What a deputy CISO does and how the role leads to the top security seat

What the two documents cover

This guide draws on two sources. The first is an AWS Security Blog profile of CJ Moses, published April 8, 2019. The second is the Commonwealth of Pennsylvania Office of Administration "About IT" page, which carries no date.

Neither document gives a general definition of a deputy CISO's job. Neither lays out a promotion process. What they give is two named people, their titles, and their own or their employer's descriptions of the work. The guide stays inside that material and says so where the documents are silent.

What CJ Moses says he owns

The AWS profile says the blog sat down with Moses to learn about his day-to-day as a cybersecurity executive. Moses gives his own title in the first answer.

The title joins a deputy role to an engineering line, and Moses describes the scope as wide. Asked about the hardest part of the job, he says:

He names that breadth as the main challenge.

He also points to what his organization has shipped. These are customer-facing security services, which fits the "Security Engineering" half of his title.

The profile does not list direct reports, budget, or a split of duties between Moses and the CISO. It does not say which decisions he makes and which go to the CISO. What it shows is a deputy whose own account of his work runs from facilities audits to product engineering.

Moses's path, as far as the profile shows it

The profile gives the start of the path, not the steps to the deputy title. Moses says he came to AWS from the FBI with two colleagues, one of whom was the CISO at the time of the interview.

The three began with a specific project. Moses also dates the result.

The profile does not say when Moses became deputy CISO. It does not say what he held in between, and it does not say he later became CISO. The question asks about his path to the top seat, and this document does not answer it. In April 2019 the profile names Schmidt as the CISO and Moses as the deputy. Nothing more can be said from this source.

How Pennsylvania lays out its technology and security leadership

The Pennsylvania page describes a state IT organization with several senior roles. It says the Office for Information Technology covers security among other services.

The page names the roles above and beside the CISO. The CIO sits over the whole organization.

The page also lists a Chief Technology Officer who runs an office that includes security operations.

The CISO is a separate listing. The page says Andy Ritter holds the post and describes the job this way.

The page does not draw an org chart. It does not say who reports to whom, so the reporting lines are not stated.

Andy Ritter: deputy CISO first, CISO now

The Pennsylvania page documents a deputy-to-CISO move directly. Ritter's biography says he held the deputy role before his current one.

This is the closest the documents come to saying what a deputy owns. In the page's wording, the deputy work was carrying out the statewide strategy, working with agency executives, and coordinating across the enterprise. The CISO work is described as leading statewide initiatives. Those are the page's descriptions of two jobs held by one person. The page does not set them out as a formal division of duties.

The page also summarizes what Ritter brought to the post. The page does not say which of these he did as deputy and which came earlier. It gives no date for his move to CISO.

What the same page shows about the CISO job and a different route

The page lists a second person tied to the CISO seat, James Sipe. His current title is Executive Deputy CIO, a deputy to the CIO rather than a deputy CISO.

Before that, he held the CISO post. The page gives no date for Ritter's start as CISO. It does not say how Ritter's and Sipe's tenures relate, so this guide does not state an order.

Sipe's biography also gives the page's fullest list of what a state CISO is responsible for. That list is useful as a reference for the scope a deputy might share or cover. The page does not say which items a deputy takes on.

His new role is described in terms that overlap with security. The page does not explain the reason for the move, and this guide does not guess at one.

Sipe's biography also names an outside employer. The page places that work at Amazon Web Services. The Pennsylvania page does not connect his career to Moses, and the AWS profile does not mention Sipe.

What the documents support, and what they leave open

Taken together, the two documents support these points:

• A deputy CISO can hold a broad scope. Moses describes his own as running from auditing physical security at data centers to hypervisor choices for new services.
• A deputy can also be tied to execution. Pennsylvania's page describes its former deputy CISO as implementing the statewide strategy and partnering with agency executives.
• One documented route to the top security seat exists in these sources. Pennsylvania's Ritter served as Deputy CISO and now serves as CISO.
• A CISO's route does not have to end at the CISO seat. Pennsylvania's Sipe moved from CISO to Executive Deputy CIO, according to the page.

The documents do not answer these questions:

• How Moses became deputy CISO, and whether he moved up from there.
• Which duties the deputy holds and which the CISO keeps, at either organization.
• How long a deputy typically serves before a CISO appointment.
• What skills or credentials a promotion board looks for.

Any claim on those points would need another source.