CISO reporting lines: what three appointment announcements say

The short answer from these documents

Only one of the three documents names the person the CISO reports to. Q2 Holdings' announcement of November 13, 2023 says its new CISO, Beth-Anne Bygum, is a member of the senior leadership team "reporting to the president." The MetLife and Deltek announcements, both dated July 30, 2024, place the CISO inside a larger organization but do not state a reporting line.

None of the three documents says the CISO reports to a CEO, CIO, CTO or CFO. This guide does not fill that gap. It covers what each document states, and where each is silent.

Q2 Holdings: reporting to the president

Q2 announced three appointments on November 13, 2023: a Chief Development Officer, a CISO and a Chief Risk Officer. The release states that Bygum is responsible for the company's global information protection, product and application security, enterprise IT security, cyber defense, and data protection strategy and services.

The release gives each of the three a stated reporting line, which allows a direct comparison:

• The Chief Development Officer, Himagiri Mukkamala, is described as a member of Q2's executive leadership team, reporting to the president.
• The CISO reports to the president, as quoted above.
• The Chief Risk Officer, Blair Williams, is described as a member of Q2's senior leadership team, reporting to the Chief Financial Officer.

In this one company, then, the security seat and the risk seat report to different executives. The release describes the risk role as newly created, and says it brings together enterprise risk management, regulatory compliance and internal audit. Cyber defense and data protection are listed in the CISO's scope, not in the risk officer's. The release does not explain why the two roles report to different people.

The release also names Matt Flake as Q2's CEO. A later headline in the same Business Wire page, dated October 28, 2026, states that Flake continues as President and Chairman of the Board alongside a new Co-CEO. That headline does not say anything about the CISO's current reporting line. It does show that the president's title and the CEO's name sit with the same person in that later item, which the 2023 release does not state.

MetLife: inside Global Technology and Operations

MetLife's release of July 30, 2024 says the company added two leaders to its Global Technology and Operations organization: a Chief Data and Analytics Officer and a Chief Information Security Officer. It names Dan Antilley as the CISO.

The release gives the CISO's background: more than 30 years in the technology industry, mostly at Bank of America, where he led Cybersecurity Operations, Cyber Forensics and the Incident Response Program. His most recent job was Chief Security Officer at NCR Atleos.

The only executive quoted is Bill Pappas, titled MetLife Head of Global Technology and Operations. The release does not say Antilley reports to Pappas. What it does say is that the CISO joins the Global Technology and Operations organization. A reader can note that placement, but the document does not describe a direct line to any named officer.

Deltek: leading a Global Information Security team

Deltek's release of July 30, 2024 says the company appointed Becca Harness as Vice President and Chief Information Security Officer, leading the Global Information Security team.

Two details in the release bear on seat placement. First, the headline and opening describe both appointments as additions to Deltek's C-Level leadership team. Second, the CISO title is paired with a Vice President title, while the other appointee, Margo Martin, was promoted to Senior Vice President and Chief Customer Officer.

The release does not say whom Harness reports to. Bob Hughes, President and CEO, is quoted saying he looks forward to working with both appointees. A quote about working together is not a statement of a reporting line, and this guide does not treat it as one.

What the documents do and do not support

Taken together, the three announcements support these points:

• A company can state a CISO's reporting line in an appointment release. Q2 did, and it stated the lines of two other executives in the same release.
• A release can place the CISO in a function without naming a manager. MetLife placed the role in Global Technology and Operations. Deltek described a team the CISO leads.
• The CISO title can sit alongside other titles in a leadership group. Q2 calls the CISO a member of its senior leadership team, and Deltek lists the role among its C-level additions.

The documents do not support a count of how often CISOs report to each executive, and three releases cannot establish a pattern. They also do not include company leadership pages, so the question's second part, what leadership pages say, cannot be answered from this set. A reporting line for MetLife or Deltek would need a source that states it.