- If ChatGPT produces AI-generated code for your app, who does it really belong to?
- The best iPhone power banks of 2024: Expert tested and reviewed
- The best NAS devices of 2024: Expert tested
- Four Ways to Harden Your Code Against Security Vulnerabilities and Weaknesses
- I converted this Windows 11 Mini PC into a Linux workstation - and didn't regret it
Developing a security coaching tree
Former NFL coach Bill Parcells’s coaching tree — consisting of assistant coaches who went on to become head coaches in their own right — is legendary. Parcells hired and trained Bill Belichick among 14 head coaches who have collectively won nine Super Bowls. One of today’s most powerful coaching tree branches out from Chiefs head coach Andy Reid, who himself sprouted from the legendary Bill Walsh tree.
Does the corporate security world have its own version of coaching trees — chief security officers (CSOs) whose deputies or other staff went on to become heads of security or executive leaders at the same organization or elsewhere? I revisited my 30 years of working with corporate security departments and consulted with experts with extensive knowledge of corporate security leadership to find out.
Opinions differ, but the upshot is that coaching trees may not be as prevalent as one would expect. “I’m not sure there is a… coaching staff tree in the security world today,” says Scott Lindahl, the CSO of the Kellogg Company and the President of ISMA. “With so many CSO roles being filled by second-career folks (post-FBI, Secret Service, etc.), there hasn’t been a great bit of a succession planning and development to the CSO role.”
If there are analogs to the Parcells and Walsh trees, they might be ones that started with either the late Don Walker or Ray O’Hara. Many of today’s leaders ascended under their tutelage.
To the extent they exist, one of the most bountiful trees emerged from Baker Hughes starting almost two decades ago. Russ Cancilla hired a bumper crop of talent, including, among others, Joe Olivarez, Brian Hogan, Joe Walters, and Josh Walker. After more than a decade rising through the ranks at Baker Hughes (and helping to recruit some of the aforementioned professionals), Olivarez now serves as CSO and VP, Operational Center of Excellence for Jacobs. Hogan followed his stint at Baker Hughes by landing senior roles at major corporations; he’s now CSO at LyondellBasell. Walters leapt from Regional Director, North America at Baker Hughes to become the top security executive at NRG Energy. Once head of crisis management and business continuity at Baker Hughes, Josh Walker runs the security program at Bridgestone Americas.
During the same time period, Capital One had a remarkable run of deputies who are CSOs today. Don Childers (now with PayPal), Dave Aflalo (McKesson), Steve Braden (Comerica), Patrick McCarthy (SlapShot Entertainment), Sean Turner (TD), and Sarah Slenker (Gartner) were among those minted by the bank under CSOs Tim Janes and Timothy Rigg.
At Target, Brad Brekke begat Bill Tenney (MetLife), Nick Lovrien (Meta), Mike Rackley (Nike), and Craig D’Souza (confidential employer).
Still, Lindahl says he sees relatively few deputies get CSO opportunities at other organizations. One exception has been Marco Mille’s direct reports at Siemens, he says.
Are Baker Hughes, Target, Siemens and Capital One the rare exceptions? What accounts for such runs of talent? Is it careful recruiting, incentivizing, and development? Is it that opportunities are limited at many companies, so the best professionals leave? Is it a matter of luck or happenstance? Why don’t companies with dozens of senior security executives churn out more senior security executives?
It’s likely a combination of mindful recruiting/development, limited opportunities, happenstance and other factors.
Executive recruiter (and fellow columnist) Jerry Brennan says that security coaching trees may not be as obvious or cohesive as NFL coaching trees due to head coaches having much more influence and authority on their teams than security professionals have in their corporations. A CSO may groom a successor, but executive management might have someone else in mind, or wish to move or overhaul the security department once the incumbent CSO leaves.
In addition, Brennan says, “CSOs might repress their deputies. They may not want them to succeed [for fear of getting replaced] or it may not be intentional — deputies are just not paid attention to.” Ignoring assistant coaches in football, by contrast, rarely leads to a successful season.
Moreover, it’s easier to measure the success of a coach than of a CSO. Wins and losses are simpler to assess than losses prevented or other, perhaps murky, metrics.
Brennan and Jacobs CSO Joe Olivarez agree the most fertile environments for security professionals is where the senior security executive “leads up”’; that is, communicates with and provides value to business line owners and executives in other departments.
For example, Olivarez recalls advising Jacobs executives on centralizing Health, Safety and Environment departments in light of company divestitures. “They bought into that idea — not just my boss, but the COO and CEO.”
Unfortunately, Brennan says, many CSOs are “mentally siloed. They don’t understand the infrastructure of the company — administration, purchasing, supply chain, vendor management.”
Adds Olivarez, “Can you run a budget, influence a board, interconnect with enterprise risk?” The best developers of security talent assist their protégés with these non-security skills, he says.
He credits his development to Cancilla, who set him up to report to business leaders. “If you can’t deliver to those operational leaders as a business enabler, you aren’t going to last.”
Olivarez says his purpose as a leader is to help others grow, as Cancilla did with him.
“I prepare them for being in a position to compete for a CSO role,” Olivarez says. “It’s not just about the technical ability of the craft. It’s about prioritizing real relationships, learning how to connect, to influence…. It takes time and willingness.”
CSOs might look to successful coaches like Mike Shanahan, Andy Reid, and Bill Walsh. The Xs and Os of game play are just a fraction of what they do. Like security professionals, they must also motivate, communicate effectively with superiors, navigate adversity, deal with public scrutiny, protect their staff, and convey positive influence.
That’s their legacy. What will be yours?
