Subscribe
Share
Share
Embed
Technology isn't built by companies. It's built by people.
Random Access Memories (RAM) is where technology gets personal. Host Jake Bernardes sits down with founders, CISOs, engineers, operators, investors, and community builders to explore the stories behind the products, the pivots, the failures, and the moments that shaped their careers.
Whether we're talking cybersecurity, AI, startups, leadership, or life outside the office, every conversation asks the same question:
What shaped the person behind the technology?
New episodes every week.
Presented by Hubscale.
Hello and welcome to another episode of Random Access Memories, Stories That Bite with me, Jake
Bernardes, and today I have with me Tim Chase, Field CISO at Orca.
Now what we spotted before, Tim, just lift up your shirt a little bit so you can see we
are both wearing football jerseys, but from very different football types.
I'm wearing an obscure Curaçao away jersey that will never be worn because they never got
far enough in the World Cup.
And Tim, what is yours?
University of Tennessee Volunteers.
There you go.
So between us we are sporting representation tonight and the World Cup actually only
finished on Sunday, so we're pretty well on brand at the moment.
Although the American football season has not started yet, right?
Getting ready to start in about a month.
Count down, man.
in between in that transition phase.
Interesting.
we recorded this at RSA and the audio went horribly wrong.
So we're coming back around for round two, which is good because I got to sit down, watch
the video and think, what did I want to ask Tim?
What were the hard questions I never got to?
So this is gonna be way more fun.
so we'll roll with it.
So I'll ask you to start
Yeah, fun for somebody.
I'll ask you to start the same way as always.
So please tell us who you are, what you do, your hobby, and your hero or inspiration in
life.
Tim, over to you.
Yes.
So name is Tim Chase, field CISO, former CISO in the past.
I live in Nashville, Tennessee.
I work for Orca Security.
My hobby is really, I'm kind of in that part of life where my hobby is my kids.
but if I had to pick a hobby outside of kids, it is definitely sports, football, and
hockey.
American football and hockey are kind of my two that I gravitate towards.
And as far as
hero, like you know, I would say my sports hero has to be the great one himself,
Wayne Gretzky.
Love how he played, love the kind of person that he is, and loved his philosophy of taking
chances in life, right?
If you don't ever- you miss all the the shots you don't take, right?
So
I was gonna say you're gonna get to it.
I know nothing
about ice hockey.
I've been to a lot of ice hockey games for various hospitality things, so I know nothing about
it.
But I must use that quote to my son, to the kids football team that I coach and to various
other people in my teams all the time about risk taking, right?
If you don't shoot, you're gonna
miss.
My kids know it well.
Like they play ice hockey themselves and sometimes they get a little bit intimidated for
whatever reason, the bigger kids or whatever.
And I'm like, dude, you're not gonna get better.
If you don't go out there and try, you'll never know.
Right.
so they know it well
too.
Interesting.
Right, I want to start with something that you actually said yourself, which kind of led
me straight in, right?
So I I loved your background.
You went through from like systems engineering to QA to security testing to CISO.
You did the CISO job
twice and then you left it.
Right.
I'm assuming that that you didn't like wake up one day and think, I want to be a field
CISO, probably because it didn't exist at the time.
So when you were back in that point in that journey, and what did you want to become?
Like when you started your career, what were you thinking, this is what I want to do?
Was it always security?
Was it anything different?
Like what was it?
I didn't really know.
you know, I think I was a typical twenty-two-year-old graduated from college in a little
bit of a an economy where, you know, people with twenty years of experience were taking
jobs for a fraction of the you know, of the salary.
And so it was kind of like you're gonna take whatever job you can get, right?
And
I managed to get into a QA quality testing job.
and I was like, okay, that's fine.
But
One of the things that I found I was pretty good at was there's a lot of technical stuff.
There was the automation, there was the performance testing, right?
Where you're doing C scripting and all of that.
and about that time, the company that I was working for, which was Willis, you know,
the same people who have the Willis Tower in Chicago, they were hiring their first CISO.
They'd not had a CISO before.
This was back, you know, when even CISOs themselves were kind of new, right?
and so
he and I got to know each other quite well, still do, run into him all the time here in
Nashville.
And I was like, man, that's a pretty cool job, but like why would why can't we do security
testing as a part of all the other testings that I just named off, right?
Like we're not doing anything.
It was kind of the the and it wasn't his fault.
Like if you think about in the 2000s, it was kind of this IDS, IPS, firewall sort of
scenario
where there wasn't a lot of protections once you got inside.
There weren't a lot of
customer facing applications that were external.
and so like that's just kind of where I got the start, right?
And so I started manually doing some some application security testing, right?
You had your web app web application hackers handbook on the left, the computer screen on
the right, and you were just kind of learning as we go.
and so I think that really that got me pointed in the in the right direction, I would
say.
And so that was the kind of the start.
you kind of felt your way into it.
You spent years though getting to the CISO chair, which you
obviously at some point aspired to, right?
And most people
spend years of their career in our domains and industries getting there.
Yeah.
But what was missing?
'Cause at some point it's at HealthStream, it's where you go from CISO to then director
of field security after that point at Collibra.
What what was missing that made you go, I spent all this time and all this ever getting
here?
You know what?
That's not for me.
I'm gonna do something else.
Yeah, interestingly enough, at the time that I did that, and the role has changed a little
bit.
I think you're a good example of of the CISO in a startup, kind of in a in a modern
technology company.
But at the time, CISOs were kind of in their lane, right?
And they didn't get out and talk and talk to vendors, talk to other people.
it it wasn't as as big of a thing back when I was a CISO at
at HealthStream.
And so I was like, well, you know, I have an opportunity.
I think I've kind of run the course here at HealthStream with with what I want to do.
And I was like, you know, if I'm if I'm thinking of what I want to do next, like I I like
talking, I like going to events, I like evangelizing.
I think, you know, talking about security,
teaching people about security and training.
you know, what does that mean?
Because I don't want to go full sales.
Like that's not the life cycle of a that I wanted to to
you know, lead where you're taking people out to dinner every night and and all of that.
and so that's kind of where this field security, field CISO thing came into my life.
I got a phone call from the recruiter at Collibra, who started talking about these things
called options and what happens if they IPO.
and I was like,
he may have dropped Google as an example, which probably he overshot that a
little bit there.
But I decided to go down I was like that sounds pretty interesting, right?
and so
that that was kind of it, because I felt like it was this mixture of I can still be a
security practitioner, I can still talk about security, but at the same time, like I can
go out and evangelize, I can talk about it with other companies, I can learn what other
companies are doing that I can then take to other CISOs, right?
But I but I'm not full sales.
You're in the sales cycle, you're a part of it.
but you're you're not you don't have this quota that you're that you're beholden to,
right?
you've gotten that point, right?
You don't have a quota, you're not paid on sales or delivery of sales.
what you're saying though effectively, and maybe I'm putting words in your mouth, is
that from an operational capacity, you almost felt that you were too sociable to be a
CISO.
Like you liked people too much to be a CISO.
Is that we're kinda getting at?
Yeah, the
field CISO is for the CISO who actually likes to talk to people.
It was.
And I'll tell you a a little bit even more than that, right?
Like, at the company that I was at, the the leader was really good.
I don't want to say anything bad, but he kind of was he didn't like me going and
presenting or for whatever reason that wasn't his thing or training or like all of that.
So it was kind of like, I like to go to RSA and at that point I'd give in at least two
talks, I think, on like container security and things like that.
And so it's like but he kind of frowned upon that and I was like, Well, that's not cool.
And so that was kind of the that was kind of the push that I needed.
So yeah, I was a little too social and wanted to to teach and learn other people.
Do you think that all CISOs should have that skill?
You touched on me being, I think I am an archetype of a modern CISO or a modern tech CISO.
Do you think that all CISOs should now have that string to their bow?
Do you think it's a requirement for a CISO now to be able to sit with customers, to
present, to speak, to be on podcast?
Like, is this a skill set now people need to have that we just don't have enough quality
in which is why field CISOs exist?
Because the CISOs themselves can't do it?
Yeah, I think that field CISOs exist for a couple of reasons, right?
One is scale.
I mean, in in, you
know, I used to run a team of of eight field CISOs because I can't be everywhere.
CISOs have different niches, you know, healthcare, sometimes financial, depending on the
size of the company, you might want to, you know, have the team organized differently.
So, like one reason is is is that just just scale.
But I do think that modern CISOs should.
try and get out there more and speak.
They still seem to like to meet in their own little groups and things like that.
But I think I think it really helps both from a really from a sales perspective, from a
customer retention perspective, just like they like talking to CISOs.
Like one of my favorite CISOs to talk to is this is this great lady who works for like
a transportation company.
And that's one of the things that she does.
She's not she doesn't work for a startup.
She doesn't work for a, you know, a security company.
You know, she works for a logistics company.
But she goes and she talks to a lot of the different customers.
She'll do the site visits where she talks to their security
folks, say, here's what we're doing to keep your your data secure and things like that.
And I think it means a lot.
And and so I I do think that's something that most should should aspire to.
And it brings a little bit of authenticity to the to the role as well and to to what the
sellers are saying.
okay.
Well let me ask then the awkward question.
The elephant in the room, right?
I've talked a lot on social media about the fact that I feel that even just being a vendor
CISO let in a field CISO you carry like a leper bell around your neck.
Where you walk around and people are like, You're not actually a real CISO, you're half a
salesperson, right?
And there's this messaging around field CISOs aren't CISOs.
Does that piss you off?
Yeah, a little bit.
because it it's funny.
It's like I I've been in that role.
I have probably had more experience than some of the people that I'm talking to.
and yet they want to not treat you like you're a CISO.
That doesn't happen all the time.
Like there's funny, you know as well as I do that like you go and a lot of people
understand the role.
they like the fact you can speak their language, but there's a certain subset that
automatically kind of take it and put you over here.
even people you've worked for for a while.
Like I'll there was one company that I worked for, hired a person, got him in his
role, did fantastic.
And then I went over and, you know, three years later, I I knocked on the door to just
say, Hey, how things are going?
You know, could we can I give you a hand with anything that you're that you're doing?
You know, I know you're you're trying the software.
And instead of him replying to me, I got a nastygram from his boss, right?
And so it's like, man, like both of them I've worked with before, but the tables had just
turned because I was on the other side, right?
So that does
frustrate me.
It's because it's like I I've been there, I understand it.
I operationalized so many teams, not just when I was a CISO, but when I was a cloud
security leader, application security leader, and all of that.
like I I think I think it's turning a little bit.
it's not quite like it used to be.
I think maybe the the tide's turning, but yeah.
I have been told to my I I
yeah.
you've done it in so many places in massive companies, right?
You've held like Lacework, Collibra, like now Orca, you you've held big roles at big well
known brands.
Have you ever had to defend that career choice?
Because you made a point where you're like, you know, some people go in and out of field
CISO or normal CISO, whatever, right?
But you've gone strategically, I'm gonna this is this is my journey, this is who I am,
right?
This is who Tim is.
Have you ever had to defend that where someone said, like, why the hell are you doing this
and make the wrong choice?
Like you should be back in operations, like
Have you ever had to defend your own choice?
And have you ever actually sat there and even questioned it yourself, like, Why have I
done this?
I think sometimes you know you wonder kind of the the the what's next, right?
You do wonder like, okay, I'm a field CISO. Is there something I want to do next?
You know, when you run a team of pretty large number of field CISOs, you start to to ask
that question.
so I've been asked by people like what's the next career step for you, or somebody who
wanted to be a field CISO, they're like, you know, what is what's after that?
You know, what's next?
And so I do think about that.
you know, you know, sometimes and I've been asked.
why that choice, why the career choice.
and you know, I still like being operational.
And I would not say that I wouldn't ever go back to like being a a CISO at a startup that
kind of had that dual role.
Like I think that skill set's still there and I would still do it.
So I wouldn't shut that door completely.
but I have been asked that or like asked kind of what's the career path for sure.
What do you think the one thing is that people fundamentally misunderstand about field
season?
If you were to pin down to one thing that people don't get, what is the one thing people
don't understand about your job?
That don't carry a Rolodex.
like, like I there's there's been many,
many times that I have been on you know calls or in the past when I've interviewed for
jobs or whatever it happens to be, right?
and they're like, I'm like, what do you need me to do?
Well, we need you to bring a bunch of CISOs over and schedule meetings for our product.
Yeah.
Well, that kind of goes back to what we just talked about.
There's gonna be, you know, when a CISO goes to a field CISO role, there's potentially
that subset of of folks that are gonna be like, Yeah, no, you know, you're kind of a
seller, I I get it.
And they'll treat you like a you know, like a sales guy.
But I feel like putting a field CISO in this role where they just can text a bunch of
CISOs to to buy the product or whatever, like I think that's putting them in a box that is
You know, not fair, right?
Because there's other aspects to the role, the marketing aspect, the product aspect, and
all that kind of stuff.
So that part really does frustrate me sometimes.
I a hundred percent agree because I get asked obviously in the vendor CISO role, which is
kind of half field, half operational all the time: who can you bring into
this room?
I'm like, it's not what I do, right?
I build a brand, messaging, and authenticity.
the customers who listen to me listen to me because I don't like pull them into a room.
Like if that's what you want from someone, that's not what I am and it's not what I think
you actually need, because that's short sighted and it's transactional.
look, you you start talking about travel at beginning in keynotes and conferences.
Well we had a conversation RSA and we talked about burnout, right?
And about the fact that the travel gets to you, like the constant like pressure getting
gets you and stuff.
Like when like have you ever been at a point where you've realized that and gone, like
this is all great, and I love doing those conferences and those travel and stuff, but this
is too much.
Like it's taxing me mentally or physically or from a family stance.
Like have you ever had that experience?
Yeah, sure.
I mean, It's something I have to constantly, you know, measure, right?
Like I I've got four kids, I've got a wife that works.
and like the life of the field CISO, you know, I'm traveling the next two weeks, right,
for a conference in Grand Rapids and then one at Black Hat, right?
And so it's kinda like at some point you you got to really kind of keep that in
perspective because and I had to say no sometimes, right?
It's to the point of
You know, I've talked to the marketing folks and they'll be a gatekeeper for me.
Like, you know, just the most important ones that you need and the customer success.
Like, you know, let's let's do like one QBR with you this time.
I'll hit up the other customer success rep for the QBRs for the next quarter.
Like it's something that I constantly try and balance because I've I'm always very clear.
Like I don't want to be a road warrior.
Like that's just not who I am.
I recognize it is part of it for the job, but you do hit your points where, you know, when
there's three weeks in a row that you're traveling,
And then when you're not traveling, you're taking your kids to sports and trying to get
the date night in with the with the wife and all of that kind of stuff.
It's you know what I mean?
Like it can be a lot, right?
but there's also the reward side of it where you get to talk to a lot of customers about
the cool stuff that you're doing.
You get get to meet a lot of cool people, you get to slip a hockey game into the trip
that you feel a little bit guilty about, you know, when the wife's home putting all the
kids to bed and you're cheering on the the local hockey team, right?
But
Like there are positive aspects to it, but there's definitely the point.
Like there's always a reset for me.
and it happens a lot usually, like maybe like at the end of the year when things kinda die
down.
you're like, All right, like how can I figure this out for next year?
'Cause you know as much as I do, once conference season gets rolling, man, like it it
doesn't stop.
You know, between the
earlier in the year spent I tell people proudly and embarrassingly that I spent
thirteen weeks going to and from the UK and multiple cities each week, like relentlessly
'cause like basically just overly booked myself and I couldn't really get out of it
because most of them weren't anecdotes, they were just me.
and it was hard.
I assume then I think I know the answer to this question, but the biggest sacrifice then
to be good in your job, to be a good field CISO, is probably there's a requirement to be
with customers in the conferences and that means sacrificing some
Family home time,
right?
Yeah, yeah.
Like, you know, the the conferences don't care about what time it is, right?
Like Black Hat's always my first kid my my week's my kids first week of school.
Every single year, you miss the the back to school part for the kids, right?
and then obviously reinvents always the right after Thanksgiving.
Right.
And so you know, you do you do sacri you can't make it to all the soccer games, you
can't make it to all the hockey games, right?
There is there is a level of of sacrifice there, but I think you know, it it's it is
what it is, right?
It's part of the job, it's worth it.
The the kids and the family understand.
The key is I think, just like with anything else, making the most of it when you're home,
right?
Being able to, you know, turn the laptop off at four, at least until, you know, they go to
bed and and then maybe catch up and do some more stuff.
But the key is like, you know.
make make the most of it.
Like I'll like an as an example, I I drive my daughter's school bus, right?
for for I
do, yeah.
There's a there I should have told you that was a interesting fact.
So yeah, yeah, yeah.
It's white, but I do.
I do.
Like I so like when it was it was probably a couple couple years ago I got the the
wild hair to just get my CDL.
Like you have to go and get a
Like a CDL and endorsements and all this kind of stuff, right?
It's not easy.
'cause my kid, my daughter needed a a bus driver for her soccer team.
And so I'm drive the the big bus.
So, you know, that's one of the ways that I like that's one of the ways that I can like
spend some time with her as she's doing her hobby when I'm home, right?
Because I always offer to do that to the away games when they need it.
Yeah, have your kids ever asked you to like so my kids always tell me I should be a
plumber or electrician, 'cause the plumbers and electricians they know don't seem to
travel anywhere.
I don't know if you have the same experience, but
that's when I noticed I was traveling too much my kids.
I said, Have you ever thought about being a plumber?
They haven't been they're not that smart, I guess.
They're like, Do you really have to go again?
Can't you just stay home and not work?
I mean that's what they tell me.
I'm like, well okay, but like That's right.
I'm sure like me, the first time you
learn about options, you have this like thing where you go home and you do your
spreadsheet and you're like, I'm gonna be like a multimillionaire by twenty eight and
you're like, that's not how it works.
damn.
did that
at at one of my previous companies.
I'll let you look at my resume and decide which one that was and and how that ended.
I did that calculation many times.
I was a customer at one point, but we'll leave that aside.
not every so you'll be in a lot of customer meetings, and I could ask you about the ones
that are great and what you learned, but for me that's kind of the boring bit.
I like the kind of awkward, difficult conversation.
So what is there one you have to name customer, that one customer meeting you've had as a
field season, maybe in this role, that you just want to erase from history.
That was so bad that you wish you'd never stepped in that room and it was irrecoverable
afterwards.
It yeah, I mean, gotta I'm gonna narrow it down in my head.
I mean I've been I've been yelled at before in a in a customer meeting.
Like
like you get on, you know, to do a roadmap or something, and then they just straight up
tell you, I don't wanna hear your roadmap.
I've had these three tickets open for X amount of time, right?
Like, why do I wanna hear about your new features?
Why aren't coming on here and tell me what you're doing and why you're not fixed this
issue?
These are the and like when you hear the issues.
I'm like, but those are not the things like those are important to you and I understand
it, but like in the scheme of the security program, you don't know what you're talking
about, right?
So those are the ones that I get frustrated.
You go it is not, I did not say
that.
It was more like, I hear what you're saying, let me figure out what the problem is and see
how I can get back with you, right?
but yeah, and then they start yelling at the you know, customer success.
Like, I've been in those meetings before, but cause you have to keep your composure.
You have to tell them, hey, I hear you.
but at the same time, you're like, you don't know what you're talking about.
I another one that I'll that I'll tell you, the hard ones, it are the ones where you
have the security people who maybe aren't up to date on modern technology.
And I don't want to name any names
or customers, but like you you'll get in there and you're talking cloud security, right?
and they'll ask you, and you'll be like, tell me a little bit about your environment.
Right.
I want to know you know how Orca can come in and how we can and help.
And there'll be something along the lines of like, yeah, well, how do you integrate with
the firewalls that I have in the cloud?
And you're like, okay, like you have firewalls in the cloud.
Yeah, we have, you know, this brand of a firewall that we that we put in there.
We had them on prem and we just put them in the cloud and we use Gigamon
inside of there to you know to do some network monitoring.
And you're like, okay, like let's go back and let's go back and do some cloud one on one
maybe and see.
if we can I feel like we're already lost.
I think we've lost the thread.
So
what what do you learn from those?
The being shouted at, the guy who clearly doesn't have a clue what he's talking about, but
you have to like kind of like feed his ego or her ego, like what do you learn from those
as lessons?
I mean, I think you learn how to handle people different.
Like everybody's different.
and I think it's just a lesson in in in handling people.
Like I, you know, I've taken people from like they got mad at me.
and then at the end of it, like they were, they were thanking and and sending notes
saying how much they appreciated the time, right?
I think it's you know, my wife is a neonatal nurse practitioner, right?
And so she
Has taken many courses on dealing with the emotions of parents.
right.
And and I think she can de-escalate a situation and turn it to where they see her as a
trusted advisor.
She's better at it than I am.
And I think
situations like that are where you learn from.
You learn to hear, de-escalate, and feel like an advisor and not make it contentious,
right?
I think that's kind of what I learned from those, is like hear what they're saying.
What's really bugging them?
You can't always win.
Like there there are some customers that for whatever reason don't want to hear it, right?
It's maybe it's because they're just that way.
Maybe they're maybe they've had, you know, six months of the same conversation and they're
just really mad.
Maybe they like a different vendor more and they're just using you as a as a you know is
as a they're just angry at you because they want to get you out and you know what I'm
saying?
Like there's all sorts of reasons.
You can't win them all.
But that's typically what I take from it is like, you know, just learn from how to deal
with that person, hear what they're saying, treat them as an individual and try and de
escalate rather than you know, feeding back.
So in doing so, like you said before, you went into a field CESA role because you like
people and you're sociable.
But also to be successful in a field so CESA role, you have to have highly functioning
people skills to be able to work with very different people in different situations,
de-escalate them, and eventually it's all about getting to outcomes, right?
It's not necessarily about a sales cycle, it might be about making that thing happen they
want to do, which internally we don't want to do, right?
Yeah, we've all been there trying to convince R and D to build something they don't care
about, but your customer really does care about.
So I think that's interesting.
You you also mentioned about you talked about your wife talked about this whole concept of
de escalate and become a trusted advisor.
Now I basically took a ton of field CISO posts off LinkedIn and threw them into a model,
as you do, and asked it what the most common criteria that it teaches is, or the most
common saying of the field CISO world.
Do you want to have a guess, Tim or what it is?
At the same?
Or like
common teaching or principle or saying that field CISOs put into LinkedIn?
man, that's a good one.
it's gotta be something customer related.
I don't wanna say the customer's al always right.
That's too cheesy and too
not the customer's always right, but you're on the right lines
of saying it's about customer.
the customer doesn't always know what they need.
Customer doesn't know what their problem is.
game show.
I'll give it to you.
The
most common thing in some way or form is saying this products don't win deals, trust does.
That has been repeated in a million different Yeah,
million different structures that has been said.
Products don't win deals, trust does, right?
How do you build trust?
Like, as a field CISO, you go into a room, you're seen as a salesperson a lot the time, or
you're seen as being non
Operational you're seen as coming into a room to try and de-escalate someone who's already
pissed off with a company.
How do you build trust?
Is there a magic lesson that you've got for the world on building trust?
one, yeah, I got two.
they need to know that you know what you're talking about, right?
Like you have they they need to know that you speak their language, you live their world,
and that's a way of of gaining trust.
And I'm not saying that salespeople don't have the trust, like they have their own way of
of gaining trust.
You see people buy from the same people over and over and over when they go to different
companies, right?
But I think that I've seen so many security leaders,
Like their eyes turned to me and and be engaging when I could speak their language, right?
Like when
they're talking about the problem they're having, I could take it and expand upon it.
So yeah, I I did that.
I remember when I was having to create a new board deck and I remember trying to figure
out exactly what that board wanted to hear.
Here's some of the things that I had to do.
Or when I was rolling out cloud security over at this company, like these are some of the
roadblocks that I had.
Here's how I implemented it, and these are just some general thoughts.
Like to just being able to speak their language is is important.
But I would even back up a little bit more than that, and say sometimes when I am
Sometimes when I am doing customer calls and working with with the sellers, I will even
do help them do a discovery call or the pitch call because I think what we're really
good at is understanding the problem, right?
We're not trying to sell.
We're not trying to, you know, find exactly you know how what we can sell to them.
But the key to selling, and I think this is why some sellers are really good too, is
We get to the crux of what the problem the customer is trying to solve is, right?
If you
go in and you're like, tell me about your environment.
What are your security priorities?
What do you want to do this year?
What are you hoping to accomplish?
What's the biggest problem that you have?
What does your board care about?
And then you and then you say, well, here's how I can help is by, you know, you may not
need all of these things of the product, but right now you really need this part, and
here's how we can help you, and is here's how we can make your life better.
Sometimes that's meant.
In my in my past, I've told them like we're not the right we're not the right fit.
I mean, like go talk to this company
or this company.
Happy to make you a referral.
and and and hook you up.
But like it's it's making sure you're trying to solve a problem and not just trying to
find a problem to solve, I guess.
Like, if that makes sense.
So
You touched on two things that I think are fundamental and I think they're what you're
saying without using the exact words.
one is integrity.
You have to have integrity, like you can't just be there to sell and to propose.
And the second is authenticity or honesty.
This fact
that I sit in the room sometimes and go, one of our big competitors at Anecdotes is
Vanta.
And then go, You're probably a better customer for them than you are for us right now.
Like they they will solve your problem better than we will.
But you know what?
Like if you have these problems, then we will be the best company for you.
So let me know if things change, right?
And I think that
is what makes the difference between a field CISO who is trusted and a field CISO who's
effectively the guy with the Rolodex.
let me ask
you two kind of parting questions.
So let's say an operational CISO, let's say Tim from years ago, sitting back at Health
Street rings you and says, I'm thinking about becoming a field CISO.
Question one.
If you went back in time to yourself, would you say yes, this is the right thing to do, or
would you say, you know what, let's take course?
Second question is, what's the one thing you would tell them that nobody told you that you
wish someone had?
I would say I would still take the call.
Like I think it's it's got it gotten me a lot of experience that I did not have before.
And that's talking with people from all sorts of different industries, right?
whether it's security companies like us, large banks, healthcare companies, like it's
given me a a wealth of experience and and helped me, I think, to to help solve more
problems because I understand like the selling motion.
I understand a little bit more about that.
Like,
I have the marketing experience of the product marketing and the analyst relations.
Like I think the field CISO role and what it's kind of morphed into, at least in my case,
it's kind of made me like a better technologist and a and better, more well rounded
individual.
So I would say yeah, like I it's been really great.
and I would say do it again.
it again, but what would you tell yourself, or what would you tell this person who the
thing you wish someone had told you at the start, which no one told you?
I think probably you know it watch out for the travel.
That would be one thing, I guess.
Like
that one bit me a little bit.
I didn't realize the the level.
we've adjusted and it's great and I wouldn't change that now because that's how you get
out there.
but I think COVID hit pretty soon after I took that kind of a role.
And so, you know, obviously travel was not a big thing back then, but
You were weirdly a field CISO during COVID, right?
When no one actually got on planes.
Well that must be a joyful role
to have.
I know it's fantastic.
I think that that's probably one.
and then the thing that I would just say is like, you know, know what your next step is.
Like, I'm, you know, you want to go to a field CISO, just understand, like, is that what
you want to do?
You know, is that a stepping stone to something else?
Just, you know, kind of understand what that next step is that you want to do, like.
'Cause it can be a role that you can sit in and be really good at.
but it's also a pathway to to other areas, to be frank,
whether that's marketing, whether that's product, you know, and you can set yourself on
the right path if you just kind of understand like what your next step is.
Tim, thank you.
This has been an absolute pleasure.
Here's the takeaways that I took from talking to you.
I think one is that you can't over plan your careers.
Sometimes the opportunities come and you take the path it follows, your passions and what
interests you and the skills that you have, in your case, being too sociable to be a CISO.
and once you get there, you work
an i an introvert, by the way, ironically.
I think most of us are, I think most of us in this space, I class myself as an introvert
extrovert, or an extroverted introvert,
if now you look at it right.
So I I'm with you.
I think that I think then you you work out how to to see if that is a stepping stone, a
part of a journey, or it is the journey.
And inside of that, when you decide that you have to find this balance for burnout versus
normality and trying to find structure inside of it, and then you have to work out how to
be good at your job, which I think is this principles around you build trust through
authenticity and through integrity.
And by doing so, you don't become a Rolodex, you become an advisor who matters.
and I I'm an advocate.
I think there should be more field CISOs.
And I think there should be more field CISOs doing the right things like you do and like
Orca does that actually enable people to be this consultative voice in the room to help
rather than just to try and drive to the ARR and the close of the deal.
Tim, thank you very much.
It's been an absolute pleasure.
hopefully we'll have you on again soon in some different capacity.
Is there anything I shouldn't have I should have asked you that I didn't?
No, I think you hit pretty good.
I like your questions, mate.
Sweet.
Cool.
Then in that case, thank you all for listening.
I've been Jay Bernardes.
This has been Tim Chase.
We will speak to you both again or all again soon.
subscribe, follow, like, and we'll see you on the other side.
Peace.