There is a version of the security leader's job that fits neatly on a slide. Frameworks, maturity scores, a roadmap with tidy quarters. It is the version we present to the board, and it is true as far as it goes.
Then there is the version no one warns you about.
It is the phone buzzing at 2 a.m. and the half-second before you look — the half-second where your whole body already knows. It is sitting in a leadership meeting, nodding along to revenue targets, while a part of your mind never stops running the list of things that could go wrong. It is the strange loneliness of being the person everyone assumes has it handled, on the days you are least sure you do.
That weight is real. And almost no one talks about it honestly.
The myth of the single pair of shoulders
Our entire industry is quietly built on a flattering, dangerous idea: that security is something one capable person — or one capable team — can simply hold. Hire the right leader, give them the right tools, and the weight is dealt with.
It never works that way for long.
The threats move faster than any one person can. The organization grows in directions security was never consulted on. The tooling multiplies until managing the tools becomes its own full-time risk. And the leader, the one everyone is counting on, slowly turns into a single point of failure — not because they are weak, but because the model asked one human to carry something that was never meant for one human to carry.
The problem was never the leader. The problem was the belief that the weight belonged to one set of shoulders.
When that leader burns out, or leaves, or simply has a bad week at the wrong moment, the gap that opens is not a staffing gap. It is a gap in the thing the whole business was trusting to be held.
What the seat actually teaches you
I spent more than three decades in and around that seat — through military intelligence, national-security work, and more than a hundred engagements with organizations of every size. Along the way I had the privilege of mentoring thousands of security and privacy leaders.
If there is one lesson that outlasted all the frameworks, it is this: the leaders who endure are not the ones who carry the most. They are the ones who learned to share the load without surrendering the responsibility.
That distinction matters. Sharing the load is not the same as offloading it. You do not hand security to a vendor and walk away. You do not bury it in a contract and call it solved. The accountability stays with you — it should. But the carrying — the daily, grinding, 2 a.m. weight of it — that part was never meant to be solitary.
The leaders who last figured out how to build something around themselves that holds when they cannot. People who share their values. A discipline that does not depend on any one person remembering everything. And, increasingly, partners who sit on their side of the table rather than across it.
A quieter way to think about it
Here is a question worth sitting with, away from the dashboards: if you stepped away for two weeks, what would happen to the weight?
If the honest answer is it would sit on the desk, untouched, waiting for me — that is not a sign of your importance. It is a sign of fragility. The goal of good security leadership is not to be indispensable. It is to build something resilient enough that your absence is survivable — for the business, and for you.
That is a harder thing to build than a control matrix. It asks you to trust people. It asks you to encode your judgment into a discipline others can run. It asks you to let go of the heroism that the industry, frankly, rewards.
But it is the only version of the job that does not eventually break the person doing it.
You shouldn't carry this alone
I have written this not as a pitch but as a note to a younger version of myself — and to anyone sitting in that seat tonight, watching their phone.
The weight is real. It is not a sign that you are doing it wrong. But you were never meant to carry it by yourself, and the strongest thing you can do is stop pretending otherwise.
Build the people. Build the discipline. And when you are ready, find the partners who will carry it with you — not the ones who will sell you something and leave you holding it alone.
That is the whole of what we believe at CyTech. It took me thirty years to be able to say it this simply.
← All insights