Career profile
Michael Mestrovich
Chief Information Security Officer, Rubrik
- Current role, per sources checked 2 November 2026
- 25 May 2022
Michael Mestrovich is the Chief Information Security Officer of Rubrik, appointed in May 2022.
Career path
Before entering government service, Mestrovich was a systems engineer at Cisco Systems and served in the U.S. Air Force.
He went on to serve as Chief Information Security Officer of the Central Intelligence Agency, where he led the Agency's cyber defense operations, developed and implemented cyber security regulations and standards, and directed the evaluation and engineering of cyber technologies.
A Dark Reading author biography describes him as the CIA's former acting CISO.
While at the CIA, he also served on a rotational detail as Principal Deputy Chief Information Officer for the U.S. Department of State, where he was responsible for managing the Department's $2.6 billion, 2,500-person global IT enterprise.
Rubrik announced his appointment as the company's CISO on May 25, 2022, saying he would lead its internal data security efforts and provide cyber security and cyber policy expertise.
On joining, Mestrovich said, "With increased vulnerabilities in existing infrastructure and legacy security solutions, organizations' most critical asset - data - is more vulnerable than ever,"
adding that he had chosen to return to the private sector to work on data security.
Remit and public commentary
At Rubrik, Mestrovich's role centers on the company's internal data security program alongside external cyber security and policy expertise for customers. He has contributed authored commentary through Dark Reading, including the piece What Cybersecurity Chiefs Need From Their CEOs, published March 4, 2024. He has also written on artificial intelligence risk for insurers, in a piece titled As AI Risks Grow, Insurers Split on Covering the Damage, published October 22, 2026. In May 2023, he took part in an on-demand program titled Hackers Don't Back Down, So You Need to Back Up: Data Security's Hardest Truths, discussing findings that about 93 percent of surveyed external organizations reported malicious actors attempting to impact data backups.
