TL;DR
- You do not have to feel completely ready for leadership before exploring an opportunity that could grow you into it.
- Moving beyond technical security work means understanding how the business operates, what it needs and what risk it is willing to take.
- Good leaders make room for people to contribute, grow and challenge an idea before it becomes a decision.
- Security works best when it helps the business move forward responsibly, rather than becoming the department that only says no.
Rick Scott did not think he could be a CISO.
While travelling back from RSA with a former CISO who was stepping into a CTO role, Rick watched him delete the tools and apps that had been part of his day-to-day work for years. Looking at the weight of the role from the outside, Rick said, “Gosh, I don’t think I could ever be a CISO.”
Around 18 months later, when an opportunity to become CISO at Elevate Textiles came up, his first thought was “Goodness no”
But he still chose to have the conversation. After speaking with the leader who would become his boss, Rick left wanting the role. Nine months later, when the company’s CIO stepped down, he was asked to take on that responsibility as well and he said yes so what changed?
Perspective.
This experience is an important part of Rick’s story because plenty of people look at leadership that way. You can be good at your work, trusted by colleagues and steadily building experience, yet still struggle to picture yourself in the role above you. The responsibility seems bigger, the decisions feel heavier and you are aware enough of what you do not know to wonder whether you could really handle it, but you do not need to have every answer before you take the next step.
You need to be willing to learn what the next step requires.
His experience offers a useful lesson for anyone trying to move from being technically capable to becoming someone trusted to lead.
Leadership starts before you are given the title
There is a tendency to think leadership begins once you become a manager. Before that, you are expected to learn your job, deliver your work and wait until somebody decides you are ready but in reality, the habits that make someone a strong leader often begin much earlier.
Rick spent years working across different parts of technology before he moved fully into security. He worked with data, supported business teams, managed technology in a line of business and became the person helping the business and development teams understand one another. None of those roles was a direct route to becoming a CISO, but each one taught him something he later needed: how systems are used, how people make decisions, how information moves through an organization and how different teams can see the same problem differently.
That is worth remembering if your current role does not look like the one you eventually want. Your work may be teaching you more than you realize, especially if you pay attention to the problems around you rather than focusing only on the tasks in front of you.
You may not be ready to lead a department today, but you can begin building leadership by taking responsibility for a difficult piece of work, helping someone else understand something you have learned, asking better questions when a problem comes up or becoming known as someone who follows through.
People rarely trust you with more responsibility because you say you want it. They trust you with more responsibility because they have seen how you think, how you handle uncertainty and how you respond when something needs to be done. You’ve already stepped into that role, even before you have it
Do not walk into a new environment with an edict
Another important things is learning and unlearning. Experience can help you recognize problems quickly, it can also make you assume that the way you handled something before is the way it should always be handled.
When Rick moved from a heavily regulated banking environment into a non-regulated company, he initially found himself reacting to processes that would not have been allowed in his previous role. His instinct was to see what needed to change.
Then he realized that he first needed to understand why those decisions had been made.
The people around him had worked in the business for years. They understood the history, the processes and the realities of operating in that environment. Rather than coming in with an instruction, Rick started asking questions: Why are we doing it this way? What are the implications of this model? What problem was this process designed to solve? and that was a sign of someone who understands that context matters.
A new leader may have more experience in a particular area, but they do not automatically have more knowledge about the organization they have just joined. Taking the time to listen protects you from making changes that look sensible from the outside but create problems for the people doing the work every day.
Before changing a process, take time to understand what is already working, what has already been tried and what people need from you. You will make better decisions, and you will also show your team that you respect the experience they bring.
Leading people is not about making everyone work like you
One of the most useful parts of Rick’s advice on being a great leader is learning how to lead people differently.
It is easy to fall into the habit of giving everyone the kind of support you would want yourself. If you like regular conversations, you may assume your team needs regular conversations. If you prefer close involvement, you may see someone who wants more independence as disengaged, but people work differently.
Some of your direct reports may want regular discussions and guidance, while others simply want to know what is expected of them and be trusted to do the job. Your responsibility as the leader is not to lower expectations for one person or put more pressure on another. It is to understand what helps each person do strong work.
That also means being careful about how your own communication affects the people around you, because you can care deeply about an idea and still create space for someone else to improve it. You can be decisive without making people feel as though disagreement is pointless.
As a leader, ask yourself whether people can challenge you without worrying about how you will react. If they cannot, you may never hear the concern, the alternative idea or the early warning that could have helped the team avoid a mistake.
Mentoring teaches you how to lead
if you want to be a good leader, learn how to mentor.
Mentoring is sometimes treated as something you do once you are senior enough to have a long list of achievements behind you, but it is also one of the ways you become a better leader in the first place.
When you mentor someone, you learn how to listen to what they actually need instead of jumping straight to your own answer. You learn how to explain your experience in a way that helps another person make a decision. You learn that supporting someone does not mean choosing their path for them and Rick carries that into his leadership style.
He sees his role as supporting people in what they want to do, even if their next opportunity eventually takes them outside his own team and that is not always easy. As a leader, you want to keep good people, but people are more likely to trust and grow under a leader who is genuinely invested in their development, not only in what they can produce for the current organization.
You do not need a management title to begin practicing that. You can mentor someone who is earlier in their career, help a colleague prepare for a difficult task or share what you have learned after completing a project. The more you practice helping others grow, the more you develop the patience, communication and judgment that leadership requires.
What’s the fun part about being a CISO
When people imagine the CISO role, they often think about pressure, incidents and difficult decisions and while that comes with any leadership role, for Rick, the fun part is all in the collaboration.
For him, the value comes from being part of a community of security practitioners who can share what they are seeing, talk through problems and learn from one another and that kind of collaboration matters because cybersecurity is not a field where one person can know everything. The threat landscape changes, technology changes and organizations are constantly balancing new opportunities with new risks so you need people around you who will challenge your thinking, share what they are learning and help you see what you may have missed.
There is also a particular satisfaction he finds in stopping something before it becomes a bigger problem. When a control works, a process catches an issue or a team prevents an incident from escalating, it is proof that the work behind the scenes is doing what it should.
Most people will never know that something did not happen and in security, that’s a very good day.
What would you tell your younger self?
Rick’s advice to his younger self was to be less hard on himself, accept that failure can happen and listen more than he talks. When you’re early in your career, there can be a real urge to prove that you know what you are doing. You want to contribute quickly, demonstrate that you understand the topic and avoid looking as though you have nothing useful to say.
But trying too hard to prove yourself can work against you. You need to listen more than you talk
Listening does not mean staying quiet or pretending you do not have a point of view. It means giving yourself enough time to understand what somebody is actually saying before deciding how you want to respond and that becomes even more important in leadership. You cannot understand what your team needs, what the business is trying to achieve or what a risk really means if you are already preparing your answer before the conversation is over.
The ability to say, “I do not know,” ask for help and stay open to another perspective does not make you less capable. It usually makes you more useful.
What you can take from his story
Rick’s story is not about someone who had always planned to become both a CISO and CIO. It is about someone who kept learning, accepted opportunities that stretched him and gradually built the experience needed to take on more responsibility.
If you are looking ahead at a role that feels beyond you, do not dismiss it simply because you cannot yet see yourself doing every part of it. Have the conversation. Learn what the role requires. Pay attention to the team, the environment and the opportunity to grow.
At the same time, keep building the habits that will make you ready when an opportunity does come: understand the business around you, explain risk in a way people can use, listen before making changes and help other people develop alongside you.
Technical ability may get you into cybersecurity but learning how to work with people, guiding decisions and enabling the business is what turns that ability into leadership.
Watch both part 1 and part 2 of the conversation with Rick Scott on the Root to CISO YouTube channel for more on cybersecurity careers, leadership, business enablement and building a career that keeps expanding. things