First-time CISO hires: what organizations say when they create the security seat

What the documents cover

This explainer rests on three documents. The first is a Bishop Fox press release distributed on GlobeNewswire and dated September 19, 2023. The second is Christie Terrill's author profile on the Bishop Fox site, which carries no date. The third is a Sequoia Consulting Group press release distributed on PR Newswire and dated January 18, 2023.

Only the Bishop Fox release says the CISO seat is new. The release describes the hire as the establishment of the company's first CISO. The Sequoia release announces a CISO appointment but never says whether the role is new, so it is a data point on how a CISO hire is announced, not on first-time creation. The profile page adds detail on how the Bishop Fox hire's career is described after the announcement.

Why the role was created, in the announcers' words

Neither company states a single reason for the CISO seat such as a regulatory trigger, an incident or a customer demand. What each says is framed as leadership growth.

Bishop Fox's CEO, Vinnie Liu, ties the new roles to wider change at the company. The release quotes him: . He then places the CISO next to other first-time executive seats: . In this telling, the CISO is one of several executive positions being added in the same period, not a response to a single event.

The release also describes a certification track that came before the appointment. It says The company had also reached an earlier milestone: The release presents the certification work as preceding the title. It does not say the certifications caused the role to be created.

Sequoia's framing is about clients and talent. CEO Greg Golub is quoted: . The CISO is one of three hires announced together, alongside a Chief Client Officer and a VP of Global Services and Solutions.

Backgrounds of the hires

Bishop Fox: an internal promotion. The release says Her most recent job was not in a security-operations seat. The release says . It adds that

Her earlier employers are named too:

The profile page fills in the path. It says 's enterprise security consulting practice and then serving in the sales organization. The page gives her tenure as . The release says 14 years and the profile says over 15. The two documents were published at different times, and the profile is undated, so this explainer does not reconcile them.

Sequoia: an external hire. The release says The release names no security certifications, degrees or years of experience for him, so the documents do not support any further statement about his credentials.

The two backgrounds differ in kind. One is a long-tenured insider whose experience is described through client delivery and consulting. The other is an outside hire described through his previous employers. Two announcements are too few to call this a pattern, and the documents do not claim one.

Mandates stated

Reporting line. Bishop Fox is the only document that states one: The Sequoia release gives no reporting line.

Scope of work. The Bishop Fox release does not list duties for the CISO in the announcement itself. It describes the CEO's view of her value as The later profile gives a clearer mandate. It says she as part of leading the company's internal security strategy and program. It also says . Across both Bishop Fox documents, the stated mandate ties internal security to client value and confidence.

Sequoia's scope is wider than security alone. The release says The CISO there owns IT as well as security. The release also sets out a direction for the program: The word "continue" appears in the release, but the release does not say what existed before him or whether he is the first person in the seat.

What the documents do not say

The documents leave several questions open, and a reader should not fill them in.

• No trigger is named. Neither release cites an incident, a customer requirement, a regulator, a board request or an insurance condition as the reason for the role.
• No budget or headcount is given. Neither release says how large the security team is or what the CISO controls financially.
• No board access is described. Bishop Fox gives a CEO reporting line, but neither document says whether the CISO presents to a board.
• No success measures appear. Neither release says how the CISO's results will be judged.
• Sequoia's first-time status is unknown. The release is silent on whether this is a new seat.

The Bishop Fox release also names the second hire. It says That is a CTO fact and not a CISO fact. It shows the company announced its CISO and CTO together as part of one leadership step.

What can be taken from the three documents

Within these sources, an announcement of a CISO hire is mostly a leadership announcement. The reasons given are organizational growth and client focus. The first-time CISO in the one clear case was an insider, and the release leads with her company tenure and her client-facing career. The mandates stated are a CEO reporting line at Bishop Fox, a program tied to client value there, and a combined security and IT remit at Sequoia.

Anyone building a profile of a first CISO from announcements alone will find the stated rationale thin. The release says what the person has done and who they report to. It rarely says what problem the seat was created to solve. For that, the documents here give no answer.