Some security leaders’ titles tell you their job is bigger than security alone. Privacy, identity, compliance, and technology risk now sit alongside cybersecurity in the remits of the five leaders below, at a hotel management company, a public university, a business data provider, a healthcare company, and Genesco. Each title combines responsibilities differently, and each shows how decisions about systems, personal information, and wider risk end up in the same hands.
Roy Mellinger – SVP, Security, Privacy, IT Risk & Compliance and Global CISO, Aimbridge Hospitality
Roy Mellinger began his career as a special agent and intelligence officer for the US government. Four decades later, his title at Aimbridge Hospitality covers security, privacy, IT risk, and compliance. He joined in February 2020 as global CISO during the company’s merger with Interstate Hotels and Resorts, with responsibility for security programs across corporate offices and hotel properties, and his role later expanded to include enterprise technology risk, disaster recovery, business continuity, compliance, and privacy programs including PCI, CCPA, and GDPR. In a 2025 account, he credited colleagues across the US, EMEA, and Latin America with implementing those programs across corporate locations and 1,600 managed hotel properties. His earlier career includes nearly nine years as CISO of Anthem, a stint as SVP and CISO at Sabre, and chief security officer roles at Sallie Mae and GE Capital. He has served on the HITRUST board since 2010, was part of the first FBI CISO Academy class, and has testified before multiple congressional committees on cybersecurity.
Matthew Martin – Chief Information Security and Privacy Officer, Western Carolina University
When Matthew Martin briefs Western Carolina University’s Board of Trustees on security and privacy, he does it in public sessions that are streamed live and open to the media and community. As chief information security and privacy officer since September 2025, he leads the program protecting university data, research, and more than 12,000 students, faculty, and staff, overseeing compliance with FERPA, GLBA, and state privacy rules, along with third-party risk and data governance. He has talked about using creativity to work within budget constraints and enable the university’s academic mission. He came from nearly eight years at LPL Financial, where he moved through information security and technology risk leadership roles to become SVP and deputy CISO, and then founded the advisory firm Two Candlesticks. He is also active in AI security, chairing the CISO advisory board at Trustwise, serving on the global advisory board of the Responsible AI Institute, and speaking at Black Hat’s AI security summits.
Jay DePaul – Chief Cybersecurity & Technology Risk Officer, Dun & Bradstreet
“AI doesn’t own outcomes; teams do.” Jay DePaul made that case in an April 2026 article arguing that “human-in-the-loop” oversight no longer fits AI agents that can plan, act, and adapt on their own. The alternative DePaul proposes, “human-at-the-helm,” has people set intent, define guardrails, monitor performance, and stay accountable, without approving every step. As Dun & Bradstreet’s chief cybersecurity and technology risk officer since January 2023, DePaul brings that technology risk lens to a company whose customers use its data and insights to make consequential decisions. DePaul has spent more than nine years at Dun & Bradstreet, rising from global SOC director to global head of cybersecurity operations and then SVP and platform CISO. Before that came more than 15 years at BNP Paribas, in technology roles that included CTO of BNP Paribas Financial Services and head of systems security and operations for North America.
Jason Richards – CISO, VP Information Security, Privacy & Identity, CHG Healthcare
Some organizations expect their CISO to play Gandalf, declaring “None shall pass.” Jason Richards has said that is not always the best approach, and that collaboration gets a company further. As CISO and VP of information security, privacy, and identity at CHG Healthcare since October 2023, he leads security across cloud, big data, SaaS, B2B, and HealthTech environments, with responsibilities spanning product security, risk, compliance, incident response, identity, and privacy. On measuring security, his view is that clarity creates metrics, not the other way around, and he has noted that in healthcare, protecting the confidentiality of patient records is a defining priority. He started in customer support and systems administration at Novell, then spent seven years at FamilySearch, rising from security engineer to information security officer for a global website serving millions of users. He went on to lead security at Domo and serve as CISO and VP of security and IT at Sword Health.
Steve Arrington – VP, Chief Information Security & Privacy Officer, Genesco
Steve Arrington started out as a financial analyst. After years in budgeting, financial systems, and ERP consulting, he moved into security consulting for Fortune 500 companies and served as a security architect for the Department of Defense at Arnold Engineering Development Center. Privacy has been part of his title for more than 15 years: at Gaylord Entertainment, he served as both CISO and chief privacy officer. He joined Genesco as CISO in 2013 and has been its VP, chief information security and privacy officer since 2019. According to Genesco’s 2025 corporate responsibility report, his remit covers information security, physical security, privacy, and compliance, and he reports to senior management and the board’s Audit Committee.
Five Combinations, One Direction
Mellinger’s title combines security with privacy, IT risk, and compliance. Martin pairs security with privacy and answers for both in public. DePaul joins cybersecurity with technology risk, Richards adds privacy and identity, and Arrington brings privacy together with information and physical security. The combinations differ, but each reflects a security role that has grown to cover how personal information, identity, and wider technology risk are managed.
Discover more CISOs securing their organizations:
-
- When Customers Depend on You: The Security Leaders Protecting the Services Businesses Run On
- Running It and Securing It: The Cyber Leaders Who Own Both Infrastructure and Security
- Security in Motion: The European CISOs Helping Businesses Transform
- From Policy to Practice: Europe’s Cyber Leaders Securing AI Adoption
- Everyday Services, Secured: The Adriatic and Western Balkans CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.