CISOs at investment firms and holding companies: how the role is shared across entities

What the sources cover and what they do not

The question has two parts. The first is what a CISO does when one person covers an investment firm and its portfolio or affiliated companies. The second is how that role compares with a fractional or interim CISO. The documents answer the first part only in thin outline. They do not address the second part at all.

Four documents were provided:

• A Business Wire release dated December 2, 2025, announcing Brian Blakley at Bellini Capital and ConnectSecure.
• The "About" page of Glilot Capital, which is undated.
• A PR Newswire release dated January 18, 2023, from Sequoia Consulting Group.
• Sequoia's leadership page, which is also undated.

A note on the last two. Sequoia here is not an investment firm. Its release says, "We help companies address their top people-related business challenges such as improving retention, attracting top talent, and increasing people-spend ROI." The two Sequoia documents are useful only as a contrast, a CISO inside one operating company.

None of the four documents uses the words "fractional" or "interim" for a CISO. This guide therefore does not claim to compare the two models on the evidence. The last sections list what the sources leave open.

Bellini Capital: one CISO for the firm and a portfolio company

The December 2, 2025 release is the closest match to the question. Bellini Capital describes itself in its announcement as "a Tampa Bay–based investment firm and innovation engine on a mission to secure America’s digital future." The release says the firm invests in "transformative technologies across cybersecurity, AI, and ecological preservation."

The announcement gives Blakley two roles. First, it says he is acting as the firm's CISO and "driving initiatives to improve cybersecurity talent and education industry-wide." Second, it says that "As part of his role within Bellini Capital’s portfolio, Blakley will also serve as CISO of ConnectSecure."

The two roles are described differently. The firm-level role, as written, is about workforce and education. The portfolio-company role is described in terms of the company's product and market.

The release describes the ConnectSecure work this way:

• It says he "will help develop ConnectSecure’s Managed Cybersecurity Service Model, which enables MSPs to deliver premium, scalable security offerings."
• It says he will "align technology, talent, and go-to-market strategy to help MSPs close the cybersecurity gap for small businesses."

ConnectSecure's own CEO is quoted on the same point. Peter Bellini says, "His leadership will advance our cybersecurity vision and empower service providers to be the front line of defense for SMBs."

ConnectSecure's scale is given in its boilerplate. The release says the company "is headquartered in Tampa, Florida and operates in 14 countries."

On Blakley's background, the release says he "brings more than 20 years of tested cybersecurity expertise, having led transformations across compliance, enterprise risk, and managed services."

Read plainly, the release describes a shared role in which the CISO title at a portfolio company sits inside a role at the investment firm. Much of the portfolio-company description concerns what ConnectSecure sells to MSPs, not how the company's own internal security program is run. The release does not say how his time is divided, who he reports to at each entity, or whether he is an employee of the firm, the portfolio company, or both.

Glilot Capital: a combined title at a venture firm

Glilot's "About" page lists a CISO inside the investment firm's own team. Under "Our team," it lists "Sarit Sharabi Chief Financial Officer" followed by "Amit Spitzer Chief Technology Officer & Chief Information Security Officer."

The page gives the title and nothing else. It says nothing about duties, reporting lines, or whether security work reaches any portfolio company. It does not say whether the CISO role was combined with the technology role on purpose or for a particular reason. Any reading beyond the title would be a guess.

The page does give a sense of the firm's size. It says the firm is "Celebrating 23 Exits, $500M Fundraise, Total $1.3B AUM." It also describes its people as "builders and cyber pros who've been in the trenches." That is the firm's self-description. It does not describe the CISO's scope.

Glilot's example is therefore a data point about titles, not about practice. In one investment firm, a single person holds the technology and security titles together.

The single-company contrast: Sequoia Consulting Group

The Sequoia documents show a CISO whose scope is one company. The January 18, 2023 release says Sequoia "announced the appointment of three top leaders," including "David Cook as the Chief Information Security Officer."

On scope, the release says, "As the Chief Information Security Officer, Cook is responsible for security and IT for Sequoia." The same release says Cook "will continue building a technology-rich security program based on investing in enterprise-class security features, an experienced and committed team, and continuous improvement."

The leadership page repeats the scope and adds a goal. It says "David’s goal is to build a technology-rich security program that will protect Sequoia and be a company differentiator."

The page also shows how security sits among neighbouring functions:

• The Chief Legal & Administrative Officer "works with team members in Legal, Talent, Human Resources, Security and IT, and Facilities."
• A separate VP of Global Security, Petros Rotsidis, is "responsible for overseeing the Security Program at Sequoia and supervising the IT function."

Both people appear on the page with overlapping descriptions. The page does not explain how the two roles divide the work, so this guide does not either.

Set beside Bellini, the contrast is about where the title applies. At Sequoia, the CISO's stated responsibility is security and IT for one company. At Bellini, the release attaches the title to the investment firm and to one portfolio company in the same announcement.

Fractional and interim CISOs: what the documents do not say

No document defines a fractional CISO or an interim CISO. None describes a contract, a part-time arrangement, a fixed term, or an outside provider. The Bellini release does not call Blakley fractional or interim, and the word "acting" in it describes his role at the firm and is not defined. Nothing here shows that the Bellini arrangement is either of those models, or that it is not.

So the comparison the question asks for cannot be drawn from these sources. What the sources do support is narrower:

• One executive can carry a CISO title at an investment firm and at a portfolio company at once (Bellini, December 2, 2025).
• One investment firm lists a combined technology and security title in its own team (Glilot, undated).
• A single operating company can state its CISO's scope as security and IT for that company alone (Sequoia, January 18, 2023).

What the sources leave open

For a profile of a shared-entity CISO, the following facts are not in any of the four documents:

• How the CISO's time or budget is divided across entities.
• Who the CISO reports to at the firm and at each portfolio company.
• Whether the portfolio company's internal security program is the CISO's responsibility, or only its security product and market strategy.
• Whether the arrangement is permanent, interim, or part-time.
• Who is accountable if the firm and the portfolio company disagree on security priorities.

The Bellini release is an announcement, not a job description. The Glilot page is a team listing. Neither says how the work is done day to day. A profile that wants to answer the question would need sources that state these points directly, such as an interview, an engagement letter, or a company statement of responsibilities.