Comment by datavirtue | Hacker News Reader

Comment by datavirtue | Hacker News Reader

Parent Full thread

I watched a CISO come into a startup and take it from a laughing stock (outright fraudulant PCI audits and zero policies by predecessors) to world class compliance.

There was a lot of bull-dogging, confrontation, arguing, political back-stabbing, fights with nearly every developer. It was chaos. A lot of it was funny if you were the one sitting back eating popcorn. Most of the big fights involved him trying to get shit done while navigating executive level politics and rediculous antics.

This guy is a very rash person and can be abrasive if he "thinks you're dumb" but I don't know if it would have gotten done at the level he was able to do it any other way. It was literally war 24/7 for years.

How did this person not get fired? Did they have board/executive backing? Significant ownership? Was it life or death for the startup to achieve "world class compliance"?

This is the million dollar question. I think there are cases where executives take this kind of aggression like it's tough love and so they argue with the warlike technical folks but ultimately concur, like old habits dying hard

Possibly due to this person having exceptional stakeholder management skills.

Speaking as someone who works in management. Knowing the difference between key stakeholders that you cannot afford to lose, and ones that are disposable are essential.

> Was it life or death for the startup to achieve "world class compliance"?

Most likely.

Nobody cares about security until they lose actual money because of it.

After that, your CISO now has the budget and importance defined by how much money the company got taken for.

There were factions and he was in one that had his back. The faction that belonged to a new CEO who brought with him a CTO. Most of the antics and cringy back stabbing flowed from the CFO who was brought in by other board members.

After we got acquired he started openly insulting management and the new company to their face in meetings in front of everyone. He did it on purpose but it still took quite a bit to get fired.

Reply on news.ycombinator.com