CISOs at security vendors: how the role changes when your company sells security

What these four announcements cover

This guide rests on four hiring announcements: two about Chris Bates, one about Aman Sirohi and one about Andrew Rose. They come from SandboxAQ, Cyberhaven and SoSafe, and each was published by the company making the hire. None of them describes the CISO role at a company that only buys security. None compares the two kinds of company.

So this guide cannot say what a buy-side CISO does differently. It can report two things: what the vendor-side announcements put into the role, and what the career histories in them show about the route to the seat. Where a point would need a buy-side comparison, the guide says the documents are silent.

Announcements are written by the hiring company. They state what the company wants to say about a hire, not how the job turned out.

The vendor role faces the customer

SandboxAQ announced on May 1, 2024 that it had appointed Chris Bates as its CISO. is not the date here; the announcement's own dateline reads as follows.

The announcement says that, as the company's first CISO, Bates is responsible for protecting SandboxAQ's data, communications and intellectual property.

The same sentence adds a second duty. It says he will use his expertise in sales, product development, messaging and go-to-market strategies to help develop the company's AQtive Guard cryptography management platform.

A customer-facing duty appears in the announcement too. Marc Manzano, General Manager of SandboxAQ's Cybersecurity Group, is quoted saying that Bates will engage with CISO peers at customers that include global banks, government agencies and other large enterprises.

SoSafe's announcement points to a similar customer-facing role in Rose's past. It says he was Resident CISO at Proofpoint, where he helped customers enhance their security practices, built a community of CISOs and represented the brand externally.

The SoSafe announcement also ties the hire to the product's subject. It says Rose's decision to join was driven by the company's focus on the underestimated human factor in cyber security.

In these announcements, the executive's fit with the product area is part of the stated case for the hire. The documents do not say whether a buy-side announcement would frame a hire that way.

Scope that reaches into product and the business

The SandboxAQ announcement says Bates came from SentinelOne, where he was Chief Trust and Security Officer.

It describes that tenure of more than seven years in broad terms. It says he led and was accountable for business and technical functions relating to cybersecurity, GTM, product, SaaS operations, data, privacy and more.

The Cyberhaven announcement describes the same employer differently. It says Bates served at SentinelOne as part of the executive leadership team.

It also says he built and scaled security, IT, business application and data teams and integrated acquisitions.

Those lists reach well past a narrow security function. They name go-to-market, product, SaaS operations, IT and acquisitions. The documents do not say whether a CISO at a buy-side company would hold any of those functions, so the guide draws no comparison. What the sources show is that, for this one executive at one vendor, the written scope included product and business work.

Titles vary, and the sources do not explain why

The senior security title differs across the four announcements. SentinelOne used Chief Trust and Security Officer. SandboxAQ and Cyberhaven's second hire used CISO. Cyberhaven's first hire and SoSafe used CSO.

Cyberhaven announced Bates as its CSO on January 23, 2025.

Cyberhaven then announced Aman Sirohi as its CISO on August 19, 2025.

The documents do not say how the CSO and CISO roles divide work at Cyberhaven. They do not say whether either executive's role changed. This guide does not infer an answer.

The Sirohi announcement frames his job around the company's mission. It says he will advance Cyberhaven's mission to help organizations protect their most valuable data in an era of AI-driven transformation. Unlike the SandboxAQ announcement, it lists no duties for protecting the company's own data.

SoSafe announced Rose's appointment on February 7, 2024.

What the career histories say about the path to the seat

The three executives did not take one route, and the documents show only these three.

For Bates, the SandboxAQ announcement says that before SentinelOne he held technical leadership roles at companies across several industries. It names Nike, Fidelis Cybersecurity (General Dynamics), NuScale Power and ACS (Xerox).

The Cyberhaven announcement adds that at Nike he held a senior role and developed the first business operations processes for the CISO office.

It also says he developed integrated intelligence functions with agencies such as the NSA, FBI and CISA while at SentinelOne and Fidelis.

For Sirohi, the announcement says that over a career of more than twenty years he led security programs at People.ai, Guidewire and Ross Stores. The announcement does not say which of those employers sell security and which do not.

For Rose, the SoSafe announcement lists a different mix. It says he worked at Forrester Research, where he was Principal Analyst covering the awareness and culture change space.

It also says he has a record in the legal sector, with over a decade as CISO at two firms. Those two firms are named in the announcement as Clifford Chance LLP and Allen & Overy LLP.

Read together, the announcements show some vendor-side appointees with histories at other vendors and with earlier internal security roles. Bates's history includes SentinelOne and Fidelis. Rose's includes Proofpoint and Forrester. Sirohi's, as listed, includes People.ai and Guidewire. They also show appointees with long records in non-vendor sectors: Bates at Nike, Rose at law firms, Sirohi at Ross Stores.

What the documents leave open

Four announcements about three people cannot establish a pattern for vendor CISOs as a group. The sources give no count of such appointments and no hiring criteria. They report no results from any of these hires, and they say nothing about reporting lines, budgets, board access or how much time the role spends with customers.

The questions in the title remain only partly answered. The sources show that vendor-side announcements can write customer engagement, product development and go-to-market work into the security leader's remit. They show that executives arrive from buy-side and vendor-side employers alike. They do not show that a buy-side CISO lacks any of these duties. A profile on this site that wants to make that comparison would need a source describing the buy-side role directly.