The Ideal IT Leader

At Pythia Cyber we stress that cybersecurity is a management function, not an IT function.

We also stress that leadership is a crucial part of this function.

Publicly, everyone nods sagely: just as all babies are beautiful, so are all cybersecurity programs either unnecessary or more than adequate.

But privately we hear from a distressing number of CEOs that they fear that their chief tech is not up to the task of building or running a NIST-based integrated company-wide cybersecurity program. We have never heard a CEO say that the CFO was not up to the job of managing the company's money. Why is that? Why are so many technology leaders inspiring too little confidence? This has come up often enough that we thought it worthwhile to write up an answer. Why is it so hard to hire and keep the leader of your technology efforts?

In order to be part of senior management you need to have two very different skill sets. You have to be a good colleague to other members of senior management and you have to be a good leader of your area, department, division, etc.

The two common paths to a seat at the big table tend to emphasize one or the other skill set but rarely both. Generally, you get the big promotion either because you are good at the management part or because you are good at the particular domain part. The stereotypical and cynical way we say is either "empty suit" or "promoted out of what they do best." In other words, some tech leaders are good managers who happen to have stumbled into technology or are good technologists who happen to have ended up in management.

(There is definitely a tendency to overlook departments which are running smoothly and to fixate on the ones which run badly, so there is likely a bit of exaggeration to the sense many people have that IT leaders are often not as effective as other leaders.)

Note that we are not saying that you need to be a technical contributor and up on the latest in order to lead a technology effort. We are saying that your people have to respect your judgement and that you have to be able to gauge your people's work. Therefore it is understandable that many organizations want to anoint an exception technologist as the head of the technology effort. We will discuss why this often does not work very well below.

If it is true for every area of any organization that every leader needs both, why does Information Technology (IT) seem particularly prone to having only one? In our experience, there are two common factors which make this phenomenon worse for IT.

The first factor is that most senior management in most other areas share a common language and background. "Everyone else has an MBA" is something we hear again and again. The degree is part of it, but not all of it. The shared experience of getting the degree, the shared culture and jargon are also a big part of it. This difference, a shared financial background often missing from a technologist's career path, creates two issues: the technologist is out of step in myriad little ways and the MBAs take their background for granted. The MBAs tend to assume that the technology is the arcane part and that the budgeting, modeling, case studies, performance reviews and 5 year plans are the easy part.

If the first factor is the MBA culture which the technologist does not share then the second factor is the technologist culture that the MBAs do not share. Technologist are not selected for tact or political chops or a persuasive manner. We are selected for our ability to comprehend and apply technology. We are lucky that our field has the "it works / it does not work" binary, which tends to map on to the "you are right / you are wrong" binary which tends to make us quite comfortable telling people that they are wrong, or worse yet, that we told you so. We are unimpressed by your spreadsheet model because reality will soon determine what is actually happening or what actually happened. We are bad that persuading people because we feel that having stated facts, our job is done. If you don't get it, that is your problem. Which works just fine in small technology teams but does not scale up all that well and fails spectacularly in the C Suite. Can technologists be bicultural? Of course we can. Are most of us guided in this direction as our careers progress? Sadly, we are not.

These dynamics are often unacknowledged and unaddressed because, as all managers know and new managers are always learning, leading is pretty easy and rather fun while things are going well. In fact, if things are going badly but sufficiently well--think making enough money even though you are grossly underperforming--it is still pretty easy and rather fun.

It is when things start to go badly that we find out who the good leaders are, who has political capital that can be used to buy the time and space needed to fix things, who has good relations with their peers and their subordinates.

It is hard for the C Suite to assess the MBA-less candidate. It is tempting for the C Suite to hire as their tech leader either a fellow MBA or a star technologist, because these are attributes that can be readily assessed by the C Suite. Then you just hope that your fellow MBA has the chops to get the technologists to pull together in a crisis or that your star technologist can learn MBA culture before the crisis hits.

At Pythia Cyber, we are very sympathetic to the devil you know: it is often faster and cheaper to help a senior tech fill in their gaps with support and training. Sometimes it is impossible and you need to embark on a search for a replacement, with all the expense and disruption that search will entail.

But in either case, it helps to know what you are looking for. It helps to know what you are getting and what you are not getting. Senior management needs training and support too. Senior technology management perhaps more than others. However you get there, your senior technologist needs to be both management and tech leader. As it touches all aspects of your organization, cybersecurity can be an excellent window into how bicultural your IT leader actually is.