Field CISO

What you'll do

• Partner with Sales, Customer Success, and Marketing teams on strategic enterprise and F500/G2000 opportunities, bringing security and GRC expertise.
• Lead executive briefings and CISO-to-CISO conversations to build trust with prospective customers.
• Represent Drata at industry conferences, CISO dinners, and regional roundtables across the Americas, EMEA, and APAC, building relationships in the security and GRC community.
• Share field insights through webinars, panels, bylines, and press opportunities to build Drata’s voice and credibility.
• Advise the CISO, CMO, CRO, and executive leadership on emerging regulatory shifts, systemic industry risk, and strategic direction for security and GRC.
• Provide strategy and direction for company-wide responses to major industry shifts such as new regulations, certifications, and systemic risk events.
• Raise the security and GRC bar across Drata and the industry through knowledge sharing, forums, and pattern-setting.
• Equip sales teams with security and GRC context and talking points for technical conversations.
• Leverage personal relationships in the security and GRC community to open doors and build trust.
• Partner with Marketing and GTM leadership to plan executive events, speaking engagements, dinners, and roundtables.
• Influence the product roadmap and go-to-market growth strategy based on hands-on experience and customer needs.
• Address highest-stakes, least-defined security and GRC questions facing the business and provide strategic direction.
• Approach external conversations as an extension of Drata’s security and GRC program.
• Support critical company initiatives alongside the internal security and GRC team as needed.

What you'll bring

• 15+ years of progressive experience in security and GRC, including 10+ years leading and managing teams and 5+ years in the CISO seat (as a CISO, Deputy CISO, or equivalent senior security and GRC leader).
• Strong grasp of compliance frameworks including ISO 27001, SOC 2, HIPAA, FedRAMP, GDPR, NIST CSF, PCI DSS, and CCPA, with practical experience to discuss them in depth.
• Excellent communication skills, comfortable moving between boardroom conversations and technical deep-dives.
• Genuine reputation and network within the security and GRC community.
• Track record of operating at the most senior individual contributor level where leadership and peers seek strategic direction.
• Comfort working with ambiguity, turning undefined problems like regulatory direction, market shifts, or systemic risk into clear strategy.
• Experience partnering with go-to-market teams in customer-facing conversations and comfort with enterprise sales cycles.
• Track record of thought leadership through speaking, writing, or public and social engagement.
• Familiarity with SaaS and cloud-native environments, and perspective on how AI shapes security and GRC risk and practice.
• Familiarity with compliance automation platforms like Drata.
• Openness to travel regularly for public-facing representation.
• Curious, thoughtful approach to using AI responsibly in work.