Resilient Cyber - Episode 13 - Carlota Sage- vCISO Challenges, Solutions, and Collaboration

Overview:

In this episode of the Resilient Cyber Podcast, hosts Chris Hughes and Dr. Nikki Robinson interview Carlota Sage, a seasoned cybersecurity professional with a diverse background in IT operations, support operations, and security strategy. Carlota shares her journey from web development to becoming a vCISO (virtual Chief Information Security Officer), highlighting the unique challenges and rewards of working with small and nonprofit organizations. The conversation delves into the intricacies of building security programs, the importance of aligning security with business objectives, and the emotional intelligence required to navigate the complex relationships within organizations.

Highlights:

1. Carlota’s Career Journey: Carlota discusses her transition from web development to knowledge management and eventually into cybersecurity, emphasizing her experience at FireEye and her role as a vCISO for nonprofit organizations.

2. Understanding the vCISO Role: She explains what it means to be a vCISO, the responsibilities involved, and the importance of providing strategic security advice to organizations that may not yet be mature enough to hire a full-time CISO.

3. Challenges in Building Security Programs: Carlota shares insights into the difficulties of getting technical teams to align with business objectives and the importance of social engineering and emotional intelligence in her role.

4. Rewards of Working with Nonprofits: She highlights the satisfaction of making an immediate impact in smaller organizations and the ability to share her learnings with the broader security community.

5. Advice for Aspiring vCISOs: Carlota offers guidance on how to break into the vCISO space, emphasizing the importance of building relationships, understanding client needs, and approaching the role with empathy and emotional intelligence.

6. Cyber Resilience Perspective: The discussion wraps up with Carlota’s thoughts on cyber resilience, focusing on the inevitability of failure in cybersecurity and the importance of learning from those failures to build a resilient organization.