CISOs in banking, insurance and fintech: how financial-services security leaders are appointed

What the documents cover

This guide reads four documents: a Citizens Financial Group release, a MetLife release, a Q2 Holdings release, and a Citi research page. The three releases announce a security leader at a bank, an insurer and a fintech provider. They are company announcements, so they show how each firm chose to describe its appointee. They do not show how the hiring decisions were made.

Citizens: a Chief Security Officer with a wide scope

The Citizens release is dated February 14, 2024. It says Brendan Goode will become Chief Security Officer effective April 29, 2024.

The release names the reporting line. It says that after taking the CSO role, Goode reports to the bank's CIO, who also heads enterprise technology and security.

It also describes this as a succession. The release says Goode replaces Holly Ridgeway, who retires.

Goode's most recent job was also a CSO job. The release says he came from Commonwealth Bank of Australia, where he held that title and ran the Group Security organization.

The release describes the scope of that job as broader than cyber alone. It says he brought four areas together.

Earlier roles at other banks carried different titles. The release says Goode was the CISO for UK & Ireland at Deutsche Bank. It also says that before the Commonwealth Bank role he was a Managing Director at Citigroup, overseeing information security, business continuity, operational resilience and emerging operational risks. It says that before his decade-plus in financial services, he was a member of the Senior Executive Service at the Department of Homeland Security.

The outgoing leader's path is listed too. The release says Ridgeway joined from Mandiant, was previously CISO at PNC Financial Services, and held senior roles at the FBI and the Department of Justice. The release does not state Ridgeway's title at Citizens. It says only that she was responsible for cybersecurity, physical security and business resilience.

The Citi page: a related name, with no title attached

A Citi Global Perspectives & Solutions article dated May 7, 2019, "Managing Cyber Risk with Human Intelligence," lists Brendan Goode among its many contributors. The page gives no job titles for any author, so it cannot confirm his role at the time. Its argument is that organizations should move to a proactive posture. The Citizens release, not this page, supplies Goode's Citigroup title.

MetLife: a CISO from large-bank security operations

MetLife's release is dated July 30, 2024. It announces two hires into its Global Technology and Operations organization.

The release describes Antilley's background as mostly at one bank. It adds that he created and led insider threat, application security and third-party assessment programs there.

His most recent title was CSO, not CISO. The release says he worked at NCR Atleos, where he was the Chief Security Officer. MetLife's title for him is Chief Information Security Officer.

The release also lists industry ties. It names partnerships with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the National Cyber-Forensics and Training Alliance (NCFTA). It says he will be based at the Global Technology Hub in Cary, North Carolina. The release does not say whom Antilley reports to.

Q2: a CISO announced alongside a risk chief

Q2's release is dated November 13, 2023. It announces three executives at once.

The release says Q2 provides digital banking and lending technology to financial institutions. So this is a security leader at a company that sells to banks, not at a bank. It says Q2 provides solutions to banks, credit unions, alternative finance companies and fintechs.

The release defines Bygum's remit in technical terms. It says she has more than 30 years of experience across application and product security, cyber defense, risk management, information governance, IT compliance and training.

Her listed background is outside banking. The release names her prior sectors. Banking is not on that list. The release also says she holds a Certified Business Continuity Professional designation and is a member of the National Technology Security Coalition.

Q2 keeps security and risk in separate roles with separate reporting lines. The release says Bygum reports to the president. It says the Chief Risk Officer role is newly created and combines enterprise risk management, regulatory compliance and internal audit. It says Williams reports to the Chief Financial Officer.

What the titles and backgrounds show

These readings are limited to what the three releases say.

• Titles vary, and the CSO title appears in both directions. Citizens uses CSO for its top security seat. MetLife and Q2 use CISO. Goode held both titles earlier in his career, and Antilley's most recent title before MetLife was CSO.
• Scope differs by title in these examples. Citizens describes a security organization that includes fraud, physical security and business resilience alongside cyber. Q2's release describes a CISO remit built around information protection, product and application security, and cyber defense. Risk and compliance sit with a separate Chief Risk Officer.
• Prior big-bank security experience appears in two of the three announcements. Citizens' release cites Citigroup and Deutsche Bank for Goode. MetLife's release cites Bank of America for Antilley. Citizens' release also cites PNC for Ridgeway.
• Government and law-enforcement service appears at Citizens. The release lists the Department of Homeland Security for Goode, and the FBI and Department of Justice for Ridgeway.
• Q2's CISO shows a different route. Her listed background is across several non-banking sectors, and the release stresses breadth of team leadership.
• Reporting lines differ. Citizens places the CSO under a CIO who also holds the security title. Q2 places the CISO under the president. MetLife's release is silent on the question.

What the documents do not say

None of the releases gives hiring criteria, search processes, compensation, board involvement or reasons for choosing a CSO or CISO title. The Citi page does not describe any appointment. Three announcements are a small sample, and they do not establish a general rule for finance. They do show the descriptions each firm chose to publish: past titles, past employers and reporting lines.