Why CISOs leave consulting and big-tech security roles for startups and smaller firms

What the four announcements cover

Four company announcements describe CISO or CSO appointments at smaller or growth-stage firms. Cyberhaven announced Chris Bates as Chief Security Officer on January 23, 2025. Flock Safety announced Chris Castaldo as CISO, and its post carries a published date of December 8, 2025. Kai announced Alfredo Hickman as CISO on March 19, 2026. Bishop Fox announced its first CISO, Christie Terrill, on September 19, 2023.

The announcements are company statements. They give each executive's background, one or two quoted reasons, and a short description of the role. They do not give compensation, equity, or reporting detail beyond one line at Bishop Fox. That limits what can be said about motive, and this guide stays within what each document states.

The question assumes a move from large companies to startups and mid-size firms. The documents support that for some of the four and not for others. The sections below separate the cases.

Where each executive came from

Cyberhaven's announcement says Bates brings over two decades of experience across company sizes. It says he joins from SentinelOne, where he was part of the executive leadership team. It also says he held a senior role at Nike earlier in his career.

Kai's announcement says Hickman was CISO at Obsidian Security, where he helped build the security organization from day zero. Before that, the announcement says he led security product engineering at Rackspace Managed Security. His earlier path in the announcement includes government work and a consultancy he founded. So his move runs from one growth-stage company to another, not from a large firm.

Flock's announcement lists five earlier CISO roles for Castaldo. The announcement does not describe the size of those employers, so it cannot be read as a move down from a large company.

Bishop Fox is the one consulting background in the set. The announcement says Terrill spent 14 years at the company and held more than 20 years of experience overall. It adds that before Bishop Fox she held consulting roles at large-company clients. Her appointment is a promotion inside the firm, not a move from outside.

The size of the companies being joined

Only Cyberhaven's announcement gives a clear funding signal for the hiring company in its own words. It says the company raised Series C financing in 2024. Kai's announcement describes its funding and customer base.

Flock's announcement describes growth without a funding figure. The CEO's quote says the role is needed at a company growing quickly. Bishop Fox's announcement describes a company adding executive positions for the first time. The CEO's quote lists the CISO and CTO alongside a first CPO and CFOs.

The reasons the announcements state

Three of the four include a quote from the executive. The reasons differ.

Bates's quote in the Cyberhaven announcement points to timing in the industry and at the company. The CEO's quote about him focuses on experience with fast-growing firms.

Hickman's stated reason in the Kai announcement is about how AI should be applied to security work. Kai's CEO describes his decision as an endorsement of the company. Neither the quote nor the announcement mentions leaving a larger employer.

Castaldo's stated reason in the Flock announcement is the mission and the chance to build a program. The announcement also notes he wrote a book about embedding security in a company from founding to exit.

Bishop Fox's announcement gives no quote from Terrill. Its CEO's quote credits her prior work on operational strategy.

How the role scopes differ

Scope reads differently in each announcement.

At Kai, the announcement describes an inward-facing, hands-on role. Hickman oversees the security of the company's systems and data and strengthens customer trust as it scales. The announcement adds that he will operate the company's own product inside its environment to mature it.

At Flock, the announcement frames the role as strategy and governance across the organization.

At Cyberhaven, the subhead describes Bates's job as overseeing the company's security strategy. The announcement says his SentinelOne work included building teams across several functions.

At Bishop Fox, the announcement defines the role mainly by its position in the company and its compliance record. It says Terrill and the CTO report to the CEO. It says she was central to two major certifications, ISO/IEC 27001 Type 2 and SOC 2 Type 2. The announcement notes the company had reached SOC 2 Type 1 in February 2023. It also stresses a client-facing history.

What the announcements show for the question

Taken as a set, the four documents show three different paths: a move from a public security vendor to a Series C company (Bates), a move between growth-stage companies (Hickman), and an internal promotion from client delivery to the first CISO seat (Terrill). Castaldo's announcement shows a career of CISO posts at several firms and a stated pull toward the mission and the chance to build a program.

The stated reasons are about mission, timing, product direction, and building a program. None of the four announcements names a reason for leaving a large employer, such as pay, workload, or culture. Scope also splits by company type. The two vendor-side announcements, Kai and Cyberhaven, tie the security leader to the company's own product story. Flock describes strategy, risk, and governance. Bishop Fox describes a first CISO seat defined by certifications and a CEO reporting line.