Building A Cybersecurity Career That Adapts To Change | Root To CISO Podcast

How do you build a cybersecurity career that can adapt when the industry around you keeps changing?

In this episode of Root to CISO, Kris Rides continues his conversation with John Masserini, cybersecurity consultant and experienced security leader, to explore what decades of change in cybersecurity can teach us about building a career that lasts.

Throughout his career, John has had to adapt to different industries, technologies, regulations and responsibilities. From the early days of cybersecurity consulting to protecting Dow Jones and The Wall Street Journal, building the security program for a new stock exchange, and leading security across multiple countries, each move required him to understand a new environment and respond to a different set of challenges.

His experience shows why succeeding in cybersecurity is not simply about what you know today. Professionals need to remain curious, get hands-on with technology, understand how different businesses operate, build relationships within the industry and be willing to keep learning as their responsibilities change.

In this conversation, we explore:

🔐 Why adaptability becomes increasingly important as cybersecurity changes
🔐 How working across different industries can make you a stronger security professional
🔐 Why curiosity and hands-on experience matter when starting a cybersecurity career
🔐 Why networking and participating in the cybersecurity community can create career opportunities
🔐 How mentorship can shape your career and why giving back matters as you become more experienced
🔐 How to navigate major career transitions and find new ways to use your experience

Whether you are trying to break into cybersecurity, looking for your next opportunity, moving into leadership, or figuring out what the next stage of your career looks like, this episode offers practical lessons on building a career that can evolve with you and the industry.

🎙️ Listen to Part 2 of our conversation with John Masserini on Root to CISO.

#RootToCISO #Podcast #Cybersecurity #CybersecurityCareers #CISO #CybersecurityLeadership #CareerAdvice 

Transcript

Speaker 0:00

Hi, and welcome to the Root to CISO podcast. It's me, Kris Rides. I'm gonna be your host and I'm gonna be chatting to seasoned chief information security officers about their career journeys. We're gonna be unencrypting their real life stories and searching for the hidden keys to help you fast track your cybersecurity career

kris-rides_3_06-29-2026_145120 0:21

Hi everybody, and welcome back to part two with John Masserini. Uh, where we left it off last week, or just a few minutes ago for us was, we were talking to John about his role and his job that he just got into a security consulting company back in New Jersey. And so first sort of completely dedicated company, dedicated team focused on that. So I'm interested to hear, how that came about, obviously after turning down the EDS opportunities internally, and then also how that was being probably pretty cutting edge with most companies not even having information security or information assurance, I guess, maybe back then, right?

john-masserini_3_06-29-2026_175120 1:02

It was an interesting time, right? Uh, in that, in that just, the, the opportunity back in, New Jersey was actually for a very, um, it's for a very large government contractor based in DC.

kris-rides_3_06-29-2026_145120 1:18

Okay.

john-masserini_3_06-29-2026_175120 1:18

and they were just, growing, a cyber business. That's what they were doing, right? Um, so coming from arguably one of their main competitors, being EDS, having the cyber experience, there weren't many of us, right?

kris-rides_3_06-29-2026_145120 1:35

Yeah

john-masserini_3_06-29-2026_175120 1:35

it was, you know, it was a really good fit. Um, so it was just between the insurance houses, uh, the insurance firms, the, the brokerage firms, the financials up in New York, were happy that someone wanted to go, be back up there, and do work on cyber. So,

kris-rides_3_06-29-2026_145120 1:55

Mm-hmm.

john-masserini_3_06-29-2026_175120 1:55

um, schlepped the family, back to New Jersey. Um, and, you know, kind of just built a great, great program, right? Uh, the, the company back then, well, the company's still called SAIC. Um, and,

kris-rides_3_06-29-2026_145120 2:10

I know them

john-masserini_3_06-29-2026_175120 2:10

have, a firm called Global Integrity. And just, I look back and, the people who, between Global Integrity and, the, of the, the firm that I worked for after Global Integrity I look around and every one of them are CISOs. They're they've, uh, started, uh, security startups. They've ran businesses. It was just between those two organizations, the other one was called Garden based in, in Boston, um, they were just, this incredible incubator of talent, right? And it was just... You know, I look back now and I go, it just, it seemed like the Wild West, right? Because we were just, we were out, everywhere, just selling security, just trying, just trying to move the needle a little bit, right? And it was just, it was a really fun time. You know, the big, um, at that point, the big regulation was called GLBA.

kris-rides_3_06-29-2026_145120 3:15

Yeah

john-masserini_3_06-29-2026_175120 3:16

Um, you know, the, that hit the banks, right? 'Cause it was, we have to stop putting account numbers on statements and, you know, that kind of stuff. so there was this big, there was this big push when GLBA came out, and we just happened to be, one of the few cyber firms that had experience, right? We had been doing this for a couple years and, you know, at that point it just, it exploded. We were busier it was just, it was crazy, right? We had, people all over the place. We were in kind of almost, every financial, every insurance. We had a huge group of people, who were in, the petroleum side, all of the majors. So it was just, it was an amazingly fun time. Um, and then they decided to sell the subsidy, of Global Integrity, to another firm, Which didn't go over very well.

kris-rides_3_06-29-2026_145120 4:10

Right

john-masserini_3_06-29-2026_175120 4:10

It was just, it was, um, it was just a very two very different organizations that could not gel together, right? They were a networking firm. They were, you know, they weren't what we would call an MSP today, but they were sort of like an MSP. Um, we just, we had different operating models, right? There was no VAR aspect to what we did. Uh, right from the start it was consulting. That's all it was.

kris-rides_3_06-29-2026_145120 4:39

Yeah

john-masserini_3_06-29-2026_175120 4:40

so, you know, that, ultimately, did not work out and, and, uh, unfortunately that, that company kind of, dissolved a little bit. But a bunch of us picked up and went to this company called Garden that was

kris-rides_3_06-29-2026_145120 4:53

Yeah.

john-masserini_3_06-29-2026_175120 4:54

in, in Boston, in Waltham, Massachusetts.

kris-rides_3_06-29-2026_145120 4:58

Did you have to move again? Did you have to move again?

john-masserini_3_06-29-2026_175120 5:00

I'm sorry?

kris-rides_3_06-29-2026_145120 5:00

You

john-masserini_3_06-29-2026_175120 5:02

Uh,

kris-rides_3_06-29-2026_145120 5:02

take the family down there or

john-masserini_3_06-29-2026_175120 5:03

not move, thankfully. I, I did not have to move. Um, but it was, uh, you know, I look back on that, and the people, that just, again, collective group of people there, which are so amazing. We built, um, we were predominantly consulting, right? That's kind of what we did. Um, but one of the, one of the, uh, there had this idea that, know, can build, we, we can take this new thing, this fairly new thing called Linux. We can put a box on site Nessus on it,

kris-rides_3_06-29-2026_145120 5:39

Yeah

john-masserini_3_06-29-2026_175120 5:39

can scan their infrastructure, and then we'll take the data, analyze it, and give them a report. So they don't have to do anything, right? We just drop this box on site, and we do the scanning. Um, that turned out to be kinda like one of the very first security service providers, right? And it was huge. We ended up buying a data center down in Providence and building all this infrastructure and all this kind of stuff. We're out here doing all sorts of consulting, and it was just, it was amazing, right? It, was just being part of that whole, that whole experience was just fantastic. We're doing that for several years. Um, the world was great, fantastic. Um, VeriSign gets tired of us beating them at every RFP,

kris-rides_3_06-29-2026_145120 6:24

Right?

john-masserini_3_06-29-2026_175120 6:25

They buy us. Same thing happened once again. The, the cultures didn't jive, and the next thing you know, the consultants are being turned into sales engineers and all that kind of stuff. So, um, it was an amazing run. Um, one of the, one of the people that honestly I look at as my first mentor in this space was Steve Katz from Citi. and Steve, I met Steve while working at Guardant because we would do application pen testing and all that kind of stuff for him. When the Guardant VeriSign thing happened, I decided to leave. that's when I became the CISO for Dow Jones and the Wall Street Journal. Um, and kind of reached out to Steve and I said, I'm gonna need some help here." And you know what? I would go into the city, and we would have coffee or have lunch and God bless that man, he had the patience of a saint and, you know, being, arguably the first CISO, right? and but, he would, he, would just... You know, I'd be able to call him and say, what do we do with this?" And he'd give me pointers or, I'd get, a paper emailed to me, and he'd go, "Read this and that'll put you in the right direction." It was just, it was amazing. And honestly, we were talking about BSides earlier and all that- When I do mentorships, I do a lot of, executive coaching and all that kind of stuff, and all of that is rooted on how he treated me, right? He could have very easily said, "I don't have time for you," you know, "I'm, I'm the CISO for Citi. I have more things on my plate than to worry about you." he didn't. He was a human, right? And he

kris-rides_3_06-29-2026_145120 8:10

Yeah.

john-masserini_3_06-29-2026_175120 8:11

man, and took the time, know, when he knew if I reached out, I needed help, right? He was always there. So, um, again, looking back on, having that experience, that's the experience that I wanna bring forward and there's a lot of reasons, like I said, with the BSides and all that kind of stuff that kinda drives that mentality that we have to give back.

kris-rides_3_06-29-2026_145120 8:36

Yeah

john-masserini_3_06-29-2026_175120 8:36

Um, so just kinda to quickly get through, that... I ended up at Dow Jones. I was their, CISO for about six years. Uh, had all sorts of fun. Uh, that's when SOX came out. that's when PCI DSS came out. So, you know, I joined and my number one objective, was to get us SOX compliant,

kris-rides_3_06-29-2026_145120 9:01

Yeah

john-masserini_3_06-29-2026_175120 9:02

sooner did I do that than we had this thing called PCI that I had to worry about getting us compliant, right? And not long after we managed that, we had, Fox come in, and, and buy Wall Street Journal. Not Fox, but uh, News Corp

kris-rides_3_06-29-2026_145120 9:17

Yeah

john-masserini_3_06-29-2026_175120 9:17

came and bought, Dow Jones. And then we had to have all sorts of other compliance issues that we'd never even imagined. So it was just, that was six years of constant change and constant growth, and it was just, know, The Wall Street Journal is one of the most well-respected properties in the world and, ensuring that that never went down, never got hacked was, you know, it was critical. And then you think about the other thing that- Most people don't realize is Dow Jones has, runs the infrastructure for the industrial averages, right? So if the industrial averages go down, that did happen once in my tenure there, we had a technical problem, right? And the markets went down hard, Um, you know, our, it's public, so it's, a lot of our executives were called to Congress going, "What's going on?" Right? I mean, we can't have this single point of failure that makes the markets drop 800 points.

kris-rides_3_06-29-2026_145120 10:21

Yeah

john-masserini_3_06-29-2026_175120 10:22

Uh, understanding that we're, we're not just a publishing company. We don't just publish The Wall Street Journal. We actually drive the financial markets, right? And that necessarily click for a lot of people, right,

kris-rides_3_06-29-2026_145120 10:37

Yeah

john-masserini_3_06-29-2026_175120 10:37

point, and then we all, we kind of took a step back and went, "Hmm, yeah, we..." It's more than just calculating a number, right? The world literally runs on this number. So, um, understanding, contingency planning, business continuity, disaster recovery, you know, and the whole crisis management, kind of fell to me, right? So my team was now responsible for building an entire crisis management program for a lot of that infrastructure. Uh, so, it was, you know, one day we're running vulnerability scans, the next day I'm worried about Fukushima nuclear plant in Japan is melting down, and we have people out there. What are we gonna do? How, are we gonna, keep our business running and all that kind of stuff. So, there, um, yeah, it was just, it was an amazing, amazing place. Um, and it, but it was just always on, they were cutting edge enough, to where they were, you know, the Journal had... They were targets, right? There was no other way to put it, right? I

kris-rides_3_06-29-2026_145120 11:39

Yeah.

john-masserini_3_06-29-2026_175120 11:40

um-

kris-rides_3_06-29-2026_145120 11:40

public, right? Very public targets

john-masserini_3_06-29-2026_175120 11:43

Very, very public. Uh, so understanding, you know, we, uh, quick story. So we had, all of our reporters when they were trying to file stories remotely would have... Remember the old secure ID tokens, the little fobs with the rotating numbers, right? so we got a call one day and went, "We need to get this person access. His fob got confiscated because somebody thought it was a timer for a bomb, he can't submit his story, and we need to get this to print in, like, 12 hours." We're like, wait a minute. I was just... You know, but they're the kind of things that you walk up to and go, "Oh, never would've expected," right? 'Cause somebody didn't know what it was, and yeah, it's a rotating number. It looks kind of suspicious. We'll just take it, right? Um, so, there, there are the kind of things that, every, every security executive deals with the complete unexpected, right? And

kris-rides_3_06-29-2026_145120 12:40

Yeah

john-masserini_3_06-29-2026_175120 12:41

while that's the part I love about this job, it's also the part that, causes all the gray hair, right? Because you just, you literally walk in the every morning, you go, "Okay, what are we gonna, what are we gonna find today? What are we gonna deal with today," right? And that's kind of the fun part of it. Um, I was at Dow Jones for six years. Left there, went right up the street, to a company called MIAX Options, and, uh, built a stock exchange. Um, a bunch of, a bunch of folks from the old Philly stock exchange, when that was bought, had this, idea about building, kind of the world's fastest processing stock exchange off off-the-shelf hardware, right? No custom chips, nothing. Literally you could buy the server, and we could, we could do this. Um, so when I was thinking about it, when I was thinking about making the jump It was really, how many times, uh, is a CISO gonna have an opportunity to build infrastructure and program from nothing,

kris-rides_3_06-29-2026_145120 13:48

Yeah, Greenfield.

john-masserini_3_06-29-2026_175120 13:49

could

kris-rides_3_06-29-2026_145120 13:49

Rare.

john-masserini_3_06-29-2026_175120 13:50

It how I wanted. I didn't have to worry about legacy technology anywhere, right? There weren't old applications that were... Everything was being written from scratch. w- when I, m- my first day when we walked in there, literally we were whiteboarding things, right? There wasn't even a data center. You know, we were building all of the operation centers and the data centers and all that kind of stuff. So it was, um, it was just one of those opportunities where you go, "I'm never gonna have this again," right? So, I took the leap and it was it was just, so different than anything I had done. Um, all of my experience with the regulators nothing compared to time I spent with the regulators building a stock exchange, right? I mean, it was, we were in DC, we were on the phone with them constantly. We're doing something that's extremely cutting edge for that industry, right? If you think about most of the exchanges, they've been around for a long time.

kris-rides_3_06-29-2026_145120 14:48

Yeah

john-masserini_3_06-29-2026_175120 14:48

well-known infrastructure, very well-known hardware. So when you break from that model and you build something brand new, there are a lot of questions and there's a lot of education that you have to do with the regulators. Not that they don't under- you know, well, th- they don't understand it, but it's only because they've never had a reason to understand something different, right?

kris-rides_3_06-29-2026_145120 15:10

Yeah

john-masserini_3_06-29-2026_175120 15:10

Um, so just there was an immense amount of regulatory scrutiny. We were, we were about a year from before going live Facebook went public and the NASDAQ crashed, right? There, there was this whole debacle with, with Facebook going live they couldn't handle all the volume, which cranked up all of the regulatory pressure on us, right? They're like, "You're not going live." Right? You know, "We don't you can't ha- we can't have you cause a ripple effect through the market." And all this, so we had to go and prove to them that we could handle all these scenarios and do all this kind of stuff. So it was, amazing to be able to build, an entire infrastructure, in the concepts you have in your head, right? 'Cause no matter how long I was at Dow Jones, it was always, "Well, if I didn't have this 40-year-old mainframe, I'd be able to do these things,"

kris-rides_3_06-29-2026_145120 16:03

Right

john-masserini_3_06-29-2026_175120 16:04

I wasn't so reliant on our infrastructure running COBOL, we could do all these other things," right? Um, so being able to do that was just something I will always cherish, right? It just, it was so unique. We had such a great team. Um, and I look at the team I had I had there, they're out, directors and leaders now of their own security organizations and all that. So it was, I'm happy to say that, you know, there was just a great, you know, another great experience and a great team where we all came together just to do the right thing. Yeah.

kris-rides_3_06-29-2026_145120 16:42

Yeah. It's an amazing opportunity. We don't, I think, so, like I've run Tiro since 2012, so we're 14 years in, and I think at a CISO level building something from scratch, less than 10. Less than 10 of those placements, I would say, just trying to think off the top of my head. Yeah. Six, maybe seven, like in, in 14 years, like of all those placement, like they don't, those sort of things don't come up very often, so you gotta

john-masserini_3_06-29-2026_175120 17:15

Okay.

kris-rides_3_06-29-2026_145120 17:15

grab them when you can

john-masserini_3_06-29-2026_175120 17:16

you know, usually, "Oh, well, we're gonna move, this group that's in network security, we're gonna give them to you. This group over here, we're gonna give them to you. With what we've been kinda in over the years, and, eventually..." And honestly, unless, you're joining a startup,

kris-rides_3_06-29-2026_145120 17:35

Yeah.

john-masserini_3_06-29-2026_175120 17:36

always gonna walk into that,

kris-rides_3_06-29-2026_145120 17:37

Yeah

john-masserini_3_06-29-2026_175120 17:38

I consider myself very blessed for having that opportunity. And, um, I look at how they're doing now, and they're just, you know, they're doing amazing. So, it all worked out.

kris-rides_3_06-29-2026_145120 17:49

Yeah. Even the, I mean, even some of the startups that we work with, a lot of them, a lot of that technical stuff's semi already decided, right? Even at that stage. So to get in at an early enough stage where you can really make a difference and pick the tools you want, no technical debt, like, the people you want, yeah, it's just, it doesn't happen very often. Great experience to see it right the way through. So how long were you there for?

john-masserini_3_06-29-2026_175120 18:15

So I was there for six years as well. I there for six years as well. And, um, that got to, I wouldn't say I needed a change, right? I mean, I was happy. Everything was going great. I got a, I got a call, I got a call one day, a recruiter who was looking for to come in and consolidate all of the different security teams spread across the world, for, uh, for this mobile phone provider in Latin America. And I'm like, "Well, not moving to Latin America," right? "No, it's based in Miami." And honestly, that was, my wife and our long-term goal was to always be in Florida, right?

kris-rides_3_06-29-2026_145120 18:57

Yeah.

john-masserini_3_06-29-2026_175120 18:57

know,

kris-rides_3_06-29-2026_145120 18:58

Were you snowbirds already at that point? Were you coming down for the winters and stuff?

john-masserini_3_06-29-2026_175120 19:03

Um, it was early.

kris-rides_3_06-29-2026_145120 19:06

Yeah.

john-masserini_3_06-29-2026_175120 19:07

Was early in the plan, yeah. But, the kids were in college and, you know, and, getting ready to graduate and start their lives. So, it, it wasn't anything completely off the charts, right?

kris-rides_3_06-29-2026_145120 19:19

Yeah

john-masserini_3_06-29-2026_175120 19:19

Um, I joined Millicom, who, uh, basically are mobile phone and cable to home, provider throughout, uh, Latin America.

kris-rides_3_06-29-2026_145120 19:29

Mm-hmm.

john-masserini_3_06-29-2026_175120 19:30

Uh, there are 14 countries. When I joined, they had several in, Africa as well. They got rid of them while I was there. But, yeah, it was, a bunch of different countries, each having their own security team and program. Millicom had grown through acquisition, so, every country's infrastructure was different than, almost every other country's, right? And the was a holding company, So they wanted someone to come in, structure it wasn't around direct, necessarily direct line reporting, but it was really around structure, reporting structure, and making sure that everyone was at least the same page about how we were gonna march forward, right? So, very different model, very different industry, right? So from publishing to financial, stock exchange, and now telco,

kris-rides_3_06-29-2026_145120 20:30

Yep

john-masserini_3_06-29-2026_175120 20:30

Um, that was the most, that was the appealing part of the opportunity was, once again, doing something different,

kris-rides_3_06-29-2026_145120 20:40

Yeah

john-masserini_3_06-29-2026_175120 20:41

From Dow Jones to the stock exchange, it was, "Wow, how, am I ever gonna be able to build something From the stock exchange, to Millicom was this is a global opportunity to, really help a whole bunch of different countries and people pull this all together, right? So, yeah, you know, we, we built a global security operations center. We had a global team, that kind of oversaw, everything. And it, it, it worked exceptionally well. Um, then, unfortunately, the company was hurt very badly by COVID.

kris-rides_3_06-29-2026_145120 21:19

Mm-hmm.

john-masserini_3_06-29-2026_175120 21:19

Um, you know, there were, just and cuts and, and management changes that were made. And it was all, the... Not that they were in survival mode, but I mean, COVID, it, that, that hurt, right? Especially, know, the business models between, you know, US mobile phone markets and Latin American mobile phone. They're very different business models, right? Um, so when you have people, when you have entire countries that are now, can't go to work because of COVID or, the, it just, the business was challenged, right? And it wasn't just ours, it was the whole industry.

kris-rides_3_06-29-2026_145120 21:54

Right. And they weren't just mobile, right? Were they just being used less? Was that the issue? Is that the people were spending less money on their,

john-masserini_3_06-29-2026_175120 22:01

No, no.

kris-rides_3_06-29-2026_145120 22:02

or

john-masserini_3_06-29-2026_175120 22:02

issues were, because most people down there were out of work, you know, there were, they weren't paying the bills, right? So, there was, um, there were a lot of, a lot of government mandates. Um, and, where, you know, during COVID, I was 99% as productive as I was before COVID 'cause I could work from home. in a lot of the countries down there, working from home is not an option, right? You have to go build the house. You have to go to a construction site. You have to go farm the fields. You have, you know, it's very much, labor kind of work where if you're not doing that, you're not getting paid, So the whole, the whole, economic challenges during COVID, it just had an impact on the company as it did in many companies,

kris-rides_3_06-29-2026_145120 22:55

Yeah, it did. Yeah

john-masserini_3_06-29-2026_175120 22:56

So, um, coming out of COVID, there were, just a lot of changes. Um, and quite honestly, I was at that point, 18 years as CISO, and, just kind of decided that it was time, right? And that's kind of what, what it was. Um, so it, was, the team is prospering there now. I still keep in touch with a bunch of them and, they're doing very well. But, know, I, I will tell you when I left that, when I left that job, I was lost. I was lost. Had, um, I, I left there and I started working for Tag Cyber with Ed Amoroso.

kris-rides_3_06-29-2026_145120 23:37

Okay

john-masserini_3_06-29-2026_175120 23:38

So doing the analyst work, and, you know, helping startups and all of that. Um, but I I lost purpose.

kris-rides_3_06-29-2026_145120 23:54

Yeah

john-masserini_3_06-29-2026_175120 23:56

being in that seat for 18 years, um, you almost You almost get addicted to the stress,

kris-rides_3_06-29-2026_145120 24:06

Right.

john-masserini_3_06-29-2026_175120 24:07

And

kris-rides_3_06-29-2026_145120 24:07

Yeah, I bet

john-masserini_3_06-29-2026_175120 24:08

have the stress, you don't know how to live without it, right? And I, I, you know, anybody who had told me that beforehand, I would've just kind of laughed them off. I will tell you, it took me a year before I... You know, it, it's in some ways like a drug, right? I was kinda... I missed the excitement, right? I

kris-rides_3_06-29-2026_145120 24:29

Yeah. Endorphins, right?

john-masserini_3_06-29-2026_175120 24:31

And, and, everything that drove me

kris-rides_3_06-29-2026_145120 24:34

Yeah

john-masserini_3_06-29-2026_175120 24:34

was now not there.

kris-rides_3_06-29-2026_145120 24:37

Mm-hmm.

john-masserini_3_06-29-2026_175120 24:37

I didn't expect that. That was, in my entire life, that transition, that year after stepping away, undoubtedly the hardest

kris-rides_3_06-29-2026_145120 24:49

Yeah. It's funny, isn't it? 'Cause probably people work so hard towards that and get excited by it, and I feel like for a lot of people, certain types of personalities, and I'd include myself with that, I love the idea of it, but I wonder... I mean, I even, I go back to the UK for sort of three or four weeks, see all my family. I, I work still when I'm there, but I after a little while I start feeling a bit agitated that I'm not in my home office, that I'm not, am I doing enough? You know. And, and I think a lot of people... I actually, I'm gonna make a prediction here. Who knows whether this will come true, but I'm a big believer with AI being able to maybe improve people's, um, you know, productivity. And I think highly skilled people that have got a lot of industry experience, I think we'll see more and more people semi-retire rather than completely retire. I think there'll be a lot more people that'll, maybe have a gig for a few hours a week, and that keeps them moving, gives them purpose. Um, which may maybe this will help, with some of the gaps that, that, that there are and there will continue to be if we don't bring enough youn- uh, you know,

john-masserini_3_06-29-2026_175120 26:00

Yeah

kris-rides_3_06-29-2026_145120 26:00

earlier career people through. Um, but I can see that happening. I can see quite a few people doing more fractional sort of related work, and more companies being more open to it as well

john-masserini_3_06-29-2026_175120 26:12

Yeah. Yeah, I wouldn't call myself semi-retired,

kris-rides_3_06-29-2026_145120 26:15

Yeah.

john-masserini_3_06-29-2026_175120 26:16

but

kris-rides_3_06-29-2026_145120 26:16

not now. You got too much on.

john-masserini_3_06-29-2026_175120 26:21

Um But I, I, I do truly enjoy the lifestyle I now lead. Oh, one sec.

kris-rides_3_06-29-2026_145120 26:30

Yeah, no worries

john-masserini_3_06-29-2026_175120 26:32

it's, it's very much, um, just... Side note. I need to take, I need to take my laptop in to get repaired, so I'm going tomorrow morning, right? I'm just, I'm gonna go, I'm gonna go hang out at, with the Mac genius, and he's gonna fix my laptop, and then, I'm gonna come home, and I'm gonna get finished working. I don't... punching a clock and having that flexibility, you know, I kind of half-joke about it when I say it. I don't, I can never, I don't think I'll ever retire, right? Maybe I, okay, maybe I go down to one or two vCISO clients or, you know, maybe I'm an advisor on only a couple boards but always having something to do, especially in this industry, can't ever see me giving that up completely. I just, I can't. So to the point you were making, right? I mean, even if it's a mentoring, right, or s- or something, uh, I look at, whether it's family or family friends or whatever, they retire, and they kinda, "What do I do with myself now?" Right? And I felt that way after I left Millicom. I'm like, "What purpose do I have?" Well, I'd be able to find that purpose all the stress, right? And that's what I love about what I'm doing right now

kris-rides_3_06-29-2026_145120 27:52

Yeah, I can see that. And I can, I think well we've-- everybody's heard the stories or knows somebody that either didn't retire in a very stressful job and the, the job retired them permanently, right? Or, the people that retired and then didn't do anything at all, and they've saved their whole life ready for it, and then they've got no purpose and unfortunately, you know, Grim Reaper comes and that's the-- they've been saving for years for this time that they never got to spend. And so I think there's a-- I definitely think there's a lot to be said to, to, to people retiring and having, keeping their hand in and keeping involved in stuff, and still having a purpose and a schedule, and things to get up out of bed and do. Um, so yeah, I, I, uh, yeah, I can see a lot of people going that way. And I'm glad you've found yours as well in a, in, in a way that keeps you very, very busy, but without the levels of stress you got at a lot of those places.

john-masserini_3_06-29-2026_175120 28:44

Yeah. Yeah, and and, would I, did I ever imagine I would be an event planner and coordinator? No. Never in my wildest dreams. But, look, it's stressful, and thank God we have the team we put together, we did for BSides. But that, when that day comes, we are all so thrilled and happy. the turnout, and the way, you know, the way the whole event goes. go, "Okay I can do this," right? It's, you know, a handful of months a year, and look, look at the turnout, look what it does for the community and all that kind of stuff. And, and it, it, it's a, it's a good feeling, right?

kris-rides_3_06-29-2026_145120 29:23

Yeah

john-masserini_3_06-29-2026_175120 29:24

you know, yes, I was going to work, and yes, it was stressful, and yes, I loved what I did, but, like, BSides, you, it's a good feeling, right? And

kris-rides_3_06-29-2026_145120 29:33

Yeah.

john-masserini_3_06-29-2026_175120 29:34

that's the only way to describe it

kris-rides_3_06-29-2026_145120 29:35

Well, you can see, I think you get to see that and all of the people that attended it and having photos taken and like giving you feedback, "Thank you so much, I enjoyed that." Like you see that and like me, um, having been to both of them, I can see that in everyone else, but I can also see it in all the organizers. Like I can see the excitement, uh, of it and that, you know, when you see all the people come through the door and how full and busy it is, you know, it's... And, and how that's sort of giving back to the community. So no, it's a lot to be said. You do, you guys are doing great work, so

john-masserini_3_06-29-2026_175120 30:04

Yeah

kris-rides_3_06-29-2026_145120 30:05

I'm sure you'll keep it up because it's constantly growing. I mean, the last one, the second one was even bigger than the first one, and the first one was way bigger than what I would expect a first Bsides to be anyway.

john-masserini_3_06-29-2026_175120 30:16

Yeah. Yeah, you you and me both.

kris-rides_3_06-29-2026_145120 30:21

So that's amazing. Like, I think, let me ask you a few questions just to sort of tie this up. I wanna tie it back to, like, all of the experience that you've got. Um, and, we talked a bit about internships. I think some of the people will have listening here, uh, the audience we tend to have range right the way through from people that are just starting their careers, people that are even maybe still at school, right the way through to experienced directors that are trying to make that sort of CISO step. Think the current market is a strange one for leaders. Um, and so I would say, you know if you've got any advice for those people that are out there and either have been laid off and looking or, you know, need to move on from where they are currently, what's the one piece of advice you'd give, to entry-level people, and then one piece of advice to people that are a bit more senior in their career?

john-masserini_3_06-29-2026_175120 31:14

Um So for entry level folks, I would absolutely, tell them to not rely on book smarts, right? We touched on this a little bit earlier, right? When we would hire, I would trust my team to get us down to two or three people,

kris-rides_3_06-29-2026_145120 31:41

Yep

john-masserini_3_06-29-2026_175120 31:42

And then, I would, you know, meet the people, not... You know, my team has already vetted their skill set and their knowledge base, all that kind of stuff. My interviews of them are around personality, right? I wanna make sure you're gonna fit with the team, but more importantly, I wanna make sure there's a desire and a drive, right? having a discussion, seeing you get excited telling me about, like I said, building that gaming platform or figuring out, some Wi-Fi thing that you know. That to me shows your passion and it shows you're willing to tinker, right? more so than I think any other part of technology in the enterprise, you've gotta, you've gotta be curious in security, right? Because it's never what it seems. Nothing we do is what it seems, right? So the the desire to pull things apart, figure out how they work, them back together or make them better, you know. Go build a Raspberry Pi, right? To

kris-rides_3_06-29-2026_145120 32:54

Yeah

john-masserini_3_06-29-2026_175120 32:54

to be a media server for your house. It'll cost you 50 bucks but doing that shows me, okay, you got some chops. You can, you can put some things together, right? didn't just flip a page and figure out where the answer was, right?

kris-rides_3_06-29-2026_145120 33:08

Yes

john-masserini_3_06-29-2026_175120 33:09

for entry-level people, I would absolutely say get your hands dirty, build something, do something, whatever it is, right? 'Cause the truth is, even if you're, know, even if you're rebuilding, a carburetor, right? That's still, that shows, a curiosity and a willingness to explore and tinker, and that's kind of what we look for, right?

kris-rides_3_06-29-2026_145120 33:30

Yep

john-masserini_3_06-29-2026_175120 33:31

So for people who are, either changing careers by choice or not, um, or, or looking for work, you know, one of the things that I'm a huge believer in is networking.

kris-rides_3_06-29-2026_145120 33:44

Mm-hmm.

john-masserini_3_06-29-2026_175120 33:46

A lot of my friends laugh when I say this, but the truth is, I feel I'm very introverted, right? I don't like to be in front of people. I don't necessarily like to be in front of crowds. But I learned early on That I had to be,

kris-rides_3_06-29-2026_145120 34:03

Yeah

john-masserini_3_06-29-2026_175120 34:04

learned how to be, and a lot of people, and it's funny, especially in the technology side, technology people, I think a lot of us are attracted to technology because we don't have to deal with other people, right?

kris-rides_3_06-29-2026_145120 34:17

Right.

john-masserini_3_06-29-2026_175120 34:18

Um, there are a lot of people in tech who just they don't wanna be up on stage and give keynotes. They don't like to network. They don't like to shake hands. But if you're solely relying on online networking, whether it's LinkedIn or whatever, that's never good, right? Every single city, no matter where you live, has in-person meetups. Go out, have a beer, introduce yourself, because that's how things happen, right? That's how

kris-rides_3_06-29-2026_145120 34:48

Yeah

john-masserini_3_06-29-2026_175120 34:49

you know, the opportunity that you want. Look at any posting on LinkedIn, right? It'll say, "Posted for two hours, over 100 people applied,"

kris-rides_3_06-29-2026_145120 34:59

Yep

john-masserini_3_06-29-2026_175120 34:59

think that's 100 bots personally, but the reality is you're now one instead of being one of 10, So you gotta... know it's uncomfortable, and I know a lot of people hate doing it, but just show up, right? We have some events here in, in South Florida that are literally eight people around a bar having a beer, and we have some events like Bsides or the SoFlo Tech Kids that are hundreds of people, right? Go shake hands, meet somebody new, then connect with them on LinkedIn, and the rest follows. But if you're just sitting here sending out emails and trying to connect on LinkedIn, you know, I, I think you're putting yourself at a disadvantage. I think you have to be... You have to get out there and shake hands. Um, a- and, and, you know, honestly, in some ways I think that that also applies to the new folk, the new folks too, right? That, you

kris-rides_3_06-29-2026_145120 35:56

Yeah

john-masserini_3_06-29-2026_175120 35:57

um, you might, you might be just graduating college or or, trying to figure out what you wanna do. But meeting people, you never know what opportunities are gonna pop up

kris-rides_3_06-29-2026_145120 36:08

Yeah. Yeah, no, I can't agree with you more. I think to add on, onto that, I would just say don't forget, B Sides is run by volunteers, which means they normally look for volunteers, and volunteers end up with you spending a lot of quality time and getting to meet great people in the industry that are also passionate, and

john-masserini_3_06-29-2026_175120 36:28

100%.

kris-rides_3_06-29-2026_145120 36:28

There's a lot of respect for that. I, I see people put that sort of stuff, their volunteer work on resumes, and I genuinely believe, it's of a lot of value, so

john-masserini_3_06-29-2026_175120 36:36

100%, yeah. I mean, we had, a couple companies here down in South Florida who, you know, unfortunately companies went out of business and such, and they're like, "Look, we wanna come, but, you know, it, it's, 100 bucks." We're like, "Okay, then volunteer,"

kris-rides_3_06-29-2026_145120 36:52

Yeah

john-masserini_3_06-29-2026_175120 36:52

So they volunteered, they got They came for free, they helped us out, 'cause we always need... You know, we do not have enough volunteers, right? So it works, right? That's the kind of stuff, to your point, exactly, the, whether it's, you know, what... You know, I'm, I'm also, involved in a couple different organizations like that. You never, ever have enough volunteers. Um, so either volunteer, be part of the organization just as a member, but you gotta get out and be part of the organization, right? Don't just kinda sit there and wait for stuff to come in. You gotta, you gotta, you gotta participate in your life

kris-rides_3_06-29-2026_145120 37:29

Yep, 100%. I, can't agree with you more. I think there is opportunities there and, uh, that you need to grab them, right? You need

john-masserini_3_06-29-2026_175120 37:36

Yeah

kris-rides_3_06-29-2026_145120 37:36

go and grab them, be part of the community. Don't expect anything in return. That's the only thing I would add to that, right? You, you, you don't need to give and expect to receive, but what you'll tend to find is when you do, people realize that. So,

john-masserini_3_06-29-2026_175120 37:49

Exactly.

kris-rides_3_06-29-2026_145120 37:50

things will come to you, good things. So thank you so much. Thank you for all of the work you do for B-Sides and for being my guest as well, um, and spending this time with me. I'll definitely see you at the next B-Sides. I think my team in Florida might be doing the ISSA chili cook-off this year,

john-masserini_3_06-29-2026_175120 38:10

Really?

kris-rides_3_06-29-2026_145120 38:10

I've been told. Yes. I've been told. Two of the, two of them are actually currently fighting over who's got the best chili, recipe. So it sounds like that's gonna happen. So I shall probably see you, uh see you soon in person. But thank you so much

john-masserini_3_06-29-2026_175120 38:25

Yeah. Thank you for having me. Um, thank you, thank you for all you do as well and, you know, appreciate all, all, all of the support. We really do. Yeah

kris-rides_3_06-29-2026_145120 38:35

Nice one. Thanks, thanks so much, John. And thanks everybody for listening. Make sure you do all the good stuff, like, subscribe, share it with your friends. Uh, and don't forget to come and tell me if you want anybody else that you know out there you think, "Oh, this will make a great guest." Um, Kris, I'd love you to have a chat to, to, to this CISO then. Make sure you let me know. And if there's any questions I'm not asking, then tell me. You can even probably grab John on LinkedIn and ask him some questions as well, I'm sure. I'm sure he'd be more than happy to answer them.

john-masserini_3_06-29-2026_175120 39:04

Of course

kris-rides_3_06-29-2026_145120 39:05

Thanks all

Speaker 39:06

thank you for listening to the Root to CISO podcast. If there's something you really want me to ask on the next episode, or if you're a CISO who wants to inspire the next generation, please reach out. I'll leave a URL to my LinkedIn profile and make sure you connect and message me there. We're always looking for feedback, so please don't forget to like, comment, and subscribe wherever you get your podcasts.