Becoming a CISO isn’t about being the most technical person in the room. Building on the success of last year’s sold-out panel featuring Jake Bernardes and Ray Espinosa, we returned to BSides Las Vegas on the 3rd August, for another session of our Root To CISO series. This year, we moved to a pure, live Q&A format because we realized that the best insights usually occur during the short Q&A windows of traditional talks. The result was another session where the conversation focused on leadership journeys and taking initiative.
The format was simple: no slides, no pitch, just audience-driven questions answered by three experienced security leaders, Yonesy Núñez, Johann Balaguer, and Jeff Bryner, alongside our very own CEO and cybersecurity recruiter, Kris Rides.
Here’s what came out of it, broken down by the questions people are actually asking about security leadership right now.
Do you need the title to start leading?
No.
This was one of the most repeated points of the session. The panel talked about what it looks like to step into leadership before anyone’s officially handed you the title: building trust with the people around you, taking ownership of problems even when they’re not technically yours, and supporting your colleagues in ways that make it obvious you’re ready for more responsibility.
This lines up with what we see constantly in our work at Tiro Security. When companies talk to us about who they want in a leadership role, while technical skill is important, it is rarely the deciding factor. They look at whether you have already been showing up like a leader, whether people already trust you, whether you have made the people around them better. If you’re aiming for that next step, the promotion usually follows the behavior, not the other way around.
When we evaluate leadership candidates, we look for concrete proof of these soft skills. We focus heavily on succession planning: Who have they mentored, and where are those people now? A strong leader should be able to point to a bench of talent they’ve developed.
Another telling indicator is the “follower effect.” The ultimate sign of a great leader is that the people they’ve worked with previously are willing to follow them to their next company. While this can be a difficult reality for the company losing that leader, it is the clearest validation of trust and impact. When we talk to clients about leadership roles, these are exactly the questions they ask, because they know that a true leader doesn’t just manage a team—they build a culture that people want to be part of.
What if the people you manage are more experienced than you?
This came up directly, and the panel was clear: leadership was never about being the most technical person on your team. Often, the real challenge is leading those who are more experienced than you, a situation that frequently triggers “imposter syndrome,” especially for those stepping into leadership roles earlier in their careers. The panel emphasized that effective leadership is about listening, removing obstacles, creating clarity, and helping the people who know more than you do their best work.
That led into a discussion on “servant leadership.” This philosophy flips the traditional structure; you cannot be a leader without a “tribe” that believes in you and is willing to follow your lead. At its core, this means serving your team to ensure they succeed, rather than expecting them to support you or make you look good. Some leaders mistakenly expect the team to absorb pressure and deliver results without receiving support in return, but the panel agreed that a leader’s job is to create the conditions for their team to thrive.
It is also important to note that leadership isn’t for everyone. Many professionals realize they prefer being hands-on individual contributors rather than managing people. Modern companies increasingly recognize this by offering career paths where individual contributors, such as a Security Architect, can be just as valued and compensated as a Director. This allows experts to continue growing their impact without being forced into management roles that don’t suit their strengths.
Does AI replace the skills that make a good security leader?
No.
Actually, AI came up very little during the session, a refreshing departure from the constant industry chatter that tends to dominate modern security discussions. Instead, the conversation remained centered on people, workforce development, and the human “moat” that distinguishes us from automated systems. The consensus was clear; while AI is an incredibly useful tool for boosting productivity, its primary value to a leader is the time it gives back. That recovered time should be intentionally reinvested into building the personal relationships and trust that AI simply cannot replicate.
If you’re job hunting right now, the advice is to remain open to using AI as a tool for efficiency, but never lose sight of the human fundamentals. The core skills that make a security leader effective judgment, empathy, and business understanding, remain unchanged and more vital than ever, no matter how the technical landscape shifts.
What do CISOs look for when hiring or promoting someone?
We have been recruiting for over a decade and these are the things most companies look at for leadership. Trust, ownership, judgment, and the ability to support a team rather than just lead it on paper. A resume can tell a hiring manager someone’s technically qualified, but it can’t tell them whether that person will build the kind of team that thrives. That’s the part of hiring that takes real conversations, references, and understanding a person beyond their job history, and it’s the part we spend most of our time on at Tiro Security, talking to hiring managers to find out what they are looking for, then talking to candidates to assess whether they match expectations.
As a cybersecurity staffing and recruitment firm, sessions like this one are a live version of the conversations we have every day. On one side, we talk to professionals figuring out how to move into leadership or position themselves for their next role. On the other, we talk to companies trying to build security teams and leadership benches that can actually hold up under pressure.
If you’re a professional working toward your first leadership role or your next CISO seat, what is that question you have always wanted to ask?
And if you’re a company trying to build a security team led by the kind of people that will make you business and team thrive, welcome to Tiro Security. These are exactly the conversations we have every day.
Reach out at (424) 216-8476 or send us an email at info@tirosec.com and let’s talk about your hiring needs.