Ideas, Experience & Perspectives

😂 The Job Description vs. The Actual Job Requirements: Plot Twist! Ever read a Job Description and think: "This role was practically written for me!" You tick all the boxes: ✅ Leadership experience ✅ Technical expertise ✅ Strategy and governance ✅ Risk management ✅ Team leadership You apply. You wait. Then comes the recruiter call. Recruiter: "Your profile is interesting, but we're looking for someone who has…" Managed cybersecurity for a 4,000+ employee global organisation. Owned the entire security budget. Built the security blueprint from scratch. Presented directly to the Board. And has deep expertise in AI security. You: "Interesting! Which paragraph of the JD was that in?" Recruiter: "Oh, those are additional expectations." And just like that, the goalposts have moved! Apparently, some Job Descriptions come with Terms & Conditions Apply — except the terms and conditions are revealed only after you apply. Maybe every vacancy needs two documents: The Job Description: What the company publishes. The Director's Cut: What the company actually expects. And perhaps one more section: Mandatory requirements — including those not mentioned above. Jokes aside, this creates a genuine challenge for experienced professionals. Candidates spend hours tailoring resumes, assessing their suitability, and preparing applications, only to discover that the actual selection criteria are substantially different from the published requirements. Of course, not every hidden expectation is deliberate. Sometimes, the hiring manager and recruiter aren't fully aligned, or the role evolves during the hiring process. But better, more transparent JDs would save time for everyone. A good Job Description shouldn't just describe the role. It should help candidates understand what success in that role really requires. Over to you: Recruiters and hiring managers — have you encountered this gap between the published JD and the actual expectations? Job seekers — have you ever experienced a plot twist like this? #Hiring #Recruitment #JobSearch #CareerAdvice #Leadership

I've held CISM, CCISO and ISO 27001 Lead Auditor certifications. None of them taught me this. When I first proposed a Security Awareness program with phishing simulations — the reaction was not enthusiasm. It was doubt. “Will the training quality be good enough?” “Our people are smart. They won’t fall for phishing.” “This feels like we’re trying to trick our own employees.” We went ahead anyway. The first simulations were simple. And people sailed through them. Confidence grew. Some even started boasting. “I can spot a phishing email from a mile away.” So we made it harder. The simulations became more sophisticated. More targeted. More convincing. More real. And then it happened. The people who thought they were excellent — got phished. Not once. Multiple times. The same people who had questioned the program were now its biggest advocates. Sound familiar? The data backs this up: 1 in 3 untrained employees click a simulated phishing link before any training. (KnowBe4 2025) 82.6% of phishing emails now use AI — making them virtually indistinguishable from real ones. 9 out of 10 phishing attempts are never reported by employees. But after 12 months of consistent simulation and training — click rates drop by 86%. The program that was once doubted became one of our most valued security investments. Unpopular opinion: Security awareness is not about making people feel smart. It is about making them realise they are vulnerable. Humility is the foundation of good security behaviour. And sometimes the most valuable lesson comes not from a classroom — but from clicking a link you shouldn’t have. Phishing doesn’t care about how smart you are. It only cares about one unguarded moment. Has your organisation run phishing simulations? What was the most surprising result? #Cybersecurity #SecurityAwareness #PhishingSimulation #GRC #ISO27001 #CISM #CyberResilience #InfoSec #ITLeadership #HumanRisk #CCISO #CyberCulture

CYBERSECURITY IS NO LONGER A TECH PROBLEM—IT'S A BUSINESS MANDATE. In over 25 years of leading IT security, I’ve seen a recurring theme: technical security measures fail when they aren’t aligned with business objectives. A Chief Information Security Officer isn’t just a gatekeeper; they are a business enabler. Whether it’s building a robust GRC (Governance, Risk, and Compliance) framework or refining Disaster Recovery plans, the goal is the same—ensuring that the organization can scale without compromise. My focus has always been on creating a culture where security is a "business accelerator" rather than a "bottleneck." When governance is integrated into the workflow, real transformation happens. I’m currently looking at how global firms in Bangalore are evolving their security frameworks for 2026. What’s your take on the biggest hurdle for IT leaders this year? #CCISO #CISM #CyberSecurity #ITLeadership #GRC #BangaloreTech #InfoSec #DigitalTransformation

The most powerful leadership lesson from Sundara Kaanda isn’t just about what Hanuman did — it’s also about what Ravana failed to do. While reading Sundara Kaanda, two contrasting leadership styles stand out sharply. On one side is focused devotion and discipline. On the other is Ravana’s fatal arrogance and overconfidence. Here are the key leadership principles from Sundara Kaanda that I constantly apply in cybersecurity: Leap Before You Have All the Answers Hanuman made the impossible jump across the ocean with incomplete information. Parallel: Many security initiatives die in analysis paralysis. Great leaders take calculated leaps. Intelligence Before Action Hanuman focused on reconnaissance before attacking. Parallel: Too many security programs buy tools before truly understanding their real risks. Adaptability in Hostile Territory Hanuman adjusted tactics fluidly while keeping the mission intact. Parallel: Rigid leaders struggle as threats and business priorities change rapidly. Power with Restraint & Timing Hanuman had immense power but used it with precision. Parallel: Knowing when not to act can be as critical as knowing when to act. Discipline in Mission Boundaries (Jambavan’s Wisdom) When Angada wanted to fight Ravana immediately, Jambavan reminded him: “Our mission was only to find Sita and bring back intelligence.” Parallel: Overstepping your mandate — even with good intentions — creates chaos. The Fatal Cost of Arrogance (Ravana’s Downfall) Ravana was powerful, brilliant, and wealthy — yet his arrogance became his undoing. He underestimated Hanuman, ignored Vibhishana’s repeated warnings, and believed his empire was untouchable. Parallel in Cybersecurity: Leaders who say “We’re too big to fail” or “That could never happen to us.” The ones who dismiss risk reports, silence uncomfortable voices, and overestimate their defenses. History shows this mindset has preceded many of the worst breaches. Humility in Victory Hanuman delivered extraordinary results and returned with zero ego. True leadership is not just courage and capability. It is courage + capability + discipline + humility — and the constant guard against arrogance. Question for you: Which lesson from Sundara Kaanda resonates most with your leadership journey — especially the contrast between Hanuman’s devotion and Ravana’s arrogance? Drop your thoughts below. I’d love to hear your perspective.

We passed the audit with flying colors… and got breached three weeks later. The report looked beautiful. Green everywhere. Auditors left happy. Leadership sent congratulatory emails. Then reality called — and it wasn’t impressed. We’ve turned compliance into high-budget corporate theater. Complete with costumes (policy documents), props (screenshots), dramatic performances (steering committee meetings), and standing ovations for passing the audit. The only problem? The attackers don’t buy tickets to the show. Here’s what the script usually looks like: “Temporary” exceptions that overstay their welcome like that cousin who came for dinner and never left. That critical system got a 90-day exception two years ago. It’s now celebrating its third birthday, still unpatched, still exposed, and still “temporary.” The Screenshot Hall of Fame. Teams proudly submitting the same 2024 policy PDF as “current evidence,” complete with the old CEO’s signature and outdated logo. Auditors nod approvingly. Attackers just shake their heads and move on. Green dashboards, blood-red reality. Everything looks perfect in the compliance tool. Meanwhile, the real crown jewel systems are held together by compensating controls that can best be described as “Roger in IT promised he’ll keep an eye on it.” Check-the-box culture is comedy gold — until it isn’t. We exhaust talented people collecting evidence for controls that exist only in PowerPoint, while actual risks are throwing a full-blown party in the shadows. The punchline arrives when the breach notification hits. Real compliance shouldn’t be a quarterly scavenger hunt for the right color of evidence. It should be a living, breathing stress test that forces us to fix what actually matters. The strongest programs I’ve seen don’t fear audits. They’ve already run the test themselves — multiple times. Question for you: What’s the most absurd or expensive example of compliance theater you’ve witnessed in your organization? Drop your war stories below (no company names). The ridiculous ones usually spark the best conversations.