From Coder to Chief: How Standard Chartered's Security Boss Runs Defence at a Global Bank
The bank's top security executive explains how the job has changed, why security leaders must speak business not just tech, and what artificial intelligence means for both attackers and defenders.
Key points
- Standard Chartered's group CISO (Chief Information Security Officer, the person responsible for protecting an organisation's data and systems) gave a video interview to Dark Reading outlining how the security leadership role is evolving.
- The CISO described a shift from purely technical work toward strategic, boardroom-level decision-making.
- Artificial intelligence is changing both sides of the contest: defenders are using it to spot threats faster, while criminals are using it to craft more convincing attacks.
- Banking remains one of the highest-value targets for cybercriminals worldwide.
What does a bank's top security official actually do?
Most people picture a cybersecurity expert sitting behind screens full of code. The reality at a major international bank looks very different.
Standard Chartered's group CISO described a career arc familiar to many senior security leaders: years of hands-on technical work, followed by a gradual move into strategy, budgets, and board-level conversations. The tools change. So does the audience.
At that level, the job is less about writing code and more about convincing executives to fund the right priorities before something goes wrong. That requires a fluency in business risk, not just in firewalls.
Why does business knowledge matter so much now?
Security teams that can only speak in technical terms struggle to win resources. Full stop.
A CISO who frames a request as "we need to patch this server" will lose ground to a colleague who explains "an unpatched server puts our customer data and our regulatory licence at risk." Boards respond to the second version. Regulators, increasingly, expect it.
That pressure is intensifying. Rules such as the United States Securities and Exchange Commission's cybersecurity disclosure requirements, which took effect for large public companies in December 2023, and the European Union's NIS2 Directive (a law requiring essential-service operators to meet minimum security standards, effective October 2024) both demand that senior leadership, not just the IT department, own security decisions formally and publicly.
How is artificial intelligence changing the threat?
AI cuts both ways, and that is the uncomfortable truth.
Defenders at banks like Standard Chartered use AI tools to sift through enormous volumes of alerts, flagging the ones that matter faster than any human team could. Response times shrink. Coverage widens.
At the same time, criminals are using the same technology. AI helps them write phishing emails (fake messages designed to trick staff into handing over passwords or clicking dangerous links) that are more convincing and harder to spot than ever before. It helps them probe systems for weaknesses at scale.
For ordinary bank customers, this means the fake emails or fake calls pretending to be from your bank are getting better. Treat any unexpected message asking you to click a link or confirm account details with suspicion, and contact your bank through the number on the back of your card instead.
Common questions
Does this affect my bank account?
Your money is not directly at risk from a security executive giving an interview, but the pressures they describe are real. Banks invest heavily in these defences because the consequences of failure, for customers and the institution alike, are serious.
What should I watch for as a customer?
AI-generated phishing messages are now harder to detect by eye alone. If you receive an email or text that creates urgency around your account, go directly to your bank's official app or website rather than clicking any link in the message.
