Chief Information Security Officer

Security used to be treated as an engineering chore. Put a firewall up, tighten the password rules, and the job looked technical enough that someone inside the engineering team handled it alongside their other work.

That arrangement broke the moment a decision was required. How long to retain access logs, how many days until a departing employee's account is removed, whether customer data may go to an outside tool — these look technical, but the answer always costs money or speed. An engineer can say the plan isn't acceptable, and whoever owns the launch date ships it anyway, because the objection carries no authority behind it.

Enterprise customers added a second problem. Before a contract closes, the buyer sends a security questionnaire: a hundred-odd items asking who approves access, how many hours until an incident gets reported, and who is accountable. Fill the last field with a developer's name and the next question comes back immediately — does that person have the authority to delay a release?

The chief information security officer (CISO) is the job created to put that authority somewhere explicit. What to defend and what to accept is a business judgment rather than a technical one, and the person making it has to sit among the executives for the answer to carry weight inside the company or outside it.

Most of the day goes to setting the line of risk the company accepts and checking that the line holds. Four kinds of work.

1. Writing and revising the rules. The security governance documents — who can reach what, when access gets revoked, who is notified within how many hours of an incident — get built once and reworked every quarter. Each new tool the company adopts opens a gap in them, so this is never finished.
2. Ruling on exceptions. Much of what comes up from the team is a request to bend a rule once: direct access to the production database to handle an urgent customer problem, for example. The CISO refuses, or grants it with conditions and an expiry date, and records the decision either way so the next request can be judged against it.
3. Producing proof. Preparing for a security compliance audit, answering customer questionnaires, and chasing every finding until it's closed. A single large contract slipping two or three months over this paperwork is common enough that the work sits directly on the sales calendar.
4. Running incidents. From the moment a compromised account is confirmed, deciding what to shut off, who to inform, and when to tell customers. Engineers handle the technical recovery; this role sets the timing of notification and disclosure.

The task that actually consumes the most time is keeping an inventory: which systems exist and who can get into each one. When that list goes stale the other three become theater. An account still live three months after the person left isn't a firewall setting — it's an inventory nobody maintained, and no amount of spending on tools closes it.

This is not a job done alone. It runs into four groups continuously.

1. Engineering. Where a security engineer exists, they report in; where one doesn't, parts of the engineering team split the work. Finding and closing vulnerabilities is their side; deciding what gets closed first is this one.
2. Legal. Meetings with in-house counsel happen over the security clauses in contracts. How much gets paid out after an outage or a breach, and how many hours until customers hear about it, are legal sentences and operational promises at the same time, so both sides read them together.
3. Privacy. The closest work with a data protection officer (DPO) happens during a breach. Establishing what data left and how much of it is this role's job; deciding when and to which regulator it gets reported is theirs. At smaller companies one person often holds both titles.
4. Sales and the executive team. Questionnaires and certificates are contract conditions, so they land on the sales calendar, and the line of accepted risk is ultimately a spending question that has to be explained to the CEO and the board.

With that many points of friction, the role's reputation rests on how well it says no. Block everything and nothing ships; approve everything and the position has no purpose.

"This contract is conditional on passing their security questionnaire, so the CISO has to review it first."

Not a technical review — an accountable sign-off is a precondition for the deal.

"I'll allow this exception for three months and set an expiry on it."

Bending the rule while attaching a deadline so it doesn't quietly become permanent.

"We don't have a dedicated CISO yet, so that field goes out under the CEO's name."

There's no full-time holder, so another executive carries the accountability.

Pagedeck has no dedicated holder. Grace carries the title and Theo does the hands-on work, and as enterprise customers multiplied the quarterly questionnaires ate into Theo's time fast. Last quarter two full weeks came out of the engineering schedule for it, which is roughly what a dedicated hire would have cost in a month.

The item that blocked them was procedural rather than technical. An account belonging to someone who had left three months earlier was still active, and nobody had been assigned to confirm revocation. Grace sat down with Theo and the people lead and settled it by adding account revocation to the offboarding checklist with a named verifier.

The most common assumption is that the job goes to whoever knows the technology best. The title says security and the subject matter is systems, so that follows naturally. But the work is mostly refusing requests that can't be met and choosing which risks to accept, which calls for the ability to explain a decision more than the ability to find a vulnerability. Appoint purely on technical depth and you get someone who only says no to engineers and whom nobody in the executive meeting can follow.

The second is deciding it's a role for later, once the company is bigger — adding an executive seat at 40 people looks excessive. But the trigger isn't headcount, it's the first enterprise customer. The questionnaire arrives and demands a name and a scope of authority, and a position invented in that week starts with no knowledge of the rules already in place. Even when the title is held part-time, writing down who makes these calls beats improvising it later.