Interview: Jon France Discusses the Unique Role of CISO at (ISC)²

Cybersecurity certifications body (ISC)² appointed Jon France as its first ever CISO in January 2022, with the remit of leading all of its cybersecurity operations while serving as an advocate for security best practices around the world.

France came into the role with extensive experience in the sector, including as head of industry security for GSMA, a global organization representing the mobile ecosystem.

Infosecurity Europe caught up with France to find out more about his journey in cyber so far, how he is shaping the role of CISO at (ISC)² and advice for security professionals entering the industry today.

Infosecurity Europe: What inspired you to work in the cybersecurity industry?

Jon France: I didn’t make a conscious decision to work in cybersecurity. I took a traditional route into cyber for my generation – my career began in IT after completing a degree in computer science. I always knew I wanted to work in technology, but as the need for cybersecurity evolved in the early days of the digital era, my interest in the discipline grew.

At my previous company, I transitioned to the role of Head of Industry Security where I led the fraud and security function for the global mobile industry. After many years of working in enterprise IT and security roles, I realised I enjoyed cybersecurity as a discipline the most – not just securing networks and systems from attacks, but also the human aspect of cyber. Considering how a threat actor may go about attacking a system was an intellectual challenge which required both critical and logical thinking, and that’s really what sparked my passion.

Now, as the cybersecurity industry faces a shortage of more than 3.4 million professionals and more pressures than ever in a digital age, my primary focus is on advocating for the profession while protecting my organisation and raising its resilience. When I began my career 25 years ago, cybersecurity as a profession was nascent as a standalone role (the first CISO position dates back to the mid-90s!) Now, while having an IT background can be helpful, a successful career in the cybersecurity world does not depend on it.

As our research shows, technical skills aren’t the only important attributes a candidate can offer and anybody looking to pursue a career in the field can choose a direct route into cyber without having to follow the same traditional IT path. Non-technical skills such as creative and analytical thinking, as well as personality traits such as strong problem-solving abilities, are all equally or more important than specific degrees and certifications.

IE: How did your previous roles prepare you for the position of CISO at (ISC)2?

JF: I have a strong technical background from many years of working in technology, but I also have been fortunate to gain exposure to many aspects of business operations. In my previous security role I also served as part of the company’s leadership team, while supporting the risk management function and acting as a trusted board advisor. I also served as both Deputy IT Director and Business Continuity Manager at LexisNexis for a number of years. Despite what many may believe, effectively fulfilling the role of a CISO is not just about technical excellence and having hands-on technical experience. It’s all about having an awareness of how you sit within a business, how you can help it, as well as strong communication and leadership skills. In my past positions, I gained board and senior stakeholder exposure, which provided an invaluable opportunity for me to learn how to communicate with the C-suite. I was able to listen and appreciate the executives’ perceptions of cybersecurity, business risk and understand what motivates and drives them.

I’ve also had the opportunity to be on the client’s side of security. Now, I’m in a position of advocating for the profession and I appreciate the complex challenges faced by security professionals operating within a business themselves. 

IE: As (ISC)²’s first CISO, how have you shaped this role since arriving in the post?

JF: Since being appointed as (ISC)²’s first CISO in January 2022, our membership base has grown rapidly, more than doubling in size. With our growing influence of more than 450,000 candidates, associates and members to protect, there comes an even greater responsibility. As our organisation expands, so does our employee base and this brings its own new challenges.

I have brought a stronger focus on internal threats, rather than just external. For example, there is an increased need to educate employees on the security risks posed by shadow IT, especially with the rise of generative AI tools. My aim is to foster an inclusive security culture where all employees feel equipped to play their part in keeping the organisation – and our members – safe and secure. Naturally, we’ve required different practices as the value of the information we hold is going up and we have had to technologically innovate. I make sure we adopt the right strategies, tools and techniques to do so securely.

As our first CISO, my aim was to shift the organisation’s mindset away from cybersecurity as a purely technical function but as a business function too. I am constantly asking my team to question what we’re trying to protect and why. With this perspective, I’ve moved the needle from a 90% technical response to one that is more balanced to consider a business risk perspective too. If our security team suggests we need a certain tool, I ask, ‘What is the negative thing you’re trying to stop happening?’ and more importantly, ‘Why does the business need to care about that?’ I encourage my team to consider the business objective of any decision. I can provide strategic insights to senior management and the Board of Directors and translate what we need to do to be secure.

My overall aim has been to shift security from being viewed as a treatment to a problem, and instead implement principles such as the ‘secure by design’ approach, where security isn’t perceived as an add-on or a reactionary process, but rather an integral and intrinsic part. I work with stakeholders throughout the organisation to ensure security is ingrained in all aspects of our security strategy.

ADVERTISEMENT

Enjoyed this article? Make sure to share it!

Looking for something else?