Executive Vice President and Chief Security Officer: what the CSO title covers at three firms

What the documents say about the title

The question asks what an executive vice president and chief security officer title means in practice. The three announcements reviewed here use the shorter title, Chief Security Officer, and none of them attaches a formal rank to it. What they do show is how each organization defines the job: which risk areas sit under it, who the holder reports to, and what career the holder is said to bring. The three cases are Citizens Financial Group, Intesa Sanpaolo and Commvault. A fourth document, a 2019 Citi research article, adds context on how one of the Citizens appointee's former employers framed cyber risk.

Citizens Financial Group: a CSO below a technology and security head

Citizens announced its appointment on February 14, 2024. The company's announcement says Brendan Goode would take the Chief Security Officer role effective April 29, 2024.

On reporting line, the announcement says Goode will report to Michael Ruttledge, CIO and Head of Enterprise Technology & Security. So at Citizens the CSO sits inside a combined technology and security organization, not directly under the chief executive.

On scope, the announcement describes the outgoing CSO's remit. It says Holly Ridgeway has been responsible for cybersecurity, physical security, and business resilience. Goode will succeed her, and she will retire from Citizens at the end of June.

The announcement also describes Goode's previous CSO job. At Commonwealth Bank of Australia, it says, he brought cybersecurity, fraud, physical security, and business resilience together to combat and respond to growing cyber and financial threats. The bundle of functions is similar to Ridgeway's, with fraud named explicitly in his case.

Citizens: the backgrounds behind the title

The two Citizens leaders came from different places. Goode's earlier role at Citigroup, per the announcement, was as a Managing Director in New York City, where he oversaw information security, business continuity, operational resilience, and emerging operational risks. Before banking, the announcement says, he was a member of the Senior Executive Service at the Department of Homeland Security.

Ridgeway's path, the announcement says, ran through Mandiant, where she was Director of Information Security Programs. The same sentence says she earlier served as CISO for PNC Financial Services and held senior leadership roles with the FBI and Department of Justice.

Goode also appears in the Citi article. His name is on the author list of the May 7, 2019 Citi Global Perspectives and Solutions piece on managing cyber risk. That article argues that organizations need to move past a reactive posture. In its words, the increasing scale of cyber breaches means it is necessary to mature beyond a basic reactive defensive approach to an intelligence-led, proactive one. The article does not say what the Citi role of any author was, so it should not be read as a job description.

Intesa Sanpaolo: a new area reporting to the CEO

Intesa Sanpaolo's page, last updated October 17, 2024, describes a structural decision as well as a hire. The bank created a new Chief Security Officer governance area, reporting directly to CEO Carlo Messina and entrusted to General Antonio De Vita.

The page lists three responsibilities: physical security, IT security (cybersecurity) and business continuity. It also says the area will ensure a single point of control for security models and solutions, governance of the budget, and identification of priorities.

Messina's stated reason is about focus and money. He says the new area will let the bank ensure focus, investments, and resources in security, in all its complexity, with particular emphasis on technology. In this case, the title comes with budget governance and a direct line to the chief executive.

Intesa Sanpaolo: a background in command and operations

De Vita's biography is from the Carabinieri, not from a technology function. The page says his most recent position was Lieutenant General, responsible for overseeing the Carabinieri forces in Southern Italy. It adds that he led security efforts for the 2006 Winter Olympics in Turin.

His General Staff roles also touched management. The page says that as Deputy Chief of Staff he was responsible for legislative, administrative, and budget management for the Carabinieri. His listed education includes a law degree from the University of Cagliari and degrees in internal and external security sciences from the University of Tor Vergata, Rome.

Commvault: a CSO at a data protection vendor

Commvault announced its appointment on March 31, 2025. The company's announcement says Bill O'Connell joins with nearly 20 years of cybersecurity, risk, and data privacy experience, including prior leadership roles at Roche and ADP.

The announcement does not state a reporting line or a list of functions for the role. It describes the background instead. At ADP, it says, he held numerous security leadership positions, overseeing all application, software, and product security for the company globally. At Roche, it says, he led technical, operational, and strategic programs to protect critical data and infrastructure.

CEO Sanjay Mirchandani ties the appointment to specific skills. He cites Bill's vast experience in cyber, product security, data privacy, and incident response. The release also says O'Connell previously served as Chair of the National Cyber Security Alliance Board of Directors. Mirchandani adds that the company is welcoming him to the Commvault leadership team.

What the three descriptions have in common

Reading the three side by side, the documents differ on several points.

• Reporting line. Citizens places the CSO under the head of enterprise technology and security. Intesa Sanpaolo places it directly under the CEO. Commvault's announcement is silent on the point, though it places O'Connell on the leadership team.
• Scope. Citizens and Intesa both name physical security, cybersecurity and business continuity or resilience. Citizens' documents add fraud for Goode's prior role. Intesa adds budget governance and priority setting.
• Background. The holders come from a federal security service and banking, from a national police force, and from corporate security at a pharmaceutical firm and a payroll company. The announcements stress breadth of operational experience, in each case, over a single technical specialty.

None of the documents defines the title in a way that fixes its rank or duties across companies. The job is described by what the organization puts under it and who the holder answers to.