Skip to content
CISO Spotlights

Career profile

Mike Johnson

Chief Information Security Officer, Rivian

Status
Role as of 11 April 2023, the date of the latest source
Appointed
April 2023
Published

Compiled 12 October 2026 from public records. Each statement below is drawn from the sources listed at the end.

As of April 2023, Mike Johnson is the Chief Information Security Officer of Rivian, a role he joined that month.

Career path

Johnson's cybersecurity career spans more than 25 years, beginning with prototyping intrusion detection systems for battlefield networks.

He spent nine years at Salesforce in various roles, where his work was instrumental in building and growing the company's Detection and Response organization.

From Salesforce, Johnson became ride-sharing company Lyft's first Chief Information Security Officer, leading its cybersecurity efforts during a period of rapid growth.

Fastly named Johnson as its Chief Information Security Officer in 2019, where he focused on bolstering security alongside performance, scale and edge functionality as the company grew its edge computing offerings.

He served as Fastly's CISO for over three years, securing the network and platform of the edge cloud company, before joining Rivian as CISO in April 2023.

"As Rivian enters this new phase of its growth, ensuring the security of the owners' vehicles and data is critical," Johnson said on joining the company.

Board role and public commentary

Johnson serves on the Board of Directors for the Shadowserver Foundation, a non-profit that gathers and analyzes data on malicious internet activity.

He co-hosts the CISO Series podcast and has appeared as a guest on other industry podcasts.

During his time at Fastly, Johnson published commentary including Future security trends for 2022/2023, 30 Years of Web: Securing Tomorrow, and a jointly written piece with Kim Ogletree on business continuity during the invasion of Ukraine.

He has also written for Dark Reading, co-authoring a piece with Gavin Reid titled Headwinds Don't Have to Be a Drag on Your Security Effectiveness, published in February 2023.

Sources

  1. 1.
    Fastlyfastly.com · undated page · checked 12 October 2026 · tier A
  2. 2.
    CredSparksecuritymagazine.com · published 11 April 2023 · checked 12 October 2026 · tier B
  3. 3.
    Fastlyfastly.com · undated page · checked 12 October 2026 · tier A
  4. 4.
    Dark Readingdarkreading.com · undated page · checked 12 October 2026 · tier B
  5. 5.
    Rivianrivian.com · published 5 April 2023 · checked 12 October 2026 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.