Stop Waiting For Opportunities And Start Taking Initiative | Root To CISO Podcast

Most people are waiting for the "right opportunity” but most times, you have to create the opportunity yourself.

In this week's episode of the Root to CISO podcast, Zachary Lewis breaks down how taking initiative early completely changed the trajectory of his career. From fixing computers in high school to stepping into leadership roles across IT and cybersecurity, he had never been one to just wait for the opportunities he wanted.

He approached companies directly, started a side business before even graduating, took on extra roles just to learn, and worked night shifts while building his experience. None of it was part of a perfect plan, but it all compounded.

If you’re trying to break into cybersecurity, IT, or level up in your career, this episode shows what actually makes the difference. It’s not just skills or certifications, it’s what you do when no one is asking you to step up.

They also chat about:

•  How to create opportunities instead of waiting for them 
•  Why early initiative matters more than experience 
•  The real reason some people progress faster than others 
•  How taking on “extra” work can accelerate your career 
•  Building momentum before you feel ready 

This is for anyone stuck waiting, applying, or unsure what their next move should be.

#RootToCISO #Podcast #CareerAdvice #CybersecurityUSA #Leadership #Hiring #CybersecurityPodcast

Transcript

Speaker 0:00

Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

kris-rides_2_06-09-2026_140524 0:21

Hi everybody, and welcome to season three of the Root to CISO podcast. I've got my third guest with me, Zach Lewis. Thank you for joining me today

zach-lewis_2_06-09-2026_160522 0:30

Oh, Kris, thanks for having me. I'm happy to be here guest three of season three, that's awesome. Three for

kris-rides_2_06-09-2026_140524 0:35

Yes. And I'm excited to, to get you on here because, like, some of, the guests I know really well. Others I've kind of recently met, and you're one of these recently met people, which is amazing for me because although we've talked over LinkedIn for a while and talked about doing this, like, I'll get to really understand your background and everything from this. So that's exciting for me. I honestly, between, the book you've written, all of the speaking, being a CISO and a CIO, both hats, I'm not sure how you get the time to do anything else, let alone my podcast, so thank you

zach-lewis_2_06-09-2026_160522 1:08

No, no, it's awesome. I'm always glad to do these. It's,, it's a lot of fun and, uh, I mean, networking is such a huge part of this kind of career path, this role. So we gotta talk to each other, we gotta share information and, and we're doing that. So, so hopefully, uh, we always make time for it

kris-rides_2_06-09-2026_140524 1:22

Yeah. Thank you for that. And I, like, you are right. I think if there's something that's consistently kind of gone through the podcast, it is community. You know, we have an amazing security community, and if you're part of that and genuinely part of that, you know, so not somebody that's just in it to see what you can get out of it. You're in it because you want, want us to be more successful. You understand that in our industry, a lot of people are dealing with a lot of stress a lot of the time. Um, and you're, you know, like I say, you're in it for the right reasons, right? It's the, it's a, it's a good place to be

zach-lewis_2_06-09-2026_160522 1:55

Yeah, absolutely. No, that's great

kris-rides_2_06-09-2026_140524 1:58

So I, I kinda alluded to the fact that you, you're wearing two hats at the moment. Do you wanna sort of let everybody know what you're doing currently, please?

zach-lewis_2_06-09-2026_160522 2:06

Yeah. So I, I serve currently as the CIO for the University of Health Sciences and Pharmacy. I've been in that role about, uh, seven years, six years, six and a half years, seven years now. Um, yeah, anything from networking, help desk, academic technology, which is like learning management systems and, and how students get in and access courses and how teachers teach, um, enterprise systems from our student information system, our ERPs, um, all, all the big sort of enterprise level, uh, systems people might be in. Cybersecurity, I, I built the program here, so from sort of from the ground up and hired the team and brought on the tools for that. Yeah, it just really anything that kind of touches IT. The library even reports into me because, you know, there's even technology in the, in the library, so, a lot of fun.

kris-rides_2_06-09-2026_140524 2:51

Yeah, it sounds, sounds like something that k- would keep you very, very busy, I suspect

zach-lewis_2_06-09-2026_160522 2:56

It, you know, in the early days, it w- a lot of, uh, a lot of fretting, a lot of trying to figure everything out. But, uh, we've been doing it a while now, and it's, it's kind of old hat and, just enjoy it now, so

kris-rides_2_06-09-2026_140524 3:06

Yeah, it's good. It must be good when you get to that mark where, I mean, it's seven years plus is a long time. Like, y- I guess, you know, you really understand how everything works. Like, hopefully there's less surprises, right? And you know where to go when you need something done

zach-lewis_2_06-09-2026_160522 3:20

Yeah. Uh, you know, a surprise every now and then helps break up the monotony. But yeah, we know, we know how to get things done here. Um, we know the, the right people to bring on. But even before being in this role, I, I worked, um, and I'm sure we'll touch on this, but I, I worked at the university for a few years, so I definitely know where, you know, the, the skeletons are buried and, and how to get things done around here, and it all works

kris-rides_2_06-09-2026_140524 3:40

Good. Good, good. Well, let's, let's head right back, okay? So we're gonna zoom back into, you know, I guess school and then first jobs out of school. What, what, what did that look like for you? What did you study?

zach-lewis_2_06-09-2026_160522 3:53

Um, so in university, well, I, I actually wanna take it back just a step before university. But prior to getting into high school, I, I found a-- or prior to getting into college, rather,, in high school I found this, a passion for computers and, and sort of fixing computers. Um, I-- there were a couple courses I didn't wanna take in high school, and they, they put me in a senior level, computer repair class. Uh, and they were-- and I was one of the only non-seniors in there, so I didn't have this, senioritis where I just was, you know, coasting through until I could get out of school. So I was o- one of the only kids who worked in there, and I learned a lot about, patching computers and how the parts go together and how to assemble and reassemble them and, and viruses and stuff like that. So when I, I kinda started-- stood up this side business of fixing people's computers and trying to tune them up back then, and that g- that's what really drove me into, into college and university where I got there, started studying computer engineering and realized it wasn't quite what I wanted to do. There was a lot more, a lot more chemistry, a lot more science in that. I, I, I didn't enjoy that. I didn't like it. So I, I went and was like, "What else is there? I wanna work with computers. I wanna fix computers. Like, what is there to do?" And, I was at Southern Illinois University at the time in, in Edwardsville. It's right in the center of the country,, outside St. Louis. My advisor was like, "We have a program called Computer Management Information Systems. It's in the business school." Everyone knows that business school is easy, so this sounded like a great deal. I'll get to go in and, and work on computers, and that's, and that's really what it was. It was a lot of information processing and a little bit of, of coding languages and infrastructure, how servers work, and that, that got me a deeper dive. Um, ended up getting, an internship at a, a co-location facility, so a place that hosts, hardware for different companies to run all their infrastructure on. I worked midnights there through through my senior year of college, and then also started a, a second job, eventually with a tech startup, which I took on full time when I graduated. Um, and they were like, sort of like the Google of the Midwest, very, very trendy. Pool tables, fully stocked bar, massages, haircuts, you

kris-rides_2_06-09-2026_140524 5:57

Nice

zach-lewis_2_06-09-2026_160522 5:58

a tech startup. And for a college kid coming out of school, like that was where it's at. Hey, I can get my laundry done here. I can get an oil change. I can get a haircut, and I never have to leave. This is great, and I worked there for a number of years in IT, but became the system administrator there. Um, loved it. It got bought out. I, I had to move on, and went to, a coal company, one of the largest coal companies in the country, um,

kris-rides_2_06-09-2026_140524 6:23

Zach, let me, let me stop you there just for a second because I'm fascinated by this. 'Cause I, so I, um, I chair the board for the National Cybersecurity Training and Education Center, so that's, like, their members, and it's 480 community colleges. Uh, you know, so it's a lot of education. And I know something, and, and I think this has been an issue even, you know, going back, but, but certainly is a big issue now, is things like getting internships and getting roles before people graduate. So I wanna stop on that, like, just for a second because I think that's a really interesting part and something that, you know, perhaps the people that are earlier in their career l- that are listening to this, and I know our audience ranges from students right the way through to senior leaders that, are either making the move or are currently CISOs. So for those that are kind of in, you know, they're students, they're thinking of getting into IT or cybersecurity, like how did you get your internship, and then how did you get the opportunity at, at, at that company as well before you graduated?

zach-lewis_2_06-09-2026_160522 7:22

Yeah, both are bo- so both are very good stories, and I'm, I'm glad you double-clicked on that. So for the internship, at our school, at the university I attended, they would bring in different companies to talk about what they do, and I was a member of a group called AITP, Association for IT Professionals, that was ran through the school. I think CompTIA has bought that out and owns it now, and it has a different name. But we would meet once a month, and we would bring in these speakers from different companies in the area, and they would talk about what their company does and what roles they had. And I remember this, the co-location facility came in, and they were, they're called Data- I can say the name, Datatel, was what they were called. And Datatel came in, they did a pitch, and I was fascinated with it. I was like, "Man, this sounds like a really cool company." I... And I heard it pretty early on. Maybe my sophomore, junior year, I heard them pitch, and they came every year. And I just went in my senior year to them. been in the role, I'd been in the, the club a few years, and so they had seen me. I, I talked to them before. My senior year, I went up to them and said, "Hey, I wanna work for you guys. Do you have anything available?" Like, they came in, I told them that that's what I want. And that has been a, a constant trend throughout my career, and we might dive into that a little bit more as we talk. But, like, make your interest known. It's not just applying for the job, and sending in an application to, you know, an un- unnamed face somewhere. But, you know, just actually talking to these people goes back to networking, how we started this conversation. But I go up to them and like, "Hey, hey, you know me. You've seen me here. I'm an IT professional. I'm gonna graduate. Do you have an open internship or something I can do?" And they did. Um, ended up being a, a late shift of just watching the facility and testing stuff, but I got my foot in the door. I met some people. I got some work experience, um, got a little bit of pay. It was a paid internship. Um, you know, I wasn't making bookoo bucks, but it was something. And that was a foot in the door, which... And so, so I had that going, and then this tech startup kinda came out of nowhere. One of the other things the university did was they did, like mock interview days, and they would bring in companies, and you could practice interviewing with them to, to get better at it. And I had already had one scheduled,, even though I, I was working at this other co-location, this Datatel place. Um, and I went in and did this mock interview with this, this other company, and I kinda... I don't know. I, I was very relaxed in it. I was like, "I have a job. I don't care. I'm gonna work here. Uh, everything's gonna be cool." And so the guy's asking me these questions like, "What's your greatest strength?" And I, I just was having fun. I was like, "I'm Batman. That's-- I'm Batman. That's it." And he was like, "Okay." And then he's like, "What's your weakness?" And I was like, "Ugh, discerning reality, you know? Like, I just can't keep..." Just, just having fun with it, and he laughed. And at the end of it, he was like, "You know what? You have a great attitude. I think you'd be a great fit for this company. You wanna come work for us?" And I was like, "Oh, wow, that, that's crazy how that kinda happened." And, uh, so having, having a couple opportunities, just having fun letting that, that personality out a little bit. But again, it went back to being in person and talking with people, And, and, and having something to show for it. Like if you are somewhat, you know, competent and able to do a, a job well, do a... come in and do a good job and provide value, like if you can just demonstrate that in some way and talk to people about it, it, it, it makes things a lot easier to get in the door

kris-rides_2_06-09-2026_140524 10:32

Yeah. Yeah, there's a lot to be said. There's like, first off, you know, joining a group while you're a student, right? Getting involved in the community really early, 'cause I think a lot of people don't think about that until they start looking or maybe until their last year, right? They, they don't start getting out. Like putting your hand up. I'm also, I'm on the board of UNLV here in, in Las Vegas, and I went to an event with a-- And there was a bunch of students there and, and we-- I was there as part of the board. And, some of the students like just stuck all together and didn't even talk to anybody in the board, right? And then there was others that came over and their faculty were like really encouraging them. And you can tell it wasn't easy, you know, just to come over and talk to board members. And some of those board members were in sort of conversations between each other and it, they had to like come and interrupt us almost. But it-- but that worked great. That's what they were there to do, right? That was their opportunity. And, and so like putting your hand up, putting yourself out there, being part of the community. And then I do think being yourself is a major part of that, right? That's the thing that really distinguishes us. That's our moat, right? Otherwise, if we're just doing certain processes, AI is just gonna take that job away from us pretty quick.

zach-lewis_2_06-09-2026_160522 11:47

Another thing on those memberships, I mean, when you're in school and you're in these memberships, they're, you're there with other classmates. These are people that you're likely gonna run into again. I, and they're gonna have different skill sets. Some are gonna be older than you, some are younger, but they're going into the same sort of roles in the same areas. Um, and, and building those networking connections early can help down the road too. So

kris-rides_2_06-09-2026_140524 12:07

Yeah.

zach-lewis_2_06-09-2026_160522 12:08

network you can

kris-rides_2_06-09-2026_140524 12:09

Great examples. And also, like, the fact that you also got to say, like, putting yourself out there, like working till midnight 'cause that was the shift that was available. Like, there are, there are, there are a lot of people that aren't gonna put themselves out that far, and then when they're desperate for a, a job at the end of their, their, their degree, they get it. They're, frustrated because they're not getting the opportunities, but you have to put yourself out there so much earlier. Like we don't, as a company, we don't place a lot of really, uh, like entry-level people, 'cause obviously we get, we get called as a staffing company, we get called and asked to find, you know, experienced people to fill their roles. Um, but there's a couple that we've placed over the years, and I remember one, they were looking for somebody with like two years experience, and they took somebody straight out of a college, but out, out of a master's, but they had no commercial experience. But through each of, you know, the, their study in both the degree and then the master's, they'd done internships and got some commercial experience from doing that. And they went in there, and that person, I, I mean, I can't remember the last time we spoke to them, but, they were there for like at least seven years. They were still there last time we spoke to them, and they'd been promoted and promoted and promoted, and their hiring manager still says it's one of the best hires. And that took some persuading for them to look at somebody that wasn't two years in the industry, but look at somebody that was coming straight out. Um, so I think putting yourself out there and doing these internships gives you that commercial experience that a lot of the clients sort of look for now, right?

zach-lewis_2_06-09-2026_160522 13:35

Yeah. And you know, you don't have to burn the candle at both ends for forever, right? Like, we're... When you're coming out of school, you're young, do this. Like, get out there and hustle a little bit. You know, that, that puts you a leap and bound above, you know, anyone else who's not, and, and you do that. I didn't have to do that job for, for that long. Another opportunity popped up and I got to move out of that. But, you know, enough to, to get that experience, get the foot in the door and keep that ball moving, we just gotta hustle a little bit

kris-rides_2_06-09-2026_140524 14:01

Yeah, I love that. It is all about the hustle, and actually I think, you know, I'm sure we'll talk a bit about AI later on, but I think the, the situation we're in right now with AI, if you look at it with the right frame and take advantage of it and grab it with both hands, there's more opportunities now than ever to be hustling and doing things and taking your ideas and turning them into something. But yeah, anyway, we'll, we'll get onto that maybe a bit later. So, so continue your, your career story. Um, so that company got acquired, is that right? They got acquired?

zach-lewis_2_06-09-2026_160522 14:34

Yep

kris-rides_2_06-09-2026_140524 14:35

then did you, like, as part of the acquisition, were you kinda laid off or had you already, you already saw that coming? What happened?

zach-lewis_2_06-09-2026_160522 14:40

I- IT was laid off. I was one of those people laid off, and then so I wasn't on the market for long, maybe about a month at that time. I just put feelers out there and started finding stuff. Um, ended up coming on board with one of the largest coal producers in the country. Arch Coal is what they called. They've been purchased and renamed since then. But, um, uh, I came on there as a desktop administrator, so a little bit different from system administration, but, but, um, ki- kind of similar. Um, and, and I s- I'd like to point out one of the big things I, I had to do there was something called SCCM, and for those that are older will remember Systems Center Configuration Manager. It was a Microsoft product used to push patches and software, and updates and all sorts of things. So that's what I had to learn. Um, I had a little familiarity with it, but I became one of the, better operators of it, better administrators of it in the St. Louis area. Uh, and that skill set was in use, so I was there doing that and, and wasn't there very long before, a recruiting company found me and found that skill, that specific skill set, that one thing, and they were like, "We can get you more money, and we can get you a better role at this other company. They really need someone to do it. Will you, will you leave and, and come over?" And, you know, still being young and liking a big pay jump, yes. I, I, I took it and, and, and left. I, I liked working at Arch Coal, but I also like making more money, so

kris-rides_2_06-09-2026_140524 16:02

Yeah. I mean, look, the-- it's funny, when you look back at a lot of people's careers, um, you know, I, I think there's, there's some sort of balance there. But, you know, generally the people that have seen the pay rises the quickest have been each time you move, you see a much bigger pay jump than you do in an annual raise. And so, you know, if your current company's not keeping up to date with what the market is, then unfortunately you're gonna have people looking and be tempted, even if they're, like, quite happy where they are. You know, there's always gonna be something that's gonna tempt them a bit if, if they're not paying market rate. So yeah, that doesn't, that doesn't surprise me. So you moved to this, this new role. What were you doing there, and sort of how long, uh, you know, what company was that?

zach-lewis_2_06-09-2026_160522 16:43

Yes. Yeah, so new role, um, was, uh... This is my first role in, in higher education, the St. Louis College of Pharmacy. I was a client systems engineer, which, uh, fancy title for doing stuff with SCCM. Um, again, a lot of... I was responsible for, taking computers and building the images for them, what we were gonna put on them, with the software, the operating system, the patching. Doing a lot of deployments with that. Um, kind of evaluating hardware and what our standards were gonna be. Did that role. Um, I, I, I would, uh, um, step... Two things. I'm gonna step back once and, and say something about Arch Coal, which is where I worked. I, I worked there during a bankruptcy. So they filed for bankruptcy during the time. This was during, uh, the era where we were trying to shut down coal plants. Coal was getting a bad rap in, in the America. So I was there during a bankruptcy, and they had just fired the CIO when I was brought on board, like a month in, so it was a really weird time to be there. And then I leave. I go to this school, this higher education school, and I'm there maybe another month, and they're like, "We're firing the CIO."

kris-rides_2_06-09-2026_140524 17:46

Oh my goodness.

zach-lewis_2_06-09-2026_160522 17:47

my gosh." I was like, "Okay. Crazy." And then, uh, my boss, who had just hired me, uh, came in, he was like, "Oh, yeah, CIO's being let go. I'm also leaving, so this is my two-week notice." And I was like, "Okay. Wow, that is a lot.

kris-rides_2_06-09-2026_140524 18:00

You were like, "What have I done? What am I doing to people?

zach-lewis_2_06-09-2026_160522 18:03

So they w- they end up bringing in a, a interim CIO and,, and some other people to start running operations here and getting things figured out. And it's at this point I go in and I say, "Hey, I'm the client systems engineer. I'm doing this task. There's a need here to do X, Y, and Z 'cause it's not getting done. know how to do that. I can do it. Um, what do you think about letting me take on that responsibility?" And they were all, you know, they don't know me. They were like, "Yeah, absolutely. Please do that." So I do that, and I mean, a couple months after that, they promote me to network and systems administrator. I've been promoted, to a much bigger role with better pay, and, I do that for a couple years. And, uh, I get wind that They, they end up hiring a CIO back and we get sort of stabilized, but during that time, I get wind that the manager of the help desk is going to be moving. He's getting a new role. He's moving out of the state, um, and that role is gonna be open. So I go in to the CIO's office at the time. Uh, again, I've been here a couple years. I say, "Hey, listen, I hear this guy's leaving. I think I can manage the help desk. I can do that with my current role. I, I can do both. I will do systems, I will do networking. I'll keep those responsibilities going, but I wanna manage the help desk as well." uh, we, we talked it over, went through a, a couple different things. They started me as a manager of that with a, a promotion track to director, and I became the manager of the, the technical support center, um, while, while doing the network and system administration

kris-rides_2_06-09-2026_140524 19:25

That's amazing. That's-- Like, there is, there's some amazing stories through this. First off, you know, even going back, right? You've been through, and a lot of people are going through layoffs at the moment, right? So you've been through layoffs, you've, um, been through acquisitions, you've been through unstable, joining companies and rapid changes, happening. And there'll be so many people that'll be listening to this that have been through one of those things or are going through those things. So I think this story's gonna be really interesting for an awful lot of people here, so I love that. I also think the stuff you're talking about there, I've always-- I always got taught, my old company taught me this, uh, "act as if," um, was the, was the quote that my old boss used to use. And what he always meant by that was, um, you know, if you see an opportunity or you want people to view you in a certain way, you've got to act as if you're that person. So if you wanna be the team leader, right? Then you need to act like a team leader, team leader. Um, that doesn't mean, like, bossing people around, but it means being professional, being the person that's helping other people, being the mentor, being willing to, to be open to that sort of stuff. And that kind of weaves its way a little bit into what, what you're talking about there, 'cause you're, you're that, almost that entrepreneurial spirit maybe that came from high school and building computers, right? Has turned into an intrapreneurial spirit-spirit, where you look for things that need help with, things that could, you could provide more value at. And I think when you find those things and you offer to take them on, and, and I think what's important is you didn't just offer to take them on, but you, you weren't trying to get rid of your old job. You were still saying, "I'm gonna still help you on this, but I think I can help you on this too." That's like, who-- What kind of manager isn't gonna love that, right? That's probably the, the ideal person that you wanna trust, and they know they're not leaving you in it. They know they're just not trying to escape the work they were doing before, that they genuinely believe in the company and you want, they want to improve it. So I lo I love all tho- all of those stories. I think, um, I think also people struggle with how to move into leadership, from an individual contributor. So maybe we could talk a little bit more about that conversation and, how it went and any tips or advice you've got around that.

zach-lewis_2_06-09-2026_160522 21:47

Yeah. And, and, you know, management's not, or leadership's not for everybody. I mean,

kris-rides_2_06-09-2026_140524 21:51

Mm-hmm.

zach-lewis_2_06-09-2026_160522 21:51

gotta be comfortable. And I know people who've been in the same role for, you know, 30 years, and they love it, and they never wanted to leave, a- and that, that's fine. You just gotta know yourself. And, you know, in my mind, it's always been like, "Hey, I, I wanna go to that next level. Like, I've been doing this, I wanna manage people, but I also, I still wanna be technical and hands-on 'cause I enjoy it. let's figure it out." And, and having that conversation with my boss at the time, the CIO, that I-- role was a director position, and when I moved into it, they made it a manager position to see if I could handle it. And that was fine. Let me prove myself and, and make a path there for me to get to director. What would it take to get to director from manager? Let's put some, let's put some goalposts in there. Like, I have to do this. We have to keep our, our success ratings at, you know, why, and I need to get these projects done. If we can do that, hey, we'll give you this pay bump, we'll give you this title. Um, you did it. Great. And so we put some structure in place around that, gave me the support I needed to move into it. And a lot of that goes back to conversation. Telling people, "Hey, I wanna do this. I think I can do it." I think you gotta be a, a good contributor already. You need to be able to do good work. You can't be a, you know, a, a sort of a, a stick in the mud, real quiet, you're difficult to work with. Like, you're out there, you're talking to people, people like you, you can do a great job at, at what you currently do. People wanna help you. They wanna give you another opportunity, especially if there's something there that they can do to help you. That's, it's in our nature to do. So, um, be valuable.

kris-rides_2_06-09-2026_140524 23:19

Yeah

zach-lewis_2_06-09-2026_160522 23:20

And you can get a lot of places with that, especially if you let people know that you're interested.

kris-rides_2_06-09-2026_140524 23:24

100%. And the people around you have got to view you in that way, as you said, because, like, they're not gonna make somebody a manager of an area if they think, "Well, nobody likes the person. They're not gonna listen to them," right? You've got to have that connection and, and, like, the quality of communication and all of the other skills that kind of go along with that. Was that the first time you actually had people-- Did you have people reporting into you at that stage?

zach-lewis_2_06-09-2026_160522 23:47

Yeah, that was the first time. The first time in a IT-type job that I had people reporting to me. I, in high school, I worked at a, a country club for a few years and had a couple lifeguards, but that was, that was about it. Uh, but this was the first time having people who were, like, significantly older than me, um, which is

kris-rides_2_06-09-2026_140524 24:06

No

zach-lewis_2_06-09-2026_160522 24:07

being the young person who comes in to manage the people who have been there, you know, for 15, 20, 30 years. And different... And I, I've learned this when, uh, I, I know another CISO who talks a lot about this, but there are obviously generations of people in the workforce, and they all wanna be

kris-rides_2_06-09-2026_140524 24:22

Yes,

zach-lewis_2_06-09-2026_160522 24:22

managed a different way. They're all

kris-rides_2_06-09-2026_140524 24:23

yep

zach-lewis_2_06-09-2026_160522 24:23

by different things, and really trying to figure that out, is interesting. I remember getting, like, first-time manager books and, and trying to read them, uh, the books are great. You can get stuff from it, but it's not always just a copy and paste in the real world, too. So it was a lot of, a learning curve there and, and putting in a little extra time after hours on, on reading that stuff and trying to grow those skills. But I, I enjoyed it and I did a good enough job that they kept me in it, so.

kris-rides_2_06-09-2026_140524 24:49

Good. Was there any sort of challenging times? Like when you, like you say, when you're taking people over and they're all from different generations, especially people that have been with the business a lot longer than you, like was there any sort of struggles there or any sort of challenges you had to overcome?

zach-lewis_2_06-09-2026_160522 25:03

Yeah, de- I mean, definitely. So coming into that role, I, I'm not a, I'm a pretty laissez-faire in terms of my management skill, or at least I've developed into that, where I'm pretty hands-off. I give you, "Hey, we need to do this. Go do it." You know, like, "If you need help, come to me and figure it out." Whereas my predecessor wasn't always like that, and then the, the predecessor to the CIO, the one who was fired, you know, he was a very, um... He was a challenging CIO. Like, he would be on, he would micromanage. He had a certain way of doing things. So even to this day, like some of those guys, like I know I would tell to do something, and they would be like, "Oh, check in with me, like every step of the way." Like, "You don't have to do that. Just, just go do it." "Well, you know, this person always wanted us to do blah, blah, blah." "Yeah, I, I, I know. That's, that's cool. I, I don't need to." So getting over the hurdles of, of different management styles and what they've had ingrained to them for years was a challenge. Um, I also had like 21 student workers, and learning to manage time management, with students, who are in college and don't always show up or know how to dress properly or handle interactions and, that was different too, and took a little, uh, a challenge to, to get over it and kinda learn how to handle, handle that. But

kris-rides_2_06-09-2026_140524 26:14

Yeah, that sounds like a-- I've never, not, not really thought about that, but I'm sure that's a very different ballgame to managing people that have been around for a while and being used to being managed as well. The, and especially, I don't know whether you find my style is pretty laid back. Like, I hire people that can do the job, and then I, and then I trust them to go and do the job. Like, you know, and hopefully you trust them and that works out. It doesn't always work out, right? Some people, uh, some people do need to be managed a lot closer. Not something I really enjoy doing, but that's what some people need. I would imagine, or in my head at least, I'm imagining students with less experience of being managed, um, maybe need it a little bit more. Did you have to change much of your style for that and, how, you know, how did that work?

zach-lewis_2_06-09-2026_160522 27:02

There were a few very direct conversations with a handful of them about things that had to get done a certain way. Like, "Listen, you're just gonna have to do this." And, I... A couple actually more conversations not so around, around the tech side, but around like professionalism standards and like, "You can't wear this," or, "I need you to wear more," or different stuff. Like, like, "This is a, this is a job and we're in a professional setting, so please, do this." Uh, we had some conversations like that, which were fun. I think, yeah, I, I just, I, I had people who were 30 years my, my senior, and I had people who were, you know, 10 years younger than me, and, and really just trying to balance, those two things. And I think one of the hardest parts, though, that I, I noticed for a few years taking over was also when I delegate stuff, let them do it the way they wanna do it, and not, like, me be like, "Well, you should have done it this way." Um, I, I like to be hands-off, but I also see people doing things and be like, "Oh, I wouldn't do it like that. Why are you doing it like that?" But as long as it got done, if they got there, that's what's important. And having to learn that over the last several years too is, an early challenge, but, but now it's, it's fine.

kris-rides_2_06-09-2026_140524 28:07

Yeah. Like I, I even sit there, like I've got a six-year-old and, and so even, yeah, you kind of just wanna show them how to do it and tell them 'cause you've got the experience, but you've gotta let them fail a bit and try and figure it out themselves. And so that's always a hard balance. Like when, when she's like, "I need some help with my homework," and I'm like, I'm pulling out blocks and like putting them together and explaining, and she was like, "Just give me the answer." And I'm like, "No, I can't do that," right?

zach-lewis_2_06-09-2026_160522 28:32

Oh, yeah. I get it. Having your own a five-year-old, I, I got you. I feel you.

kris-rides_2_06-09-2026_140524 28:36

You know it. So that's good. So how long were you there for?

zach-lewis_2_06-09-2026_160522 28:41

Um, I was in that m- the manager role for almost three years, but, but counting the other two roles in, in there, um, uh, five and a half, something like that

kris-rides_2_06-09-2026_140524 28:51

Okay. And then they had you on pace, they had you like a target to get to director. Did you end up getting director there, or did you move on before that happened?

zach-lewis_2_06-09-2026_160522 28:59

Yeah, so I moved on before that happened, and I moved on because the CIO at that time and I, um, were a-acquainted, and he told-- He was going to leave and go to another school, and he wanted me to come with him fix their IT department too. Um, so we both left at the same time. We went to another school, another higher ed institution, um, and was trying to rebuild their IT department. Um, they, they had gone through a bunch of changes, a bunch of cuts, bunch of, a bunch of firings, and they were trying to staff back up. So we went there and, uh, it was a mess. It was, it was probably one of the worst jobs I ever worked, and I regretted it. Um, learned stuff about regret and, and grass isn't always greener, but, um, it, it made sense. The job was very close to my current house. We just had our first kid, um, and I was like five minutes... Like, I was like f-walking distance, five minutes from, from the campus, so I could get-- like go home and see, see my new baby a-and, and my wife and have lunch. But then I ended up, I spent multiple overnights there trying to fix stuff that was broken

kris-rides_2_06-09-2026_140524 30:00

Yeah.

zach-lewis_2_06-09-2026_160522 30:01

patch things up. And I'm like, "I'm away more now and I'm closer." Um, and I, I got really unhappy with it. Um, I ended up being there only six months before moving on and, uh, and going to, uh, ba-actually back to the university, back to the St. Louis College of Pharmacy. Um, I went back there. They, they wanted me to take over my CIO, my predecessor's role, um, who had left with me. He also left within six months and went somewhere else. We both did not like it. Um, we both left. He went back somewhere else. I went back and took his job. They, they brought me in as a director of IT just to see if I could, again, do it, build up to it, um, become the CIO, uh, and so I, I took that to, to get back there. I was familiar with the environment and, and this is, uh, again, going back to juggling a lot of stuff at one time. They gave me, uh, five different objectives to hit, and I had like, I don't know, like three, three, four years to do it. Five, you know, certs, trainings, different stuff they wanted me to do. I think in that f- I got f- I got five, I got five things done in the first year, and then they gave me three more the second year, and that was

kris-rides_2_06-09-2026_140524 31:05

Yeah.

zach-lewis_2_06-09-2026_160522 31:05

to have lasted me like three or four years, and I just went after it. Um- And I became CIO. then we went through, um... And then I, uh, uh, we did a name change, we got bigger, we added a bunch of staff, and we became a giant university system, um, called the University of Health Sciences and Pharmacy, which is where I'm currently at right now. So, much bigger than the St. Louis College of Pharmacy was. and we needed a security program. We didn't have a security program. Um, I... So I started structuring it, building it, uh, looking for tools. We, we implemented the s- security program because there was a need. and, and I was like, "Hey, let's, let's get a CISO now." And they kind of looked at the budget, they looked at the numbers. They were like, "We don't have money for another C-level. Is there anyone else who can do it? Can you do it?" I'm like, "Well, all right. Yeah, sure, I'll do it. Let's, let's rock and roll." So, uh, they, they gave me the CISO title, and I've been running that, uh, pretty much ever since. But during that time, I mean, we went through COVID, we went through, uh, a name change. We've, had an expansion. We've gone through, uh, a ransomware attack and, uh, and now we're going through a new merger and acquisition with a much, much bigger, uh, university system. So a

kris-rides_2_06-09-2026_140524 32:16

Wow.

zach-lewis_2_06-09-2026_160522 32:16

lot has happened.

kris-rides_2_06-09-2026_140524 32:17

Yeah, that's a lot to take on. I'm gonna, I'm think- I wanna ask you, I wanna ask you about things you've learned from, um, from, from that sort of six-month position, like what you would've done differently. I wanna speak to you about what you're doing currently. But do you know what I'm gonna do? I'm gonna, I'm gonna do that next week, I think. We'll keep p- we'll keep the listeners and, and the watchers all, uh, hanging on a bit, and I think we'll call the end to part one right now, and then we'll follow up with some of those questions, uh, on, on next week's Root to CISO. So Zach, thank you so much. I'm really enjoying this conversation, so I'm excited to continue it. Lucky enough for me, that will be in about two minutes, whereas everybody else has to wait a whole week for this. But thank you

zach-lewis_2_06-09-2026_160522 32:59

Awesome. Yeah, we'll see everybody next week.

kris-rides_2_06-09-2026_140524 33:01

Yeah. See you all next week. Thank you for listening

Speaker 33:03

thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.