Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCybersecurity leadership does not have to begin with a computer science degree or a conventional IT-to-security career. In a February 19, 2025, SecurityWeek interview, Kevin Winter of Deloitte and Richard Marcus of AuditBoard describe very different routes into the CISO role—and converge on a shared lesson: security leaders need business judgment, communication skills, and the ability to build trust across an organization.
Two routes into cybersecurity leadership
Their careers are examples of how people can enter security from outside a traditional technical track. They are not formulas that guarantee a CISO job; both stories involve learning, changing responsibilities, and taking opportunities as they arose.
Kevin Winter: psychology, military service, and technology leadership
Winter studied psychology and initially considered medical school. Financial constraints led him to join the U.S. Marine Corps, where he says he developed technical and leadership skills. He later held cybersecurity and technology roles at Joint Task Force–Computer Network Operations, Booz Allen, and SRA, returned to Booz Allen as CIO, and then joined Deloitte. SecurityWeek identified him as Deloitte’s Global CISO when it published the interview.
Richard Marcus: finance, startups, and security operations
Marcus studied finance and entrepreneurship and began his career in Wall Street equity research. After the 2007–08 housing crisis, he joined startup Edgecast. A PCI audit there became an opening into technology, security, and broader business responsibilities. His later career included security operations and Verizon Media before AuditBoard, where the interview identified him as CISO.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The transferable point is not that a particular degree or first job is required. Both accounts show the value of staying curious, learning unfamiliar work, and recognizing opportunities to take on responsibility.
What the CISO role asks of a leader
Technical expertise matters, but both interviewees describe executive effectiveness as depending on a wider view: understanding how the organization operates, communicating with stakeholders, and connecting security decisions to business needs.
Security should shape technology early
Winter argues that security and IT infrastructure are closely connected, so security leaders need to understand IT operations and contribute during system and network design—not only review decisions after they have been made. He described security leading network design work at Deloitte and said, “So, the CISO must be a peer with the CIO – and in many cases I’m seeing the CISO leading in the design work.”
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Some organizations combine security and IT leadership
Marcus described a different arrangement at AuditBoard: “The CISO is the CIO.” He said enterprise IT reported into security, enabling the organization to build security practices into areas such as identity and access management and endpoint security.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11These are two interviewees’ accounts of their organizations, not competing universal rules. When evaluating a CISO structure, the practical questions are whether the leader has access to executive decisions, whether security and IT operations coordinate effectively, and whether security is involved early enough to influence design. The interview offers examples, not a comprehensive governance model.
Compliance should inform decisions, not become the goal
Marcus sees compliance as useful when it helps an organization understand its obligations and guides sound strategic decisions or investment. In his view, the problem is compliance performed as a checkbox exercise without meaningful changes in behavior or security investment.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The interview also discussed SEC cyber-incident disclosure requirements and the difficulty of deciding when an incident is material. Winter raised concerns about legal exposure and inconsistent interpretations in the February 2025 discussion. That interview is not current legal guidance; organizations should consult current SEC materials and their legal advisers when determining reporting obligations.
How leaders can build a strong team and reduce burnout
Marcus describes effective teams as a balance: exceptional individual contributors matter, but so do cohesion and diversity. He uses the Japanese concept of ikigai to describe work that offers interesting problems, modern tools, autonomy, purpose, and fair compensation.
Recommended Free Tools
Winter emphasizes empowerment, trust, recognition, and room to grow. He also describes cybersecurity as a high-burnout environment, especially during incidents and active vulnerability response. His approaches include modeling personal routines, ensuring staff can disconnect after intense periods, and avoiding a structure where one person alone owns an entire area. Shared responsibility makes it less likely that the full burden of an event falls on a single employee.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Advice for aspiring security leaders
Take on work that expands your range
Marcus recalls being advised not to reflexively turn down opportunities. Raising a hand for challenging work can build experience while showing that you are willing to learn. Winter similarly recommends moving beyond familiar specialties and broadening experience across security functions.
Communicate difficult news quickly
Marcus repeats a mentor’s maxim: “Good news should travel fast, but bad news should travel faster.” He connects prompt, candid communication with ethical leadership and the role of a security leader as a trusted business adviser.
Make security useful to the business
Both leaders stress understanding stakeholders and the organization’s users. Marcus advises treating business users as customers: learn what they need, build useful functions, and look for ways security can support strategic value. Winter puts the executive mindset this way: “If you want to get into the CISO realm, you must look at yourself as a business partner – you’re the one bringing the cyber strategy; and that mindset is important.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Winter also summarizes the shift from specialist to executive: “Your technical skills will get you to a leadership position, and your leadership style will keep you there.” The message is not to abandon technical depth, but to pair it with judgment, adaptability, and the ability to bring people with you.
Source and context
The career histories, organizational descriptions, advice, and quotations above are from Kevin Townsend’s interview, “CISO Conversations: Kevin Winter at Deloitte and Richard Marcus at AuditBoard,” published by SecurityWeek on February 19, 2025. Titles and role descriptions reflect how the interview identified the executives at that time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
