درباره این اپیزود
Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, when the field was called information security and security teams could not get a meeting with the CIO. In this conversation, he explains how the industry earned its current board-level standing and what security leaders should do with it.
Jim identifies governance as cybersecurity's biggest area of progress, now formalized in NIST 800-53 revision 5 and CSF 2.0, and explains the principle behind effective executive communication: companies do not exist to be secure, so security has to be framed as enabling the business objective with the least risk possible. He credits ransomware with changing executive awareness, because it made operational disruption a universal exposure regardless of what data an organization holds.
On board communication, his guidance is specific. CEOs and CFOs are experienced risk managers who evaluate risk and reward in every decision. What they need from security is an accurate valuation of the organization's cyber exposure, presented as business impact rather than technical terminology.
The conversation then turns to the labor market. Jim confirms what many candidates experience: the entry level is saturated, while engineer-level positions remain unfilled. He outlines the practical path into the field, including structured internships modeled on medicine and psychology, a four-year degree completed on employer tuition reimbursement, and AI governance as a second skill.
He closes with his position on AI adoption: prohibition fails because employees will use AI regardless, so organizations should provide a sanctioned, secure path, supported by enforced data classification and data loss prevention. A follow-up episode on AI and data governance is planned.
- Governance as cybersecurity's biggest area of progress
- NIST 800-53 rev 5, CSF 2.0, and the formalization of governance
- Security as a business enabler rather than a technology function
- How ransomware changed executive awareness of cyber risk
- Remote work and the expansion of the security perimeter
- Presenting cyber risk to boards in business terms
- Why security awareness and workforce involvement are staffing necessities
- Jim's career path: history degree, campus IT, security leadership
- Professional humility and the role of community in the field
- The labor market: saturated entry level, unfilled engineer tier
- Internships, degree requirements, and career progression
- AI governance as a career skill and an organizational requirement
- AI adoption strategy: sanctioned paths instead of prohibition
- Data classification and DLP as the next area of maturity
Jim Mapes is a practicing CISO, advisor, and adjunct professor who has worked in security since the late 1990s, spanning the antivirus and Windows NT era through today's governance-driven, board-level discipline. He entered the field through campus IT work with a history degree, which he credits for the assessment, analysis, writing, and communication skills that carried him into leadership. He teaches in boot camps and university programs, advises organizations on security leadership, and expects the CISO role to eventually report into enterprise risk under a chief risk officer.
Jim on LinkedIn: https://www.linkedin.com/in/jimmapes/
