CISOs who come from law enforcement, intelligence and government to corporate security

One appointment as the case study

The clearest example in these documents is a bank announcement. Citizens Financial Group's February 14, 2024 release says Brendan Goode will assume the role of Chief Security Officer, effective April 29, 2024. The release says he will succeed Holly Ridgeway, who will retire from Citizens at the end of June.

The government part of his résumé sits at the end of a long list of private-sector jobs. The release lists the corporate roles first and the federal service last, as the period that came before them.

How the announcement describes Goode's government years

The release gives the federal years one sentence. It says that before his decade-plus in financial services, Goode was a member of the Senior Executive Service at the Department of Homeland Security. The wording ties the role to a function a corporate security chief also needs: detection and response. It also notes that the work reached the private sector as well as federal civilian agencies.

The release describes the time gap this way: "Preceding his decade plus tenure in the financial services industry." So the federal post is not the job he moved directly from. Three corporate roles came between.

The corporate steps in between

The release names those steps. It says he was CISO for UK & Ireland at Deutsche Bank and global head of Information Security Operations. It then says he was a Managing Director at Citigroup in New York City, overseeing information security, business continuity, operational resilience and emerging operational risks.

His most recent post was at Commonwealth Bank of Australia, where, according to the release, he brought cybersecurity, fraud, physical security and business resilience together. That is the scope of a corporate security chief, and it is the part of the résumé the release describes most fully.

What the hiring executive says he is hired for

The quote from Michael Ruttledge, CIO and Head of Enterprise Technology and Security, does not mention government. He calls Goode a security executive with "extensive experience and innovative insights in security, operational resilience, and fraud." The case for the hire rests on corporate-facing skills. The federal service is listed as background and is not the stated reason.

The release also says Goode will report to Ruttledge. That is a fact about where the role sits in the bank's structure. Nothing in the document says whether his government background influenced that arrangement.

The predecessor came from the FBI and Justice Department

The same release shows an earlier version of this path. It says Ridgeway joined Citizens from Mandiant, where she was Director of Information Security Programs. It adds that she was previously CISO at PNC Financial Services and held senior leadership roles with the FBI and Department of Justice.

The release calls her a "20 year-plus security industry-veteran" and says she has been with Citizens since 2017. The release puts the FBI and Justice Department roles at the end of her list too, behind the private-sector jobs. A consulting-firm post at Mandiant and a bank CISO post at PNC sit between government and the Citizens job. In both bios, then, government comes first in time and last on the page.

Inside the FBI: how a career agency describes its own people

An FBI podcast transcript shows how a government leader describes his own career. Jason Bilnoski, the FBI's deputy assistant director for cyber operations, says he has Eighteen-plus years going on 19 with the FBI. He says that wherever the FBI sent him, he kept returning to cyber.

He describes the mission in terms a corporate security leader would recognize as threat-facing: "we drive to impose the greatest cost possible on malicious cyber actors." The transcript does not describe a move into the corporate sector. What it shows is the daily work and vocabulary of the agency, set out in the speaker's own words.

Where government and corporate security now meet

The same transcript describes the private sector as a working partner of law enforcement. Bilnoski says that a few years ago the FBI saw industry as either victims or a source of reporting, and that this is no longer the case. He says industry is now an equal partner in the operational space. He adds that the FBI plans joint operations around what industry knows and what steps industry could take. For a security leader with a government background, this is the setting the documents describe: agencies and companies working on the same operations.

A 2019 Citi Global Perspectives article points the same way. It says the scale of cyber breaches means organizations must mature beyond a basic reactive defensive approach, to an intelligence-led, proactive one. The article, dated May 7, 2019, also quotes an FBI agent speaking at a conference about avoiding a massive loss because someone clicked on a "dancing kitty." Brendan Goode appears in the article's long author list. The article does not say how he came to be there or link the credit to his government service.

Paths that do not run through government

Not every corporate security leader in these documents has a government record. The FBI transcript introduces Amy Herzog as vice president and CISO at Amazon Web Services, and says she was appointed to that role in June 2025. It says that before Amazon she held executive and security engineering roles across startups and large enterprises. Herzog herself says she has a combined business and security background, and that she views attacker behavior through an economic lens.

An EY release from April 6, 2017 describes Chad Holmes, a principal who leads the firm's cybersecurity practice in cyber innovation, threat intelligence, strategy and alliances. That release does not mention government service either.

What the documents show together

Read side by side, the sources describe a common pattern in how these appointments are written. Federal, FBI or Justice Department service appears in the biography, and each biography also lists corporate steps, such as Deutsche Bank, Citigroup, PNC or Mandiant, before the current job. Both the Goode and Ridgeway descriptions use functional language like detection and response, or senior leadership, and not rank or title alone. The quoted executive, Ruttledge, credits security, operational resilience and fraud experience for the hire. Meanwhile, the FBI's own transcript shows an agency that now describes industry as an operational partner, which is the ground these leaders cross when they change sides.