The Evolving Role of the CISO

CISO Roundtable Series:
The Evolving Role of the CISO

Join the NextDefense Era and Scale Your Organisation with Confidence

Telefónica Tech, July 2025

From Technologist to Business Leader: The Evolving Role of the CISO

In our latest CISO Roundtable, held under Chatham House Rules, two senior security leaders from the manufacturing and financial services sectors shared candid reflections on the emotional, strategic, and operational realities of modern security leadership. This conversation forms part of our ongoing series spotlighting the lived experience of CISOs navigating high-pressure, complex environments. What emerged was a clear picture of how the CISO role is evolving. From a purely technical guardian to a strategic business leader, balancing risk, resources, and resilience.

Risk as a Shared Business Decision

Risk tolerance and ownership emerged as key discussion points. While technical teams may surface risks, the decision to accept or mitigate them must sit with the right business stakeholders.

One attendee highlighted the importance of being transparent about what risks are being accepted, and by whom. “You need a clear paper trail. It’s not enough to say a risk was flagged. Someone needs to own the decision.”

The discussion underscored that risk is not a black-and-white technical problem. It’s a business negotiation, requiring clarity, maturity, and confidence in cross-functional conversations.

Strategic Prioritisation in Complex Environments

Both CISOs described the ever-growing scope of responsibility and the constant pressure to manage competing priorities. In complex, resource-constrained organisations, clarity is critical.

They discussed how they use internal frameworks and communication tools not only to prioritise day-to-day tasks but to focus their teams on the work that aligns with longer-term security and business goals. “It’s not about doing everything, it’s about doing what matters,” one said.

Stakeholder communication plays a pivotal role here. CISOs must help the business understand the downstream impact of security decisions on contracts, continuity, and customer trust. In short: security is a business function, not just a technical one.

Supporting Teams Under Pressure

The human side of leadership featured heavily. Both speakers acknowledged the emotional demands placed on their teams, particularly in always-on security roles where 24/7 availability is often the norm.

Team wellbeing, career development, and creating psychological safety were described as essential leadership duties, not nice-to-haves. Trusted teams, they noted, make better decisions and reduce the noise and volume of unnecessary escalations.

One reflected: “You want people to feel like they can go to the gym, do the school run, have a life. And still know they’re trusted to deliver when it matters.”

Speaking the Language of the Business

Both CISOs spoke openly about their personal journeys transitioning from technical experts to business leaders. Early in their careers, they leaned heavily on technical depth. But as they advanced, they had to shift learning to talk in terms of budget, revenue, and risk to the organisation, not just the system.

This evolution enabled them to earn board-level buy-in, position security initiatives in terms of strategic value, and secure the resources they needed.

Their advice? Learn the language of the CFO, the COO, and the Head of HR. Understand what matters to them and tailor your narrative accordingly.

Evolving Role of the CISO

“

“Your legacy isn’t how many policies you wrote. It’s the people you helped grow, and the culture you created.”

Making Hard Calls in a Resource-Constrained World

The CISOs also reflected on the discipline of knowing when to say “no.” Sometimes, the smart move is to halt an initiative rather than stretch the team too thin or deliver something misaligned with strategic goals.

Budget pressures often make this harder. But there was consensus: focusing on high-value, long-term outcomes is more effective than chasing short-term savings that risk technical debt or burnout.

Looking Beyond the Security Bubble

Networking and relationship-building outside of the immediate technical team were also seen as critical. “The people who really help you get things done are often in audit, finance, HR,” one CISO noted.

By building alliances across departments, security leaders gain influence and anticipate challenges earlier. And by socialising ideas before formal reviews, they’re better prepared to communicate persuasively when it counts.

Trust, Legacy and Learning

As the discussion drew to a close, both CISOs shared their key reflections about security leadership:

It’s relentless: Unlike other functions, there’s rarely a “done” state in security.
It’s emotional: The stakes are high, and failures are often personal.
It’s a team sport: Trust is the currency of a high-performing security function.

They also spoke about the importance of grounding strategy in real-world experience—whether from time spent on help desks, site roles, or direct engagement with users and the need to remain curious, humble, and open to learning.

As one summed up: “Your legacy isn’t how many policies you wrote. It’s the people you helped grow, and the culture you created.”

A man smiles at the camera while sitting with a laptop

Find out about NextDefense

Start your journey towards secure digital resilience with NextDefense, our next generation of advanced managed security and SOC services. At Telefónica Tech, we understand the evolving threats that organisations face in today’s digital era. That’s why our suite of proactive security, defensive strategies, and expert consultancy are designed to combat emerging cyber security threats and guide you towards a secure, safer future. Our sustainable model of advanced security capabilities is aligned to the changing threat landscape, so you can confidently navigate the digital landscape, knowing that resilience is embedded from the cloud to the edge.

Learn more about NextDefense

Explore our Events

Our CISO Roundtable Series brings together experienced security leaders from diverse industries to share perspectives on leadership, risk, resilience, and the human side of cyber security. All discussions are designed to encourage honest, practical exchange.

Explore our Events