How to bridge the CIO-CISO divide: Insights from Macquarie Group’s former tech & cyber chief

David Gee, former Global Head of Tech, Cyber & Data Risk at Macquarie stresses the importance of shared responsibility and open communication to overcome the tension between CIOs and CISOs amidst rising cyber threats.

Well known Australian tech and cyber executive David Gee retired last month after a career spanning over 40 years in various roles across multiple countries, most recently serving as Global Head Technology, Cyber & Data Risk at Macquarie Group.

David was never happy to be stuck in any role and during the 1980s, he decided against what may have been the easiest choice of working in tech at a bank and taking advantage of a “half price” housing loan.

At one stage, he declined a partnership at consultancy EY, choosing instead to pursue global CIO positions at pharmaceutical giant, Eli Lilly and Company, where he stayed for more than 14 years.

The above video is only an excerpt. Only ADAPT Advantage clients can watch the full video on a Day in the Life of a CIO.

“Transforming myself was always my goal…when I had that first opportunity to be a CIO and walk away from EY was a hard choice for me to make. Going into that job, they said, ‘Dave, you are going to be a CIO, we will put you through an MBA, send you overseas, which is what I did.’”

This reinforced a pattern in his career where he would stay in a role for a few years, build a strategy and team, execute on a 90-day plan, find a successor and move on.

“I did that for 15 years in five locations and five CIO roles,” he says, referring to his stint at Eli Lilly and Company.

Tension between two key roles

ADAPT’s data suggests that the priorities of CIOs and CISOs are closer than they have been as cyber criminals turn their attention to Australia.

David says that governments and regulators are putting pressure on boards and management to strengthen their cyber postures, but there remains a fundamental tension between CISOs and CIOs.

He was in CISO roles at HSBC and Macquarie Group. During that time, he was surprised how CIOs in different organisations “don’t get security”, how they see it as being in conflict with their own roles.

“They [CIOs] have got their agenda items too – to keep digital transformation going…so creating friction can be difficult for a CIO because their stakeholders don’t want friction. So, there’s a counterbalance. That surprised me because I was always a CIO that cared about cyber security deeply.

“It is what it is, we just need to make sure that people are joined up at the hip and understanding…how these things fit together and how we have to share responsibility. Once people understand that rather than pointing the finger, then we are going to get things done.”

Share and share alike

CISOs working at different organisations are increasingly sharing their cyber learnings. David says the cyber community is stronger if it shares intelligence, particularly around third-party concerns.

During this first month at HSBC, David was asked to do a four-hour cyber briefing to 65 key stakeholders at the bank. It worked well and was a session that ended up being duplicated every month at HSBC where people were given the opportunity to discuss and ask questions about cyber challenges.

“It was about being totally transparent and honest about where we are and saying, ‘we need to get this done, otherwise we won’t be able to overcome the issues we are having as an organisation.’”

“That worked well because people wanted to be engaged, they wanted to be smarter about things versus reading about it in a report. I am a big believer in that approach,” he says.

Know the buyer’s motivations

Finally, David has some pertinent advice for sales execs looking for better ways to connect with the CIO and CISO personas. He says that CIOs tend to have a two to three-year average life at an organisation, CISOs one to two years.

According to Gee, the first questions that sellers need to ask are: Where is this person you are talking to in their career? Have they just started, are they trying to prove themselves? Are they at the end of their career and probably more conservative?

He says that sellers need to identify the buyer’s motivations. Are they looking for something that’s safe because they are worried about their careers? Or something that’s a big hit, a win that they can take to their next job?

“Some of that thinking around these stakeholder management aspects of it are important,” he says.

He also advises that sellers think about who influences the CIO and CISO buyers to determine “where your solutions fit in.”

“I jokingly always talk about [the fact that] vendors are never in my 90-day plan. The truth is that you would talk to specific vendors in your first 90 days, but you won’t actually go in and try to meet all of them.”

The sweet spot for sellers, he says, is understanding if an organisation has an existing strategic roadmap and what it will look like 12 to 15 months down the track.

“If there’s a roadmap in place and you are trying to plug a product in…you are wasting your time. If it’s three years out, it could be speculative.”

“There’s a sweet spot around a bit more than 12 months, 15 months and a is person saying, ‘I am really interested in this widget and I’ve got my radars up for ideas around whatever that is.’ That’s where you will get some traction from CIOs and CISOs saying, ‘I’m interested in that topic, talk to me about that.’”

The above video is only an excerpt. Only ADAPT Advantage clients can watch the full video on a Day in the Life of a CIO.