Not every CISO started in a security operations center or a computer science lab. Some began with law books, communication studies, a history degree, or a part-time job behind a bank counter. The five CISOs below took routes into security that few would have predicted, and each has carried something from that starting point into the way they lead.
Chaim Mazal – CISO, GitLab
Before he led security at major technology companies, Chaim Mazal spent his days immersed in rabbinical study. “I spent, from a practical standpoint, 16 hours a day studying legal books,” he says, crediting that period with giving him an ability to focus intensely that he didn’t have before. He also took away a conviction that security leaders have to be optimists and a belief that “a little bit of goodness and kindness goes a long way.” His technical path began as a teenager in the hacker community, then ran through Microsoft technical support, penetration testing, and application security at Uptake, where he built his first team. He went on to become the first security hire at ActiveCampaign, building an engineering-first security team, then served as CISO at Kandji and chief AI and security officer at Gigamon, taking on broader technology responsibilities at both. In May 2026 he became CISO of GitLab, leading its global security organization, after eight years as a customer and five as an advisor. He holds a B.S. from the Rabbinical College of America.
Phillip Miller – VP & Global CISO, H&R Block
Phillip Miller holds a UK law degree, and that grounding still shows in his work. He is the author of Hacking Success, a book on information security policy and artificial intelligence, and takes part in privacy, ethics, and technology law forums. He joined H&R Block as VP and CISO in March 2025, after leading security at NetApp, advising large enterprises on cloud security at AWS, and serving as Brooks Brothers’ first CISO, where he had earlier run infrastructure and moved the company’s production SAP environment to the cloud. Before his recent appointment, he worked as an interim CISO for a Fortune 500 retailer through a divestiture. His security career stretches back to a decade as CISO and IT area manager at Sappi Fine Paper. Through his company, Qurple, he also runs a family farm in Virginia.
Amy Lahey – SVP, Administrative Operations & CISO, ALSAC
Amy Lahey studied communication, not computing. After earning a bachelor’s in communication studies, she started as a systems engineer and spent nine years at Hilton, leading quality assurance for e-commerce and for its property management system used in more than 3,500 hotels, managing payment application security certifications, and directing enterprise applications information security. She joined ALSAC, the fundraising and awareness organization for St. Jude Children’s Research Hospital, in 2011 to lead IT quality, then moved through change enablement, planning, and quality before building out its information security program. Since 2021 she has been senior vice president of administrative operations and CISO, defining ALSAC’s vision and strategy for information security. She later added a master’s in computer and information systems security.
Jennifer Swann – CISO, Bloomberg Industry Group
Jennifer Swann first thought about protecting data as a part-time bank teller in college. “It taught me about sensitivity of data and information,” she says. “Every account is sensitive.” Her first real foothold in security came as an infrastructure engineer at PNC, followed by a move into a security operations center at Northrop Grumman, where she discovered a passion for incident response. She went on to incident response roles at Under Armour and Exelon before joining Bloomberg Industry Group, where she expanded from incident response into product security, vulnerability management, and cloud infrastructure security, helping quadruple the size of the team. She became CISO in May 2025. “I really love building teams,” she says. She was named one of Security Magazine’s Most Influential People in Security in 2025.
Mike Patterson – CISO, University of Waterloo
Mike Patterson graduated with an honours BA in history and served for five years as a rifleman in the Canadian Armed Forces Primary Reserves. He joined the University of Waterloo in 2001 as a systems administrator, moved to supporting research computing in the School of Computer Science in 2003, and in 2009 became the first staff member in what has grown into Waterloo’s Information Security Services. In 2013 he became the university’s first manager of information security operations, and after serving as interim director of information security services, he was named CISO in 2026. He has co-chaired the CUCCIO Information Security Special Interest Group and serves on the board of the Center for CyberSecurity Operations in Research and Education.
The Long Way Around
Law, communication, history, religious study, and a teller’s window are not the usual starting points for a security career. Yet each brought something useful: the discipline of close study, an instinct for clear communication, a sense of how much data matters to the people it belongs to. Security leadership draws on more than technical skill, and the routes into it can be as varied as the people who take them.
Discover more CISOs securing their organizations:
-
- Making Security Spending Count: The CISOs to Watch
- Continuing the Mission: The Veteran CISOs to Watch
- When the Business Changes Shape: The Cyber Leaders Securing Deals, Splits and Growth
- Keeping Services Running: Canada’s Cyber Leaders to Watch
- Security Without Shutting the Door: The University CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.