Deputy, then chief: how the number-two security job leads to the top seat

Among the 51 security leaders profiled on this site at launch, twelve reached the top security title either by holding a deputy post immediately beforehand or by being promoted inside the organization that already employed them. The two routes look similar on a résumé, yet the profiles show they work quite differently: one rewards staying put, the other treats the deputy title as a credential to carry elsewhere.

Six deputies, two of whom stayed

Six of the twelve held a deputy title directly before the top job. Only two of them were promoted into the chair above the one they already occupied.

Andy Ritter is the clearest case of the in-place route. Pennsylvania made him deputy CISO in January 2024, moved him into the interim job the following October, and named him permanent CISO in February 2026. The interim step matters: it gave the Commonwealth a trial period before the permanent announcement, which GovTech reported as part of a batch of acting titles converted to permanent ones.

Connie Devine followed the same ladder at Phillips 66, where the deputy CISO became CISO effective June 1, 2026. Her earlier employers, Excelerate Energy, ExxonMobil and Honeywell, keep her whole recorded career inside energy and industry.

The other four deputies all changed employer to get the top title. Iain Mulholland went from deputy CISO at Google Cloud to chief information security officer at Salesforce, a move SecurityWeek logged in the week of February 9, 2026. John Walton held the deputy post at Electronic Arts before Nubank announced him as CISO on June 8, 2026. Justin Henkel rose at OneTrust from running its CISO Center of Excellence to deputy CISO over nearly five years, then took the top job at SolarWinds in June 2026. Chris Jones moved from the deputy CISO role at Cisco to a newly created chief trust and security officer title at Axonius in September 2026.

What these four share is scale on the deputy side. Walton's Nubank announcement stresses the 16-plus years he spent at Microsoft, including a vice president of security engineering title, ahead of EA. Axonius described Jones's Cisco portfolio as covering Meraki and Catalyst products generating more than $10 billion in revenue. In each case the hiring company presented the deputy job as proof of having run security for something very large, which is a different pitch from the in-place promotions, where the argument is continuity.

Promoted from within, without a deputy title

Six more leaders reached the top seat inside their own organization or corporate family. For five of them the profiles show no deputy title immediately before; the sixth, CJ Moses, is a hybrid discussed below. Their tenures before promotion vary enormously.

At the short end is Gleb Reznik, who joined American Express in August 2024 as a senior vice president for technology risk and information security and was reported as its CISO in the week of March 16, 2026, roughly nineteen months later. His case is unusual because he had already held CISO titles at Chase, Synchrony and a Capital One division, so the internal promotion came on top of an outside record in the same job.

Rich Agostino joined Target in 2014 and was promoted to senior vice president and CISO in 2017, three years later, after helping launch the retailer's Cyber Fusion Center. David Raymond arrived at Virginia Tech in 2015 and held several posts, including founding director of the Virginia Cyber Range and interim CIO, before the university made him associate vice president and CISO effective July 1, 2026; its CIO described the new title as formalizing responsibilities he already carried.

At the long end sits Jerry R. Geisler III, whom Team8 described in 2023 as having more than 30 years of experience at Walmart while leading its security team. CJ Moses sits between the two groups: he arrived at AWS in December 2007 already titled deputy CISO and vice president of security engineering, and later became CISO, though no source we found dates that step. Leslie Kershaw moved within one corporate family, from the IonQ Capella subsidiary to the parent company's newly expanded CISO post in January 2026.

What the pattern suggests, and what it cannot

Read together, the twelve profiles suggest that a deputy title travels well while an internal track record mostly pays off where it was earned. Four of six deputies used the title to move. Among the internal promotions that can be dated, the time spent at the employer beforehand ran from roughly nineteen months, in Reznik's case, to more than three decades in Geisler's.

The limits are real. Twelve careers is a small sample, drawn from people whose appointments were public enough to be sourced, and several profiles cannot date key steps. A company that promotes quietly, or a deputy who never reaches the top title, leaves no announcement for us to cite. The pattern describes the people we can document, not every route into the job.