How To Identify What Is For You And Move On From One That Isn’t | Root To CISO Podcast

In today’s part 2 episode of our chat with Zachary Lewis, CIO & CISO at the University of Health Sciences and Pharmacy in St. Louis, we go deeper into the side of cybersecurity careers most people avoid talking about: what happens when the role you took turns out to be the wrong one.

From walking into an understaffed team that couldn’t hire, to navigating internal politics, leadership misalignment, and roles that look good on paper but fall apart in practice, this conversation breaks down what it really means to recognize when something isn’t working and make a move.

They get into:

📌 The red flags you should be looking for before accepting a role
 📌 Why some environments make it impossible to succeed, no matter how good you are
 📌 The hiring dysfunction that leaves teams stuck and overworked 
 📌 Why staying out of loyalty can do more harm than leaving
 📌 How to think about short tenures and explain them without damaging your career

This episode also dives into real-world leadership challenges, from rebuilding teams during uncertainty to navigating rapid change, including scaling infrastructure during COVID and responding to a ransomware incident.

If you’re in a role that doesn’t feel right, or you’re evaluating your next move, this episode will help you ask better questions, spot problems earlier, and make decisions that actually move your career forward.

🎧 Share this with someone who’s trying to figure out whether to stay or leave.

#RootToCISO #Podcast #CyberSecurity #CyberSecurityCareers #CISO #CareerDecisions #CyberSecurityJobs #Leadership

Transcript

Speaker 0:00

Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

kris-rides_3_06-09-2026_144022 0:21

Hi, everybody, and again, it's season three. I'm with my third guest of the season, Zach Lewis, and we are doing part two right now. So we're gonna jump in. Hopefully everybody's managed to catch the, the last conversation. We were, kinda left it, we were talking about your current role and a lot of changes that are going on there. We also briefly spoke about, uh, you moved out to something for sort of six months and then came back in, and I'm interested, at that six-month one sounded like a bit of a horror role even though up front with it being close and you just having a, a, you know, a kid recently, it sounded like it was the perfect time. What did you kinda learn from that? What questions would you ask if somebody's in that position, so they find themselves not coming in and then having to sort of change again?

zach-lewis_3_06-09-2026_164020 1:08

Yeah. Uh, I mean, there's a lot of digging that, that needs to go on there around, you know, why did the previous, you know, entire team get let go? And what are the, what are the plans for restaffing? I-- and, do you go about that? What we, what we learned sort of about the restaffing piece was, you know, I was, I was brought in. There's, you know, three or four of us in the entire department. It used to be 11. Um and, and we're allowed to interview, but, like, how do we go about hiring? And I mean, I probably interviewed nine, 10, 11 people for one role, and we, we, you know, pushed several of them up to, to move forward, like, "Let's go with them." And, and we kept getting denied for, you know, a bunch of different reasons or things were getting, on hold or someone else further up the line didn't like it. And, and we d- and the entire time I was there, that six months, we never hired another person, was crazy, for, for a department that, that needed people to operate, you know? With that... I like to take on a lot of work, but I can't do the role of, you know, nine other people.

kris-rides_3_06-09-2026_144022 2:04

You do wear a lot of hats and you do get a lot of stuff done, but yeah, may- maybe that's what they were hoping, right?

zach-lewis_3_06-09-2026_164020 2:10

Do need some help there. And then, there was, you know, there was other stuff that it's, it's harder to sort of fill out in a, in an interview process early on when you're looking to m- move. And, and getting in there, we learned a lot about there were some politics going on. There were different people making moves. You know, the, the, the CIO there, um, was having challenges with some of the leadership team and, and wasn't in the best standing either. And there's a, lot there that you kind of pick up after you're brought in that kind of informs that decision. So really sometimes the best you can do is the, the best you can do and, and you, you get in there and you do your job, but at the same time you start, you know, you, you realize that it might not be great and start looking for other opportunities. So, um, when, uh, when the college reached back out and they were like, "Would you be interested in coming back?" Did not rush into it. You gotta play that really cool. "You know, I could consider it maybe." Don't let them know you're desperate. But, um, but definitely made the move. But yeah, there was just a lot, a lot at that place that, um, a lot of long hours, um, that was dated, processes that were, that were weird, and when you go to change them, no one wanted you to change them. And, and if you can't make changes and you can't improve stuff, then, then why are you there? You know?

kris-rides_3_06-09-2026_144022 3:22

Yeah

zach-lewis_3_06-09-2026_164020 3:22

other opportunities and there's no reason to beat your head up over it. And, I know folks who went there and stayed because they, they thought they had to. They were like, "Oh, we gotta get this done," or, "I feel like I owe it to them." don't. You, you don't. There's a lot of other jobs out there and, and companies, so

kris-rides_3_06-09-2026_144022 3:38

Yeah, there are.

zach-lewis_3_06-09-2026_164020 3:39

your mental health

kris-rides_3_06-09-2026_144022 3:40

Yeah, that you, you've gotta think about your, your own personal wellbeing, right? 'Cause we do, and in our industry, stress is, a major issue, right? There are people having health scares because of stuff like that. Um, you know, so you absolutely have to look at, what's best for you. And of course, everybody wants to have a decent tenure in their resume for every job that, that they're in. And, you know, you join companies planning to be there probably longer than six months. There's not many people I can think of over my whole career that you've ever thought, "Well, this is definitely a stepping stone." Most of them have seen and joined because they plan to be there. But yeah, I think there's also a lot to be said for, you know, not burning bridges and keeping good relationships, right?

zach-lewis_3_06-09-2026_164020 4:24

Yep. Yeah, I, I don't ever advise to burn a bridge if you can help it, but, um, I, I'm not gonna stay somewhere where I'm miserable and, that's just

kris-rides_3_06-09-2026_144022 4:33

100%. And, and there's an example there that, like, you went back to the place that you worked for before, so you're not somebody that burns over those bridges. And I think at the end of the day, I, I'm a believer anyway, is that you can have that frank conversation. "Look, this is what I would love to do. This is what I'm trying to do." And you've had that conversation, you've tried to get things fixed, you've done what you can. At some point, if it's just not gonna happen there, you do have to look and go elsewhere, and that's not on you for not trying your hardest. That's on them for not providing the ability to be able to do what you were brought in to do. And, you know, if the CIO left around a similar time, sounds like they were probably frustrated. They were probably even, I s- suspect, like the fact that they brought you along as well, somebody that's just had a kid and all of a sudden you're having to do overnights, I'm sure they didn't feel great about that either, right?

zach-lewis_3_06-09-2026_164020 5:24

Yeah. And as long as you don't have, like, multiple of those short stints on your resume, six months, eight months, here, here, you know, one-off, it's ex- it's explainable. Like, "Hey, this is what happened." And, and, you know, people are gonna understand that and not look negatively on it

kris-rides_3_06-09-2026_144022 5:39

Yeah, 100%. It's funny, I've seen over the last sort of year or two, and I guess it's, the market's kind of changed a little bit in a, in many areas, not all, but in many areas, where there are more candidates available. Companies feel like they've got maybe a little bit more choice, maybe more power in the control of this sort of stuff. And, um, I've started seeing a bit more pushing back that we didn't see two or three years ago on the people that have moved around a lot over the last few years. Now, I totally agree with you there. I think, you know, everybody Like, you can get away with, with, with having to move, you know. If you can explain it, you know. If you, if it's happened four times in a row, then it's gonna be more difficult to explain, but I think you're right. I You don't have to stick it out. You don't have to be there for a minimum of two years if it's not the right thing for you. And to be honest, if it's not doing the right thing for your mental health, you do need to get out and get looking, and it's easily explained. So no, that makes complete sense. So tell me a bit, like, when we left part one, you were telling me about all of this stuff that's going on currently, so I wanna hear everything you've kind of been through, uh, more recently

zach-lewis_3_06-09-2026_164020 6:47

Yeah. Yeah. So I came back to, the college, um was still the college at the time, and that was in January of 2020, and, uh, you know, two months later we end up shutting down, and 'cause of COVID, right? Um, and we have always historically been a college that was in person. We had no online offerings. We didn't even have an instant messenger at the time. No one even had chat or anything, like old school. So, coming back in and, and this time sort of running the show for it was like, "Hey, we gotta get this stuff online. We need people to work remotely, 'cause we're gonna shut down." So spring break happened, and they extended spring break an additional week. So we had two weeks to build out all of the courses to be available online, have that infrastructure set up, the software in place, and then, we rolled out an instant messenger, chat feature, how to take phone calls, like everything. And we had to build that very quickly everyone else in the world, and, uh, and, and did that and just start educating and training people on how to use it. So that was sort of like the first, journey into the fire, coming back and trying to figure all that out with, with some of the old team, which was fun and in- interesting. I came back and ended up being my, my supervisor the previous time I was there. I was now his supervisor, so it was a weird dynamic where we switched. Um, but he took it well and, and we worked well together for, for many years. So that, that occurred. And then, um, whew, man, we had, uh, we had a ransomware incident in 2023. And we can talk a little bit more about that,

kris-rides_3_06-09-2026_144022 8:16

Yes

zach-lewis_3_06-09-2026_164020 8:17

But, we ran into LockBit ransomware that came into our environment, encrypted a bunch of data, and had to work through that. we've been on this big... we did a name change, um, in, at the, in 2021. Sorry, I'm going backwards in time now. But in 2021 we name changed and grew, added on a bunch of schools and programs and stuff, and became, a university from a small little college. A university with more programs and more students and more people, which was one of the hardest projects I think I've ever worked on in, in my IT career, was figuring out how to change a name and a domain and grow a system and incorporate all this new stuff. Um, it was a very big project, very big undertaking for us. and then

kris-rides_3_06-09-2026_144022 8:57

So is it a bit like a merger? Was that like

zach-lewis_3_06-09-2026_164020 8:58

Yeah.

kris-rides_3_06-09-2026_144022 8:59

of almost, you know, or like an acquisition even

zach-lewis_3_06-09-2026_164020 9:02

It wasn't even an acquisition, it was just growth. It was just add on these new... We went from a college that had two, like two schools under it, an undergraduate and a pharmacy school, to having programs and health, global population health sciences, which was, its own individual insert certificate programs and all this stuff. So we just grew very quickly. We had a new president, new direction, uh, and wanted to grow very, very quickly, and that's what we did.

kris-rides_3_06-09-2026_144022 9:29

Wow

zach-lewis_3_06-09-2026_164020 9:30

and then now we are, we're here and we're getting ready. We are gonna be the acq- uh, ones getting acquired now by a, an even bigger, institution. And so we're, we're navigating now through, uh, our own merger and acquisition stage, which is different being on the other side and trying to integrate with their systems and pass data. And so we've done everything in like the last six years that you could probably think

kris-rides_3_06-09-2026_144022 9:52

That's amazing. Yeah, you've been on both sides of the merger and acquisition side of things, and I think COVID was... I mean, uh, uh, all of us at some point will look back on that and be like, "That was just a crazy, crazy time of things having to change so rapidly." And now we're in this time where I think with AI, I don't know, people keep saying it- it's kind of similar to when the internet came out, but I feel like things are transforming so much quicker than it was then. Um, yeah it's, we're living through some interesting times for sure I think all of us. So is that gonna change a lot of stuff for you?

zach-lewis_3_06-09-2026_164020 10:31

Uh, yeah, I mean, probably, uh, the, the acquisition or AI

kris-rides_3_06-09-2026_144022 10:35

Oh, uh, well, both. Yeah, yeah

zach-lewis_3_06-09-2026_164020 10:38

Uh, yeah, I mean, probably. Uh, I imagine I'm, I'm here for the transition for the foreseeable future. Um, there's been lots of talks. I I'm not going anywhere anytime soon. There--

kris-rides_3_06-09-2026_144022 10:48

Yeah

zach-lewis_3_06-09-2026_164020 10:49

team, we're all here. We're helping, um... And, and so I'm not worried about any of that too. And then, hey, we'll fall back on the networking piece when that time comes, right? And we'll see, see what

kris-rides_3_06-09-2026_144022 10:59

Yeah. Yeah

zach-lewis_3_06-09-2026_164020 10:59

the market. But,, that's, that's not-- that's a long way out. And then, and AI, I mean, absolutely. Um, you know, it's interesting talking about the internet and this being like the internet. I think, you know, we saw it in higher ed, at least I've been told I wasn't here for it, but when calculators first came out, like people in academia freaked out. You know, it was the end of math. It was the end-- what are accountants gonna do? What are tax prep people gonna do? And now we carry one around in our pocket. And then, you know, computers came and people sort of freaked out, and it changed the landscape, I think sort of like how AI is. But a computer took longer to get to you, right? You had to order it, it took weeks, you had to learn it, you had to get it set up, all this stuff. And now AI is available to everyone, again, from your pocket, from your phone for, 20 bucks or for free if you don't care about what's going into it. But everyone has access to it very quickly, so the speed of change is much faster and disruption is much faster. Um, I am embracing it. I love it. I'm on the journey. I get updates all the time on AI, like a constant stream of all the new stuff coming out and what you can do, and I play with it and I'm vibe coding and try testing this and seeing if we can automate things here and run agents here, and, I love it. I do deeply think, though, that it's gonna change the very fabric of cybersecurity, and eventually IT too completely. But till then, I'm I'm all in it Yeah, I think, well, I think you have to-- I think we, we all know that it's definitely gonna change everything, and I think you've gotta be grabbing it with both hands and like getting involved with it so that it doesn't pass you by. Like, I think those people that are like anti it and that are pushing back on it are the ones that are probably gonna be the ones hurt the most, right? The ones that will lose their jobs, the ones that... So I think, um, yeah, I, I think you gotta grab it and, and it enables you to do a, an awful lot of things quicker, including, uh, educating yourself and learning about stuff and talking through it and, you know, I think we're living through a pretty amazing time right now. I'm still really excited about it. Don't get me wrong, like, you know, there's concerns and nerves 'cause who knows how it's gonna impact each of our jobs. But, but I think you grab it and you, you try and help it take you and make you more productive. That's my view on it anyway. Yeah, yeah. You definitely need to be using it, and learning the ins and outs of it and being the subject matter expert of a certain area and asking it, querying, you know, query it on things and see what it comes back with to know the limitations of what you can and can't do. And I mean, I don't think we've even begun to scratch the surface of what all we can do with it. If you can... people tell me, like, "I don't know how to, how to code an app or how I would even vibe code." Well, ask it. what it needs to know for you to an- you know, then ask it those things. Like, it's so weird to think in that way that you have to what you've always sort of thought about that stuff, and it's a lot more than like a Google search engine, so.

kris-rides_3_06-09-2026_144022 13:47

Yeah. And I do wonder about what will happen with all the search engines, 'cause, you know, most of the people I see now are kinda asking AI to go and do the searches, right? And, and, and so I mean, I guess with Gemini, you know, Google are kinda implementing that stuff into their search engine. But yeah, it's gonna be interesting to see the impact on, on a lot of those companies. I guess a lot of those companies are AI companies as well anyway, so

zach-lewis_3_06-09-2026_164020 14:09

You know, it's, it's interesting. I was reading a thing and they were talking about how a lot of companies as-- and Amazon specifically is one of these among others, are starting to make pages for AI agents to read. So your agent will go out and find the agent page and read it and understand, you know, what it is you buy. And then that, then it brings up other questions like, will people make pages with products to try to convince agents to buy it for their human owner and, and how will that work? Like, are they-- Is that like a prompt injection or what?

kris-rides_3_06-09-2026_144022 14:38

Yeah. I think people are, right? I actually think I, I was... Can't remember who I was talking to now, but I was speaking to a couple of people and they were saying how they've built agents and given them like a f- like a credit card, like a pay-as-you-go credit card with a fixed amount on it so that they can just ask it to go and book things like an assistant or go and buy certain things. And so, yeah, I mean, I've heard you're right that, that a lot of companies weren't set up for agents. In fact, a lot of companies were scared about the agents, and so were sort of blocking them and banning them and making it awkward. And then now as they're realizing, well, actually these agents could be customers they're having to rapidly change that. So yeah, it's a funky world that we're living in, right? Everything's changing so quickly.

zach-lewis_3_06-09-2026_164020 15:21

Yeah. It's wild. It's faster every day. So, keep yourself informed. Um, don't format all of your all's resumes the exact same way with AI. Like, give it a little attention. That seems weird, but but other than that, yeah, definitely take a course, you know, get on YouTube, watch something. Just stay up to date with it as, as much as you can, for sure

kris-rides_3_06-09-2026_144022 15:41

Yeah, and make sure you read through whatever it's producing for you, 100%, right? Including your LinkedIn posts and everything else, right? There's a lot of slop out there at the moment. I think that's the worrying thing. I'm pretty busy on, on LinkedIn and, like whenever I'm on there, I can Like, there are so many posts and it's so obvious that a lot of that is AI written, and, I have no problem with AI assisting, like the stuff you wanna put out, right? I think it's made me probably a little bit of a better writer. People could, people would be able to tell 'cause they hear me on this talking, they'd be like, "Kris is so much more eloquent when he writes stuff out." Um, but it has. But I mean, you've gotta make sure it starts and it gives you what you want it to put out, and it's starting with the information you have. If you're letting it sort of tell you what to put out and it's just more AI slop, right? And that's the struggle

zach-lewis_3_06-09-2026_164020 16:30

And LinkedIn is actively combating that. They're like shutting it down. You're not getting views, you're not getting impressions. Um I had to learn all about this whole marketing social media world from, from book work and stuff like that, but it's interesting learning all that. And I, I use AI for some of my posts too, but I'm still like, "Here's the idea. Here's an article I wanna talk about. I wanna connect these things together. Here's some of my jumble of thoughts. me something." Um, and I'm okay with that. I am 100% okay with people doing that because sitting down and creating content for an entire week or two weeks at one time just takes forever, and it is draining. So if we can speed that up, 100%. But yeah, don't just make it, and now I always think about it, and I think others have talked about this, like when I'm writing, a post myself or working on a book or something, it's like, "Hmm, do I use that em dash? Ah, I used one like two pages ago. People are gonna think I'm using AI. Like, maybe don't. I guess we'll use a comma here." Like really thinking about, don't use the if then but this statement because

kris-rides_3_06-09-2026_144022 17:33

Yeah. It's funny 'cause I've, I've always written, like, with a lot of, like, dot dot dots,

zach-lewis_3_06-09-2026_164020 17:38

Oh, yeah

kris-rides_3_06-09-2026_144022 17:38

Yeah. That's been my thing, and then now I'm like, AI's, like, pushing people with dot dot dots, that must be AI, so I'm like, "Oh my goodness, I was writing AI slop before it was AI slop."

zach-lewis_3_06-09-2026_164020 17:48

I

kris-rides_3_06-09-2026_144022 17:48

I thought it was actually good stuff, good quality content.

zach-lewis_3_06-09-2026_164020 17:51

Only now everyone's doing it. So

kris-rides_3_06-09-2026_144022 17:54

Exactly.

zach-lewis_3_06-09-2026_164020 17:55

we change the entire course of human writing?

kris-rides_3_06-09-2026_144022 17:59

Yeah, it, exactly that and actually you mentioned something. Let, let's, um, you, you talked about, like, obviously a lot of this stuff you're doing now to help with the book. Yeah, tell, like, tell me a little bit about the book, and obviously you went through a, you know, you went through some ransomware. Is that where the idea of the book came about? What, you know, tell me about that.

zach-lewis_3_06-09-2026_164020 18:17

Yeah. So I, here's a copy for... There you go, "Locked Up." Um, I, uh... We had the ransomware attack and, I, oh, I learned a lot from it. Um, it was my first major incident working through it that was, pretty disruptive, and I took that and, uh, I went to a conference and I was asked to do a keynote, and I w- I wanted to talk about it. So from a very high level, I just did a, real high-level presentation on it, and I got so many questions from attendees about what was going on here and how this happened and what we did with this and some of... We took a ton of questions and the... I wrapped up. They had to kick me off the stage. We couldn't take any more questions, and people just came up and kept asking questions. I was like, "Huh, that's interesting." So I did it a couple more times, and the same thing happened, and I was like, "Man, there's, like, a real need here, a real hunger for this kind of information." And I was like, "Maybe, maybe I can do a book." I've kind of always wanted to write a book. Everyone always wants to write a book, but you gotta

kris-rides_3_06-09-2026_144022 19:11

Yeah

zach-lewis_3_06-09-2026_164020 19:12

Um, and I was like, "I... Maybe I can write a book." So I, I sat down, I wrote a few chapters. I actually got a writing coach. I reached out and found a writing coach, and he sort of like navigated me through stuff 'cause I was very, you know, technical writer, like, "This happened, so we did this, and this happened and then this. Those are the facts." And he was like, "No, you need more. Like, what was the room like? Could you smell the coffee? What were the sounds? Like, build the world." And I was like, "Oh, these are things I would never have thought of for writing a book." So he helped me really, like, fill in the scenery, rather, of, of everything that happened and paint that picture. So I wrote several chapters, pitched it to, Wiley, a big book publisher, and they were like, immediately, a couple days later, like, "We want this book. There's nothing quite a l- there's nothing like it. Um, we would love to run with you on this." And, being it was Wiley, I was like, "I'm in. Let's, like, let's do it." It sounds like a great name to have. I, I wanted a published book 'cause I felt like it would help get the reach out there, serve as, one, a, a networking tool for me in the future. You

kris-rides_3_06-09-2026_144022 20:10

Mm-hmm.

zach-lewis_3_06-09-2026_164020 20:10

this is

kris-rides_3_06-09-2026_144022 20:11

Yep

zach-lewis_3_06-09-2026_164020 20:11

But two, to get the story out, um, again, ransomware increases, attacks increase year over year. We're a little bit better at recovering from them, no better at stopping them. So you're likely gonna run into one in your career. It's very prevalent, so why don't we have more how-to guides? And you look at it and it's like, well, there's legal reasons. There's, companies don't wanna share that kind of information. There's this weird mark of shame around it in the industry where it's

kris-rides_3_06-09-2026_144022 20:33

Yeah

zach-lewis_3_06-09-2026_164020 20:34

you've had a breach, you're not very good at your job, not good at security. But that's, I mean, that's not the case at all. I think there's definitely some foundational level stuff that we're missing, and not doing properly to keep it from happening. But, no one's gonna know that unless we talk about it. So I wrote about everything that happened from my shortcomings to what we changed to, you know, decisions that were made and why they were made and by who and when, and just every detail that I could possibly think of is in that book. Had to get it approved by legal and the president, and we switched presidents during that time, so another president. Had lots of hurdles, but everything I wanted to put is in there. We didn't have to scrape anything and, and it's done really well. Um, and people have really resonated with it. Um, we've gotten a lot of positive feedback. It's it's cool having people come up to you at a conference or an event asking you to, "Hey, sign this book that you wrote." And you're like, "Oh, that's my book. Like, that's really cool. Someone actually bought it." But the story's getting out there, so I still, I do a lot of keynotes around it right now. I've been kind of all over the country talking about it, but, um, it's been a process and it's, it's been a lot, a lot. But, uh, I've enjoyed it.

kris-rides_3_06-09-2026_144022 21:37

I love that. I'll, um, I'll have to pick your brain at some point. I'm, I'm working with somebody else on a book at the moment, and so, we're pretty much there with it, but we're kind of working out how we publish it, whether we self-publish, whether we look for a publisher. So, yeah, I'll have to, I'll have to speak to you about that after this at some point. So far my grand experience of publishing anything is a kids book that's called Oh Ship, which is definitely, a little bit of humor in there. My daughter loves it, and it comes from a, a, a story that, uh, of something that, that, that happened to us. So that's out there. Um, but it's nothing to do with work and nothing-- Actually, this is probably the first time I've ever spoken about it, on a, on anything relevant to work stuff, so probably people are probably like, "Oh dear, I wonder what that is." Yes, it's

zach-lewis_3_06-09-2026_164020 22:23

up now

kris-rides_3_06-09-2026_144022 22:24

Yeah, exactly. Maybe. But your-- And your book's available on, on, uh, Amazon and stuff, is it?

zach-lewis_3_06-09-2026_164020 22:30

Yeah, Amazon, Barnes Noble, Target, Books-A-Million, all places books are sold. It's, it's been out since January, and we've sold, uh, over 1,300 copies, which is, uh, doesn't sound like a lot, but apparently it's very good for a cybersecurity Um,

kris-rides_3_06-09-2026_144022 22:45

Amazing.

zach-lewis_3_06-09-2026_164020 22:45

that's

kris-rides_3_06-09-2026_144022 22:46

Yeah

zach-lewis_3_06-09-2026_164020 22:46

The publisher's happy, I'm happy, we'll take it

kris-rides_3_06-09-2026_144022 22:49

No, that's a great job. I'll, um, how about I say this? Uh, I'll throw this out there to all of our listeners. Whoever's the first person that hears this and messages me on LinkedIn, I'll buy a copy. Zach, can I get you to sign it? If I, like, send it to you or something,

zach-lewis_3_06-09-2026_164020 23:04

You

kris-rides_3_06-09-2026_144022 23:04

get

zach-lewis_3_06-09-2026_164020 23:04

to me and

kris-rides_3_06-09-2026_144022 23:05

a copy, and and then we'll get it sent out to, to whoever the lucky listener is that, that was listening to that. Is that all right?

zach-lewis_3_06-09-2026_164020 23:12

Yeah. Thanks, Kris. Thanks to, and thanks to whoever gets in there and comments. Awesome. That's

kris-rides_3_06-09-2026_144022 23:16

Yeah. Good stuff. So thank you. So make sure you're listening to this, make sure you send me a LinkedIn message. Um, excellent. So I wanna talk a bit about, like, obviously you kind of created, you, you went back as CIO for, for the company you currently work for, so that's all about relationships. I think that's so important. A lot of people struggle getting that CISO title. I think you went about it getting the CIO title. In a way, actually, I've got a couple of friends that have done similar things. They've done a great job for a company, moved away, and then the company have wanted them back, and they've managed to move up to the C-level doing that. Also see in certain size companies, a lot more people wearing the CIO and the CISO hat. Um, so I think we'll continue to see more of that happening. What I'm interested in, and this is something I ask a lot of our guests, if you took, say, the top three attributes that you think it takes to be a good CIO/CISO, what are the three that, you feel are most important and why?

zach-lewis_3_06-09-2026_164020 24:16

Uh, I think being able to talk to people is up there. I-- you can't be introverted. You can't stay in your office with your door shut. You gotta get out there you gotta work it. You gotta talk to people, find out what their needs are. Um, I think two, you need to understand your business, and that, that piggybacks off of talking to people. But how do we make money? are our customers? is this process the way it is? Um, and really trying to understand all of the processes of the company, from the business department to finance to marketing. Like, there are so many, and it's gonna take a long time, but you really gotta get your arms around that. And so you can make things more streamlined, so you can implement technology better, so you can change stuff and help people do a better job. But also, you know, how do you sell to customers? How do you make money? Because if you disrupt that, that's a problem, and you don't wanna do that. Um, and three, ag-again, networking. We'll, touch on networking again. Again, the touch... It all goes back to talking. Um, despite that this is an IT cybersecurity job, I mean, at the end of the day, it's still sales and marketing. I mean, it really

kris-rides_3_06-09-2026_144022 25:19

Yeah.

zach-lewis_3_06-09-2026_164020 25:20

believe it or not. But having a-- and I say networking because, uh, like St. Louis, for instance, has a very tight-knit community. We are all very close we're, we're-- They call us the St. Louis Cyber Mafia. We even have matching shirts. Like, it's pretty legit. But we're on a text group all the time. If one of us has a problem, we text the group, people come back. If we need to find a piece of software, we text the group, the group comes back. all here helping each other be better. I know g- I know guys who are, you know, looking for CISO roles right now, and they might be three or four of them looking for healthcare CISOs, and they're out there competing for the job, but we're all still on the same team. Like, we still want to help. If, you know, we need advice or we need guidance, how do I get around this problem? This is what I have going. in that group is gonna stand up and give you a, a helping hand. So I think networking, knowing those people, meeting them, interacting with them, you know, you meet them at conferences, you meet them at events. You reach out and say, "Hey, I've been following you on LinkedIn. I'd love to grab a coffee or a lunch." And take them out and just talk to them, you know, get to know them, and then, you know, don't ask for anything. Just, "Hey, i'll buy you coffee. I'll buy you lunch. Like, let's go out and just hang out." And then you build that rapport over time, and then, you know, maybe a job opens up. Maybe a director comes... Maybe they need a deputy,

kris-rides_3_06-09-2026_144022 26:33

Yeah

zach-lewis_3_06-09-2026_164020 26:34

you know me, let's do it. Like, this is where I'm at." And, and those pay off down the line. They may not be immediate, but they will down the road for sure.

kris-rides_3_06-09-2026_144022 26:40

Yeah, 100%. That's interesting. So when I look at, like, the top I went back a few years back and I went out to talk over 500 CISOs and asked them the same question about attributes, and definitely communication and business understanding are continuously two of the big ones that come up. And that networking piece, like building your tribe, you know, having people that you can go and talk to and be honest with and have open conversations that, can help you when you're going through maybe a tough experience, right, or have been through those challenges before are so important. Um, you made me laugh when you talked about the St. Louis mafia. Um, we, I'm part of the cloud security mafia. Um, so that was a group of us that met through It's not affiliated to the Cloud Security Alliance, but we met through doing events and being at events with Cloud Security Alliance, and yeah, it turned into that, and it's very much, I think, a little bit of info sharing and a fair amount of drinking at one point, and a little bit of fantasy football thrown in. So there's a bit of everything going on there.

zach-lewis_3_06-09-2026_164020 27:44

Very good. That's awesome. Yeah, and CSA is a group, good group of people too.

kris-rides_3_06-09-2026_144022 27:49

Yes

zach-lewis_3_06-09-2026_164020 27:49

around AI and Mythos and everything else, so

kris-rides_3_06-09-2026_144022 27:52

Yeah. They're, just an amazing bunch, and I've been lucky. I was one of the founding directors of the Southern California chapter, um, long time ago now, and then twice president of the LA chapter and been involved with sort of Orange County and, and a little bit with San Diego. They're just such a great bunch of people. I, was on the leaders chapter meeting this morning, and so many sort of familiar names and people that you've met and people you've known for years, it, it does feel like a little bit of a family. I do, uh, like I honestly, I could win the lottery tomorrow and not have to work again and still wanna be involved in the cybersecurity community. It's just, there's just good people, and most people are trying to do good stuff, right? And

zach-lewis_3_06-09-2026_164020 28:35

I

kris-rides_3_06-09-2026_144022 28:35

you gotta have respect for that

zach-lewis_3_06-09-2026_164020 28:36

around though something too, and we mentioned the CSA and, and I talk about, you know, a network of people, but there are a lot of groups out there outside of like, I mean, AITP when I was in, in college, but like I'm a member of the local chapter of InfraGard, an

kris-rides_3_06-09-2026_144022 28:48

Yes

zach-lewis_3_06-09-2026_164020 28:49

of that, and that's nationwide. It's in all the big cities, but CSA, InfraGard, ISC Squared, like ISACA groups, there's all these communities out there where it's free to join. There's like no dues. You can come in. You, meet a lot of people. You get some information, um, whether it's from the FBI or other members of your community, but like great way to network, great way to meet people and get some resources, some training, and some information.

kris-rides_3_06-09-2026_144022 29:11

Yeah, absolutely agree. I think, I've got one of my guys has just moved from Las Vegas, one of my team members, to Florida, and he used to live there a long time ago. But he's basically just going to all of the local events and just, like, finding his people, right? It's such a quick way. I did the same thing here first time when I moved from LA to Las Vegas. I just went to all of the events and I met all these people. And now, you know, a lot of these people I've known for years are the new board for the CSA Las Vegas chapter because, you know, we have a great community and it's so important that you're out there sort of mixing and being part of it for your career to help you in what you're currently doing. You never know, right? You never know when somebody turns around and says, "Actually, I'm gonna have some headcount. I really need somebody to do this. Would you be interested?" So,

zach-lewis_3_06-09-2026_164020 30:01

100%. 100%.

kris-rides_3_06-09-2026_144022 30:03

things happen. So I'm gonna ask you just one final question. This has been such a fun conversation, so thank you. Um, and so the kind of one final question I think I'd like to leave you with is, if you had like one piece of advice for the people that are out there now that are either trying to make it to become a CISO or a period of time in their career where they're struggling with something, right? And I know this is very generic. What's the one piece of advice if you look back on your career that you think either you knew earlier in your career or you put into place?

zach-lewis_3_06-09-2026_164020 30:39

I think it's really important for you, a person, to watch for those opportunities, right? Like, I'm not getting into the hoodoo and out there stuff of like putting out good vibes and all that. Like, you can do all that, that's fine. But like, you gotta watch for the opportunity. And when you find it, don't hesitate. Like, you gotta go out there and try it. And whether that's going to, you know, a boss or CIO, someone saying, "Hey, I want that job when it becomes available," or, "Hey, I can do this," or, "I wanna be a keynote speaker, I wanna write a..." Like, you just gotta go do it. You see the opportunity and do it, because the longer you wait, someone else is doing it, and they're gonna beat you to it. And, then what do you have to show for it? I heard someone say on a podcast, no one ever is on their deathbed saying "I wish I had waited on doing that," or "I wish I had just held out a little longer." Like, no. They always wanted to like, "I wish I had made that attempt," or, "I wish I had tried that." Like, just go do it, stop waiting.

kris-rides_3_06-09-2026_144022 31:33

Yeah. Is it Wayne Gretzky that is, uh, is it that you miss every shot you don't take or something like that, the quote I think? I think it's attributed to him, and it's something like that. I've probably completely butchered it, but you're absolutely right, right? If, if you don't do it, somebody else will, and then, why do you wanna have regrets? You'll never... You won't ever regret giving it a go, right? G- saying something that you mean to. You're much more likely to regret something that you never did. That's why I'm a big believer in that. So I thank you so much. That's a, that's an amazing piece of advice, and I know through your career you've proven that jumping out, putting your hand up, and grabbing hold of things and offering to do stuff, it works, right? It helps. So yeah, Zach, thank you. This has been such an amazing conversation

zach-lewis_3_06-09-2026_164020 32:18

Thank you, Kris. I'm glad I could finally be here. This is great

kris-rides_3_06-09-2026_144022 32:20

Yeah, me too. Yeah, I'm glad we got this done. So thank you. Thank everybody. Thank you everybody for, for listening. So watch this space for season three and my fourth guest, uh, coming in the next couple of weeks. Thank you everybody. Don't forget to reach out. If you wanna get the book, you gotta be the first one to message me, so don't forget to do that. Bye everyone.

Speaker 32:40

thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.