CISOs announced in multi-executive releases: what four releases show

What this guide reads

This guide reads four company press releases in which a new CISO is announced alongside other hires. They come from Deltek, Q2 Holdings, GoTo and Jamf. Each release is the company's own account, so what follows describes how each company chose to present the appointment. It is not an outside assessment. Four releases are too few to say how companies in general behave, and the guide does not try to.

The question is what the shared release shows about the CISO's standing, background and mandate compared with the other appointees. The sections below take those three points in turn and then list what the releases leave out.

Standing: titles, levels and reporting lines

Titles are the clearest signal of standing in these releases, and they do not all point the same way. In its July 30, 2024 release, Deltek says it appointed its CISO as "Vice President and Chief Information Security Officer (CISO)." The same release says the Chief Customer Officer was promoted to a higher grade title, "Senior Vice President and Chief Customer Officer." At Deltek, then, the two "C-level" appointees carry different vice president grades.

Jamf's September 26, 2024 release shows a different pairing. Jamf announced a CISO and a second hire whose title is not a chief title: the release names that person Global Vice President of Channel and Alliances. Jamf's CEO nonetheless describes both hires as additions "to the Jamf leadership team." The CISO here is paired with a vice president, not with another chief officer.

Q2 is the only release of the four that states reporting lines. In its November 13, 2023 release, Q2 says its CISO is a member of the senior leadership team and reports to the president. The new Chief Risk Officer, by contrast, reports to the Chief Financial Officer. Within one release, two of the three appointees therefore sit under different executives.

GoTo's July 18, 2023 release frames the CISO appointment as part of a pair. Its headline says the company "invests in two key areas of the business people and security." The release does not give the CISO's reporting line.

Background: how each résumé is described

The releases describe CISOs mostly by years in security and by earlier security roles. Other appointees are described by years in their own function, and in two releases by long service inside the company.

Deltek's release shows the contrast most plainly. It says the Chief Customer Officer has been with Deltek more than 25 years, starting as a Senior Support Analyst. The CISO is an outside hire. The release says she has a 25-year career in information technology, with the past 12 years focused on information security and compliance.

Jamf's release describes a CISO with a CISO history. It says he comes from the CISO role at Afiniti and held CISO roles at several other organizations. The release also lists certifications held by the CISO, including CISSP, CISA and CISM. The other Jamf hire is described by his channel experience, not by certifications.

Q2's release describes its CISO through breadth of function. It says she has more than 30 years of experience directing teams across areas that include application and product security, cyber defense, risk management and IT compliance. The release lists sectors she worked in, but not a prior CISO title or employer.

GoTo's CISO is a return hire. The release says he built the company's security function in his first tenure, before leaving to serve as Zapier's Head of Security. GoTo's other appointee was an internal promotion, so both GoTo appointees have prior history with the company.

Mandate: what each CISO is asked to cover

The mandate language varies more than the titles do.

Q2 gives the longest list. Its release says the CISO is responsible for the company's global information protection, product and application security, enterprise IT security, cyber defense, and data protection strategy and services. The release says the Chief Risk Officer role is different in one respect: it is newly created and brings together enterprise risk management, regulatory compliance and internal audit. The Q2 release does not say the CISO role is new.

GoTo's release states a narrower scope for its CISO: security of internal systems and products, and safeguarding GoTo's information assets.

Jamf's mandate has an outward-facing part. The release says the CISO will focus on Jamf's information security vision and approach, and champion Jamf's security platform in the market. The release gives the second Jamf hire a separate mandate, in partner strategy.

Deltek's release says less about scope. It names the team the CISO leads, Global Information Security, and gives no list of responsibilities. The new CISO's quoted comment links security to customers, speaking of prioritizing "customer success and security across all of Deltek's solutions."

Who speaks about the CISO

The quotes in each release show whether the CISO is treated as one of a group or as a separate case.

Three releases quote the CEO about all the new hires together. At Deltek, the CEO says both appointees "bring impressive backgrounds in their respective areas." [[Both