TL;DR
- Practical experience helps you understand the work you want to do and gives employers evidence of what you can contribute.
- You can demonstrate leadership before becoming a manager by taking responsibility for a problem and following through.
- Growing into cybersecurity leadership means learning to support people, communicate clearly and offer workable options when something carries risk.
- A bigger title does not always mean a better opportunity, so consider the responsibilities, learning and environment behind your next career move.
- Before accepting a CISO role, understand the risks you will inherit and whether the organization will support you in addressing them.
If you are trying to move forward in cybersecurity, you have probably wondered whether you need another certification, more experience or simply someone willing to give you a chance.
Once you are working in the industry, that question can become more complicated. You might be doing your job well but wondering how to earn more responsibility, whether you are ready to lead or whether your next move needs to come with a bigger title.
Across two episodes of Root to CISO, the host, Kris Rides explores these questions with Yonesy Núñez, a six-time Chief Information Security Officer, currently a CISO at Surf AI whose experience offers useful lessons for anyone navigating those decisions.
The thread running through the conversation is that career growth comes from giving people a reason to trust your judgment, your contribution and your ability to follow through.
How do you build cybersecurity experience before your next opportunity?
Working toward a qualification can help you understand a subject, but applying that knowledge helps you discover what the work actually involves and whether you enjoy doing it.
That was an important part of Yonesy’s early career. While studying, he was already building networks, supporting computers and helping people solve technical problems. When he questioned his original plan to become an accountant, those experiences helped him recognize that computing was something he genuinely wanted to pursue and by graduation, he also had something useful to bring into hiring conversations: he could explain work he had already done, rather than only what he had studied.
If you are early in your cybersecurity career, consider which opportunities would let you develop that same confidence. Look for work that gets you closer to the field, work that can help you learn its expectations, understand your strengths and speak more clearly about what you can offer.
Of course, you still need to pay your bills, and the conversation acknowledges that not everyone can afford unpaid or lower-paying work that is within they trajectory they’d like to go with, but if you have a choice, it is worth considering both what an opportunity pays now and what it could help you become capable of doing later.
Are cybersecurity certifications enough to help you progress?
They kept circling this question as its commonly asked and Yonesy shared from his experience that a certification can support your credibility, but you still need to show how you use the knowledge behind it. After attending a SANS conference, he shares that he applied what he had learned at work and identified security weaknesses. When he suggested bringing someone in to fix them, his boss gave him the responsibility instead, which helped move his career from systems engineering into information security.The measures he introduced later helped protect the organization during major worm outbreaks, giving his employer a clear reason to value his work.
That is the connection you want to make between learning and career growth: what can you now understand, improve or solve that you could not before?
In his case, certifications came after practical experience and further education, providing external validation of knowledge he was already using. Your sequence may be different, but the question remains useful: before pursuing another qualification, think about what you know, where you will apply it and how you will explain its value.
You do not need a leadership title to demonstrate leadership
You might be waiting for a promotion before you feel able to take ownership, but people often begin seeing your leadership potential through how you respond to an ordinary problem. One of the most memorable examples in the conversation starts with Yonesy’s student job folding mail. When the programmer responsible for a university fundraising system left, an important campaign was at risk because nobody else knew how to run it.
Yonesy offered to help, spent the weekend learning the programming language and got the system working. That led to more responsibility, higher pay and the opportunity to bring others in to support the work.
Offering to help becomes meaningful when you follow through, because that is what gives a colleague or manager confidence that they can rely on you again. You do not have to know everything before stepping forward, but you need to be honest about what the work will require and be willing to learn what is missing to complete the job.
So, what makes someone an effective cybersecurity leader?
As your responsibilities grow, your success increasingly depends on whether the people around you have what they need to do their work well. That means listening to your team, understanding what is getting in their way and creating opportunities for them to develop. The conversation describes this through servant leadership, where the leader supports the team and builds an environment in which people can contribute.
There is also a useful distinction between expecting people to be the best and helping them get better. When improvement remains part of the work, people have room to ask questions, take on new challenges and keep developing rather than feeling they must already have every answer. If you are leading a team, consider whether people feel supported enough to do that. If you are choosing your next employer, pay attention to whether the organization offers that kind of environment, because your growth will be influenced by the people and expectations around you.
How do you push back without becoming the “office of no”?
They talked about taking ownership but made sure to clarify that taking ownership does not mean accepting every request, especially when a commitment needs more investigation, resources or specialist expertise than you currently have.
As a cybersecurity leader, you need to be deliberate about what you promise, while helping the business understand how it can move forward safely. When a request carries risk, a more useful conversation explains the available approaches, what each would require and the consequences of choosing one over another. Deciding not to proceed can be one of those options, but people should understand what that decision means too.
This is a skill you can practise long before becoming a CISO. If your manager asks for something difficult, explain the constraints and suggest alternatives that address the underlying need. People are more likely to trust your judgment when you help them make an informed decision, and that starts with understanding what they are trying to achieve as well as what you are trying to protect.
How can networking help your cybersecurity career?
Building relationships gives people an opportunity to understand your contribution beyond what appears on your résumé.
In Yonesy’s case, a conference presentation led to his first CISO role simply because a CIO heard him explain difficult concepts clearly and recognized someone who could help the organization. That opportunity grew into responsibility for building a security function across 25 locations.
You may not be pursuing a CISO position, but the same principle applies when you share knowledge, contribute to professional communities or have useful conversations with people in the industry. Rather than approaching every interaction as a search for a job, think about what you can contribute and what you can learn and over time, those relationships give people a fuller picture of how you think and work, which can make it easier for them to recognize when an opportunity suits you.
Does your next career move need a bigger title?
A title can tell you something about a role, but it cannot tell you everything about its scope or its value to your career. CISO responsibilities vary considerably between organizations. One position may involve hands-on engineering and building a small function, while another may focus on strategy, risk or leading a much larger team.
Changing industries can also mean developing knowledge that your previous role did not require. Yonesy’s move from manufacturing toward financial services included consulting, education and a deputy role before returning to a CISO position which brought about the conversation of taking a step back when entering a new industry just so you can familirize and learn as you build towards your goal.
If your next opportunity looks sideways on paper, consider what you would actually gain from it. A role with broader responsibilities, unfamiliar challenges or stronger support could help you progress more than a familiar title in an environment where you have stopped learning. You can try consulting or fractional work as ways to work across different businesses and build experience. The important question is whether the opportunity fits the direction you want to grow.
What should you understand before accepting a CISO role?
Before taking responsibility for an organization’s security, you need to understand its existing problems and what leadership knows about them.
That includes reviewing previous external assessments, regulatory findings and incidents, as well as understanding longstanding technical debt and risks that have already been accepted. You should also ask how clearly those issues have been communicated to the board, because expectations about what a new CISO can achieve may be very different from the reality of the environment.
As Yonesy shares how the experience of arriving in a role and dealing with an incident from the previous tenure during the first week, we see how difficult circumstances can give you an opportunity to contribute, but you need enough visibility to assess what you are taking on.
What can you do with this advice now?
You do not need to have your entire cybersecurity career mapped out to make a useful next move, but it helps to be deliberate about the experience you are building and the responsibilities you are accepting.
Look for work that lets you apply what you know, contribute where you can help and learn to explain your thinking in a way other people can use. As you progress, keep asking whether you are still growing and whether the people around you are able to grow too because those habits give others a reason to trust you with more, while helping you recognize which opportunities are right for you.
Watch both parts of the conversation with Yonesy Núñez on the Root to CISO YouTube channel for more on building experience, leading teams and navigating cybersecurity career decisions.