes the same pairing in terms of customers. Its announcement says Dimopoulos will be responsible for "strengthening the company’s security posture and resilience to help ensure customers can rely on Entrust to protect critical systems and data." In this wording, the CISO's work is tied to whether customers can depend on the vendor.

Entrust's Chief Operating Officer, Anudeep Parhar, makes a similar point. He says Dimopoulos's "proven leadership in identity security and risk management will help ensure our customers can rely on Entrust to protect their most critical systems and data."

Customers, product teams and the outside world

SoSafe's announcement shows how far a vendor security role can reach beyond the company's own network. It says Rose "will focus on driving SoSafe’s vision to strengthen digital selfdefence worldwide and help customers transform their security culture." The role as described faces customers directly.

The same release describes Rose's earlier vendor-side job as Resident CISO at Proofpoint. It says he "helped customers enhance their security practices, cultivated a community of CISOs and represented the brand externally." That is a public-facing function, and the announcement lists it as part of his background.

Cyberhaven's CEO, Howard Ting, frames the Chief Security Officer's value in terms of company growth. He says Bates "has a proven track record of building and scaling security strategies for hypergrowth companies." The announcement says Bates built and scaled "security, IT, business application, and data teams" at SentinelOne and integrated acquisitions. Those duties go beyond a narrow security remit.

What former buyers bring

Two announcements put the buyer's experience at the center of the hire. GitLab's says Mazal "was a GitLab customer for more than eight years and joined the company s advisory board to help shape product direction." GitLab's CEO, Bill Staples, says that "Having spent years as a GitLab customer, Chaim understands the GitLab platform the way builders do."

Entrust's announcement uses the phrase "builder-and-buyer." Dimopoulos says he has seen identity security from both sides, "helping build products and platforms, as well as being accountable for the outcomes as a global security leader." His buyer-side credential, per the release, is a role as Vice President of Information Security at Synchrony, where he "led enterprise-wide identity security and Zero Trust transformations."

The GitLab release also lists outside roles. It says Mazal is "serving on the advisory boards of Cloudflare, Rapid7, Axonius, and Bugcrowd." The announcement presents these as evidence of his standing in the security community.

Practitioner method is another thing the announcements credit. GitLab says Mazal's approach "prioritizes designing defenses around how attacks are actually constructed and embedding security directly into engineering workflows." The release ties this to the company's product, which is built for software engineering teams.

What people with vendor, analyst or government ties bring

Not every hire in these documents came straight from a buyer seat. Dimopoulos's release says he "has also held leadership and advisory roles at Microsoft and Gartner, where he partnered with organizations to advance security products, strategy, and execution at scale."

Bates came from another vendor. Cyberhaven's announcement says he joins from SentinelOne, "where he served as part of the executive leadership team, helping grow the company from a Series B startup to the largest cybersecurity IPO in history." It also lists enterprise work, saying he developed "the first business operations processes for the CISO office" at Nike. The release adds that he built intelligence functions with agencies including the NSA, FBI and CISA.

Rose's background mixes enterprise and industry-analyst work. SoSafe says he spent over a decade as CISO at two law firms. It also says he was a Principal Analyst at Forrester Research, where he "developed influential models for the security awareness industry."

The SoSafe release states that Rose brings "hands-on experience, knowledge, and perspective in managing risk and improving cyber security posture across complex enterprises." Here the vendor describes enterprise experience as something the CISO carries into the product and customer conversation.

Why the vendor's own product shapes the role

In two announcements, the vendor's market shapes how the CISO's mission is described. GitLab's release quotes Mazal on AI. He says AI-driven attacks are "compressing exploitation timelines, while agents expose teams to risks they aren t equipped to govern yet."

SoSafe's release ties Rose's decision to join to the vendor's subject, the human factor. Rose is quoted: "There is a huge imbalance in focus as the biggest part of security budgets are dedicated to security technology while according to the World Economic Forum, 95% of cyber threats have a human element involved."

What the documents do not show

The four releases are announcements from the hiring companies. They do not give reporting lines, budgets, pay, or how the roles are evaluated. They do not say how much time a vendor CISO spends with customers compared with internal work. They also include no accounts from the executives about what was harder or easier after the move.

The sources support three points. The documents describe the vendor seat as covering both the company and the product or customers it serves. They present buyer-side experience, including time as a customer, as a credential. And they list vendor, analyst and government-agency work as other things these leaders carry into the role.