The Man Who Helped Build the CISO Role Explains What That Job Actually Takes

Key points

• Charles Blauner held the CISO (chief information security officer) role at JPMorgan, Deutsche Bank, and Citigroup across roughly two decades.
• The CISO title was created in 1994; Steve Katz became the first person to hold it in 1995.
• Blauner and fellow first-generation CISO Phil Venables have together mentored more than 120 security leaders who went on to hold CISO roles themselves.
• Resilience and communication matter more to a successful CISO than deep technical knowledge, Blauner argues.
• The CISO job is unlike any other senior leadership role because opponents spend their entire working day trying to find a way through.

Charles Blauner was a computer science graduate at a telecom research firm in the early 1990s when hackers started showing up. Companies panicked. Somebody had to be responsible.

Blauner got lucky. He stepped into information security at almost the exact moment the profession was being invented. By 1997 he'd become one of the first people in the world to hold the CISO title, and he went on to occupy that role at JPMorgan, Deutsche Bank, and Citigroup over roughly two decades. He discussed what he learned in a conversation first aired by Dark Reading.

Who actually invented the CISO role?

The title was created in 1994 and filled in 1995 by Steve Katz, now widely called the godfather of the profession. Nobody knew what the job was supposed to look like, because nobody had done it before.

"None of us had any idea what we were doing," Blauner says. "But we had a leader. And we had a visionary."

Katz established two habits that spread through the whole field. First, he pushed collective defence: security teams couldn't protect their organisations alone, so they had to share information across company lines. That idea eventually helped produce the Information Sharing and Analysis Centers, known as ISACs, industry bodies where companies pool intelligence about attacks. Second, Katz gave his time away. He mentored CISOs, salespeople, and anyone he believed needed guidance, right until the end of his life. That culture of paying it forward became a defining feature of the profession.

Between Blauner and fellow first-generation CISO Phil Venables, more than 120 security leaders have come through their combined mentoring networks. Our 24 July piece on the language gap between CISOs and their boards is worth reading alongside this one: the communication failures Blauner describes inside organisations look a lot like the problem that piece documents at the board level.

What does it actually take to lead a security team?

Technical ability gets you into the field. It doesn't, on its own, make you a good security leader.

Blauner is direct: resilience, communication, and business judgment separate effective CISOs from the rest. Every other senior executive faces competition and market shifts. A CISO faces all of that plus adversaries whose entire working day is spent looking for a breach. "That reality makes the CISO role unlike any other in the C-suite," he says, "and one of the most demanding."

For anyone early in a security career, his advice is to skip the single-mentor model and build a network instead. For those further along, the obligation runs the other way. At his last formal CISO job he ran an internal mentoring programme with one rule: to be a mentor, you also had to accept a mentee. You paid to get in by giving.

The pattern holds across the generation of leaders Blauner represents. On 21 July we reported on Andreas Gaetje, who runs security for a 13,000-person manufacturer and has never been, in his own words, a deep bit-crawler. The technical-versus-leadership tension Blauner describes shows up across the CISO community, not just in banking.

Should you worry about who's running your organisation's security?

Most of us aren't CISOs. But the banks, hospitals, and public services we rely on are only as secure as the people running their security teams.

A profession that treats mentorship and shared knowledge as core values tends to produce better-prepared leaders, and better-prepared leaders catch more attacks before those attacks reach customers' personal data. The question worth asking of any employer is whether a named person is actually responsible for security and whether that person has visible support from the top. That's not a question just for IT departments. It's for anyone whose information sits inside a company's systems.

The job Blauner helped define is still being defined. What he'd tell you is that the people doing it well aren't necessarily the ones who know the most code.