iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A successful CISO career does not depend on one degree, one route into cybersecurity, or a move into management. In a September 3, 2024, SecurityWeek interview, Jaya Baloo, then identified as Rapid7’s Chief Security Officer, and Jonathan Trull, then identified as Qualys Chief Security Officer, describe different paths into the field and discuss executive authority, team design, career growth, and technology concerns.
Two different routes into cybersecurity leadership
Baloo’s route combined informal computer experience with formal study in political science and international relations. She describes spending substantial time on computers before moving into security work in banking and telecommunications. Her account illustrates that technical interest and sustained self-directed practice can contribute to a security career even without a formal computer-science education.
“I had no formal [computer] education, but I had a ton of informal training and hours on computers,” Baloo said in the interview.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTrull describes a different progression: computer science studies, program auditing for the State of Colorado, naval reserve service and leadership, and later security positions. Rather than presenting his career as a fixed plan, he characterizes it as a series of opportunities across related fields.
#1 Best Overall
“Most people take the opportunistic path in their careers, and it may even be easier today because cybersecurity has so many overlapping but different domains requiring different skill sets,” Trull said.
What their stories suggest for aspiring CISOs
The interview does not prescribe a single credential or sequence of jobs. Its examples instead point to several ways of building toward security leadership: developing technical skills, learning how organizations operate, taking on responsibility, and staying open to opportunities that connect adjacent disciplines. These are the interviewees’ career perspectives, not a guarantee that any one route leads to a CISO role.
Why a CISO’s authority matters more than a reporting line alone
Baloo describes the CISO role as having moved toward greater organizational seniority, while arguing that independence from IT and access to executive leadership can help a security leader challenge decisions when necessary. She also cautions against treating the reporting chart as the whole issue: a CISO needs the ability to advocate for changes that the organization needs, even when doing so meets resistance.
Recommended Free Tools
Rank #2
“It’s not that relevant where the CISO sits, it’s where the CISO stands in the face of opposition to what needs to be done that is important,” Baloo said.
Trull argued in the 2024 interview that SEC cyber rules were changing expectations for governance and incident reporting at public companies. Baloo raised a related concern about the personal exposure and legal costs CISOs may face when held responsible for matters beyond their control. These comments describe the interviewees’ assessments at that time; they should not be read as a statement of current legal requirements or advice about an individual’s liability.
How to build a security team that works
Baloo emphasizes cohesion and diversity of thought, rather than relying on one exceptional person to carry a team. In her view, differences in how people approach problems can strengthen a group’s ability to recognize and address security issues.
“When I recruit for the team, I look for diversity of thought almost first and foremost, front and center,” Baloo said.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Trull also supports diversity, while noting that some roles call for particular technical expertise. He cites cryptography and FedRAMP experience as examples of specialist knowledge that may be essential for a given job. The practical distinction in their discussion is between building a broadly capable, varied team and ensuring that a role has the specific skills its work requires.
Career growth does not have to mean becoming a manager
Baloo advises security professionals to keep learning and retain technical depth as their responsibilities grow. Advancement can involve greater expertise and influence without requiring a transition into people management.
“Don’t assume that the only way to progress your career is to become a manager,” she said.
Her other advice in the interview includes not discounting oneself when considering opportunities and observing organizational politics without feeling compelled to participate in every part of them. For people developing their skills, the discussion points to self-directed education, hands-on practice, mentoring, and continued engagement with new technologies as useful parts of professional growth.
AI and quantum technology: Baloo’s stated concerns
Baloo identifies AI and quantum computing as areas that deserve security attention. On AI, she raises questions about organizations sending supply-chain data into systems without understanding how data may flow downstream, as well as the possibility of “leaky” APIs. Her point is about the risks of adopting technology without a clear view of its data paths and interfaces; the interview does not establish that a particular AI system or API is vulnerable.
Best Value
“As a security person that concerns me,” Baloo said of AI implementation and data use.
On quantum computing, Baloo focuses on the difficulty of replacing existing cryptographic approaches. More broadly, she warns that organizations can carry familiar weaknesses into new technology or encounter weaknesses they did not anticipate:
“We tend to embrace new technology with old vulnerabilities built in, or with new vulnerabilities that we’re unable to anticipate,” she said.
These remarks are Baloo’s concerns in the 2024 interview, not a current technical assessment of AI security, quantum capabilities, or the status of cryptographic standards.
What the interview offers—and what it does not
SecurityWeek’s conversation is useful as a leadership perspective: it brings together two contrasting career histories and their views on organizational influence, hiring, professional development, and emerging technology. It is not a step-by-step credential roadmap, a legal guide for CISOs, or a technical evaluation of AI or quantum-related risk. Baloo’s and Trull’s job titles here are the titles attributed to them in the September 3, 2024 interview, rather than a verification of their current roles.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
