CISOs at Consulting and Professional-Services Firms: Four Announcements

What these four documents can and cannot show

The question is how the CISO job at a consulting or professional-services firm differs from the job at a typical corporate employer, when the same leader protects the firm and also supports clients. The four documents are company announcements of CISO appointments, from Guidehouse, Baker Tilly, Bishop Fox and Slalom. They are written by the firms themselves. They describe what each firm says the role covers and what each CISO did before. They do not describe a typical corporate CISO, and none of them compares the two jobs.

The only direct contrast with a conventional corporate role comes from one biography. Baker Tilly's release names the corporate employer its new CISO came from. Everything else below is each firm's own wording of the mandate, read side by side.

Guidehouse: one mandate covering the firm and client solutions

Guidehouse's announcement of Oct. 1, 2024 describes the mandate for Amy Howland in a single sentence that joins the firm's own systems and what it delivers to clients. The announcement says that as CISO she will lead enterprisewide cybersecurity initiatives to ensure the firm designs, builds and operates secure corporate environments and client solutions.

Chas Shaffer, Guidehouse's CIO, ties the work to client delivery in his quoted remarks. He says protecting the firm matters because of what the firm does for clients.

The announcement also gives Howland a task that faces outward to the business. It says she will work with business leaders on client needs, and the same sentence mentions regulatory requirements.

On background, the announcement says she started in audit and accounting before moving to security work at the same firm.

Baker Tilly: a reporting line through risk and legal

Baker Tilly's release says Amy Bogac's appointment took effect on Jan. 13, 2025.

The release names the reporting line. It places the CISO under the firm's legal and risk leadership rather than under technology leadership.

The release also links the CISO's work to clients. It says her leadership will support the trust clients place in how the firm delivers its services.

Baker Tilly's boilerplate describes a regulated professional structure. It states that one of its entities is a licensed CPA firm providing attest services, while the advisory entities are not licensed CPA firms. The release does not say how this structure affects the CISO's duties, so this guide does not either.

On background, the release names a corporate CISO job directly before this one. It says she held the top security seat at a textile group of many companies and sites.

Bishop Fox: a security firm whose CISO came from client delivery

Bishop Fox's announcement of Sept. 19, 2023 describes the firm's first CISO. It says Christie Terrill is a long-serving employee with deep security and technology services experience.

The announcement names her reporting line. It says the new CISO and the new CTO answer to the chief executive.

The firm credits her with the work that shows its own controls to outsiders. The announcement says she led the effort behind two industry certifications. It describes the SOC 2 Type 2 report as a way to give assurance about how the firm manages customer data.

Her client-side history is stated plainly. The announcement says she worked with clients throughout her time at the firm. It also says that before joining she held technology consulting roles at two large firms.

Slalom: the CISO role also points at the firm's services

Slalom's announcement of April 15, 2024 names Christopher Burger as its first CISO. It gives him two jobs: overseeing the company's own security team, and working with the company's experts on the security services it sells. The announcement says the aim of the second job is customer improvement.

Tony Rojas, Slalom's president, is quoted on how Burger works. He describes a culture of security that covers both the company and its customers.

Burger's own quoted remarks tie the firm's security work to its clients' concerns about AI and innovation. He says a particular protection matters to them.

On background, the announcement says he has run security operations for 26 years. It names the employers where he led teams and deployed secure solutions.

What the four profiles share, and where they differ

All four announcements put clients into the description of the CISO's job. Guidehouse connects the firm's security to client solutions and client missions. Baker Tilly connects it to client trust. Bishop Fox connects the CISO's history to client value. Slalom connects the role to the security posture of its customers. The documents do not claim that this is unusual, so this guide does not either. What the announcements show is that each firm chose to state the client link in the first description of the role.

The profiles also differ from each other. The Slalom announcement is the only one that gives the CISO a stated role in the security services the firm sells, alongside running the internal security team. The Guidehouse and Baker Tilly announcements are framed more around the firm's own environment and its delivery to clients. Reporting lines are stated in the Baker Tilly and Bishop Fox documents and not in the Guidehouse or Slalom documents. Career paths vary as well: audit and accounting, a corporate CISO post, client-facing consulting, and security operations at several companies.

Limits of this reading

These are four press announcements. They say what the firms intend and how they describe the appointment. They do not report incidents, budgets, authority over client-facing engagements, or how a CISO resolves a conflict between protecting the firm and answering to a client. They also do not say whether the same person is expected to sign off on client security questionnaires, appear in client meetings or advise client executives, beyond the general wording quoted above.

The documents do not support a ranking of the four firms or a claim about which structure works better. They also do not support a general rule for all consulting and professional-services firms. The firms differ in what they sell, from advisory and assurance to offensive security testing and technology consulting. What the documents do support is narrower. Each firm described its CISO's mandate in terms of both its own protection and its clients, and each pairs that with a background chosen to fit.