The job title stays the same. But what doesn’t stay the same is the org chart, the industry, the budget, or the board. So what actually transfers when a CISO moves from one company to the next? And what do experienced security leaders have to learn all over again?
That was the question at the center of the CISO Series February Reddit AMA on r/cybersecurity, which ran in February 2026. Three CISOs who’ve each held the role across multiple organizations joined the thread to answer questions from the community:
• Andrew Wilder, (u/CyberInTheBoardroom), CISO, Vetcor
• David Cross, (u/MrPKI), CISO, Atlassian
• Peter Clay, (u/cpthuah36), CISO, Aireon
Over the course of the week, they fielded questions on everything from board communication and vendor relationships to career transitions and the fine line between a CISO and a vCISO. Read from the full Reddit thread here, but we’ve highlighted what stood out.
To be heard in the boardroom, stop speaking in CVEs
One of the thread’s most-upvoted exchanges started with a simple observation: security teams often lose credibility not because they lack technical depth, but because they never translate it into language that resonates where decisions get made.
“The Board views the company through the lens of a Balance Sheet. If you speak in CVE scores or firewall logs, you are signaling that you belong in the basement, not the boardroom. To be heard, you must translate technical debt into financial risk.”
— David Cross, (u/MrPKI)
Cross framed AI risk for the board around three balance sheet impacts: model integrity as a fixed asset, regulatory tail risk, and operational velocity. The reframe moves security from cost center to risk-adjusted value function.
Why you left matters less than what you learned
One community member asked a pointed question: Why did you stop being a CISO the first time? Failure?
“For me, my transition was from Regional CISO to Global CISO. My boss at the time was super transparent with me. He said, your next role is my role, but I am not going anywhere for a while. If you want to grow in your career, let me help you find a Global CISO role.”
— Andrew Wilder, (u/CyberInTheBoardroom)
Wilder’s point was as much about leadership culture as career strategy — it takes a strong manager to help someone grow past them.
“1. Absolute burnout — 2) Company was purchased by Private Equity — CISO/PE firms don’t mix well 3) Company was sold and exited as one of the owners 4) Still in the chair :)”
— Peter Clay, (u/cpthuah36)
Four CISO roles, four completely different exits. Clay’s answer is a useful reminder that no two transitions look the same, and the best leaders treat each one as data.
The playbook doesn’t travel — the instincts do
A question about whether CISOs need to rewrite their security playbook every time they change organizations drew one of the thread’s cleaner debates.
“Always the same playbook — only the scale/speed changes.”
— Peter Clay, (u/cpthuah36)
Clay’s starting framework is consistent across every role: understand the actual threat environment first, build and mature incident response, then prioritize by risk. The fundamentals don’t change — the context does.
“The short answer is no, and trying to do so is one of the fastest ways a CISO can fail. A playbook that worked at a high-velocity SaaS startup will cause an organ rejection if forced onto a 100-year-old insurance firm.”
— David Cross, (u/MrPKI)
Cross’s point isn’t that the playbook is worthless — it’s that assuming it transfers automatically is one of the fastest ways a new CISO loses credibility.
How to actually get a CISO’s attention as a vendor
A vendor-side community member asked what most reps are too afraid to ask directly: what actually works when reaching out to a CISO?
“A trusted relationship. Never selling. When we need something, we will reach out.”
— Andrew Wilder, (u/CyberInTheBoardroom)
Wilder’s answer is short because the point is simple — CISOs aren’t waiting to be sold to, they’re waiting to be helped.
“5 things will get my attention: an approach from somebody that I know/am connected to, teach me something I don’t know, solve my problem, don’t use FUD as a sales tool, be interesting — talk to me like an adult.”
— Peter Clay, (u/cpthuah36)
Clay was especially pointed on vendor comparison platforms: he doesn’t care where a product ranks, he cares whether it solves a problem he’s already working on.
The CISO/vCISO difference isn’t just a title
A community member preparing for a CISO-track career asked about the real difference between a full-time CISO, a retained CISO, and a vCISO.
“I have been a Regional CISO (Reporting to CISO), Retained CISO (Like a vCISO), CISO, and CSO. Each are different. For Retained / vCISO you act like a consultant borrowing on your experience to help bring Cybersecurity Executive knowledge to organizations that would not normally have a full time CISO.”
— Andrew Wilder, (u/CyberInTheBoardroom)
Wilder’s breakdown is a useful map for anyone building a security leadership career — the title is less important than understanding which kind of authority and accountability each role actually carries.
“My biggest piece of advice is to pay very close attention to listen to your customer — the difference between a CISO and VCISO in my experience is that the organization hiring the CISO has a higher degree of commitment to good cybersecurity outcomes.”
— Peter Clay, (u/cpthuah36)
The vCISO path, Clay observed, too often involves organizations that want minimum-viable compliance without giving security the authority to accomplish it. His bottom line: if a customer doesn’t want to walk away, run.
The job changes shape more than it changes substance
What comes through across all these exchanges is a picture of a role that is simultaneously more portable and more context-dependent than it looks from the outside. The core instincts — translate risk into business language, build trust before you need it, never assume last year’s playbook fits this year’s org — tend to survive the transition. The specific configurations, stakeholders, and threat models don’t.
For anyone moving toward their first CISO role, or considering their next one: the skills that carry you in aren’t the technical ones. They’re the ones that help you read a room, earn trust, and know which fights aren’t yours to have yet.
Next up: “I’ve built diverse, high-performing security teams. Ask me anything about hiring, culture, and talent management in cybersecurity.” The next CISO Series Reddit AMA kicks off Sunday, March 15 on r/cybersecurity. Follow the thread and come with questions.
Explore all our AMAs and more at ciso-dev.davidspark.dcgws.com.