Defense in Depth CISOs Have to Be Technical. Why Is This Even an Argument?
10 snips
Nov 12, 2026 Colin Anderson, SVP and CISO at Dayforce and former security leader at Levi Strauss and Safeway, joins a lively debate on what makes an effective CISO. They explore technical competence versus executive leadership, pragmatism over dogma, resilience during disruption, and why security leaders must translate risk into business outcomes. The conversation also compares the needs of large enterprises and smaller organizations.
AI Snips
Chapters
Transcript
Episode notes
CISOs Emerged From Two Career Tracks
- CISO careers developed along two tracks: governance-focused leaders from regulated industries and technology-focused leaders under CIOs.
- Modern security leadership increasingly combines evidence-based risk management with application and tooling expertise.
Security Must Become A Business Value Proposition
- Technical depth loses influence when leaders cannot connect security work to business outcomes.
- Executive teams resist funding security as an endless cost center without a clear business-risk rationale.
Colin Anderson Learned Board Communication The Hard Way
- Colin Anderson learned executive communication after becoming a young Fortune 50 CISO and suddenly facing board scrutiny after the Target breach.
- His later Levi’s role made security’s connection to online sales and store operations unmistakable.
