CISO job changes in practice: short stints, boomerang returns and lateral moves

What these documents can and cannot tell you about tenure

The question is how long CISOs stay before moving on. The four documents here cannot answer it as a statistic. They are company announcements of individual appointments, and none of them reports an average or median tenure, a survey, or a turnover rate. A guide that quoted a "typical" number would be inventing one.

What the documents do give is dated, attributed examples of four job changes:

• a long tenure followed by two moves in under nine months
• a return to a former employer
• a company's first CISO hire, made twice

Each section below says what the announcement states and where it is silent.

A long stay, then two announcements in under nine months: Chris Bates

SandboxAQ's announcement is dated May 1, 2024. The company's announcement says it appointed Chris Bates as Chief Information Security Officer.

The announcement says he came from SentinelOne, where his title was Chief Trust and Security Officer. It also gives the length of that stay:

A second announcement, from Cyberhaven, is dated January 23, 2025. Cyberhaven says it appointed Chris Bates as its Chief Security Officer.

The two dated announcements are less than nine months apart. That is the only timing fact the documents support. They do not say when Bates left SandboxAQ or how long he held the seat there. They give no reason for the move, and they do not say whether his SandboxAQ role ended. The Cyberhaven release does not mention SandboxAQ at all. It describes him as a "Former SentinelOne security leader" and says he joins from SentinelOne. The two releases leave SandboxAQ out or in depending on the company, and a profile should record that gap and not fill it.

Taken together, the documents show a seven-year-plus tenure at one company, followed by two announced appointments at two different employers within a short span. Whether the second was a quick exit or something else is not stated.

Titles and scope can change between employers

The same person appears under three different titles across the documents. SentinelOne: Chief Trust and Security Officer. SandboxAQ: CISO. Cyberhaven: Chief Security Officer.

The responsibilities as described also differ. SandboxAQ's announcement says that as the company's first CISO, Bates is responsible for . The announcement adds that his work would include help developing the company's AQtive Guard platform, drawing on his sales and product experience.

Cyberhaven's release describes the role differently. It says the company named him to oversee its security strategy, and it credits him with more than two decades of experience.

For anyone building a career profile, the lesson from the documents is narrow. A title match between employers is not guaranteed, and the announcements describe scope in the employer's own terms.

A return to a former employer: Attila at GoTo

GoTo's announcement is dated July 18, 2023. It describes a return to a former employer. The text reads: The surname is garbled in the source text, so this guide uses his first name only.

By the dates GoTo gives, his first stint ran from 2014 to 2019, which is about five years. The company's announcement says that stint was under the company's earlier name, LogMeIn, and that he built the security function. It then names where he went:

So the documents place him at a different employer between the 2019 departure and the announcement dated July 18, 2023. They do not give the exact date he left Zapier or the exact date he returned, and they do not say how long he stayed at Zapier. They also do not say why he left or came back.

The return is to a larger title than the one the announcement attributes to him at Zapier: Head of Security at Zapier, CISO at GoTo. The announcement says his new role covers internal systems and products.

GoTo's Chief Technology Officer is quoted welcoming him back. The release ties the return to his earlier build of the security function and to his experience in cloud and product security. It does not say anyone at GoTo asked him to come back or that he asked to.

A first-CISO hire from a long career: Christopher Burger at Slalom

Slalom's announcement is dated April 15, 2024. It says the company named Burger as its first CISO.

SandboxAQ's announcement also calls Bates the company's first CISO, so two of the four documents describe an employer creating the seat for the first time. The documents say nothing about why either company had no CISO before.

Slalom's release describes a long career, not a list of short stints. It states: It names the companies where he led teams and deployed solutions. The release gives no start or end dates for those roles, so no tenure at any of them can be worked out from it.

Earlier roles feed the CISO seat

Two of the releases describe the path that led to the seat. SandboxAQ's says that before SentinelOne, Bates held technical leadership roles at several companies. Cyberhaven's names a senior role at Nike with a CISO-office link.

Neither release gives years for those roles, so tenure at each cannot be calculated.

What the evidence supports

• Tenure length: only one document gives a duration. It states Bates had a "more than seven-year tenure" at SentinelOne. Burger's 26 years is a career span, not time in one seat.
• Quick moves: the Bates announcements are dated May 1, 2024 and January 23, 2025. They show two appointments under nine months apart, but not the time spent in either seat.
• Returns: GoTo's announcement of July 18, 2023 shows a CISO coming back to an employer after a gap that began in 2019. It says what he did there before and where he went. It gives no reasons.
• Gaps in the record: none of the four documents states why anyone moved, what the departure terms were, or how tenure compares across the field.

A tenure figure for a profile would need a source that measures many CISOs. These documents do not, and the guide does not substitute for one.