Cyber Security Core Deck

1. Private and Confidential
Cyber Security Discussion
September 2016
Matt Comyns

2. Private and Confidential 2
1. Trends in the Market 4
2. The Chief Information Security Officer Role 8
3. The Talent Implications 12
4. Our Track Record 15
5. About Russell Reynolds Associates 20
6. Our People 24
Table of Contents

3. Private and Confidential 3
Our Cyber Security Practice
Cyber Security at RRA
​​The growing number of cyber attacks against firms across industries
has created a rapidly growing demand for world-class information
security leaders. What once was a relatively hidden, highly technical
function embedded deep within an IT organization now has taken on
greater importance due to the potentially devastating consequences
of security breaches and the many stakeholders involved. Security
executives today must not only be hands-on, technical experts, but
also business savvy executives able to translate cyber risk in real
business terms for C-level executives and the Board.
Our consultants are experts of key security functions with an
extensive relationship network, ranging from government
organizations and the intelligence community to cybersecurity
startups and boutiques. Our practice focuses on the role of the chief
information security officer, as well as complimentary areas such as:
Direct reports to CISO :
 Deputy CISO
 Architecture
 Business Continuity/Disaster
Recovery
 Governance, Risk and Compliance
 Identity and Access
Management/Data Privacy
 Incident Response
 Insider Threat
 Operations
 Threat Intelligence
 3rd Party Risk Management
A Rapidly Growing Practice
Since 2012, Russell Reynolds Associates has completed more than 60 cyber security searches, with
over half of those searches completed within the past year. Positioned within the firm’s
Technology Officers Practice but working across all sectors and functional areas, the Cyber Security
Practice draws upon a global network of consultants bringing together professionals with diverse
backgrounds ranging from broader technology to data and analytics to governance, risk, and
compliance. Driven by extensive demand for top tier security leadership and talent, the practice,
led by Matt Comyns and Tim Cook, continues to expand and deliver results for clients across the
Americas, EMEA and Asia Pacific across multiple industries, including financial services, technology,
Industrial. professional services, consumer, healthcare, as well as nonprofit.
Global Cyber Security Leadership Team
Irene Chan
Singapore
Tim Cook
London
Mercedes LeGrand
Washington DC
Matt Comyns
New York
Lachlan Wark
Sydney
Nicolas Schwartz
Paris
Ahmed Jamil
Chicago
Yuko Yasuda
Tokyo
Jörn Ottendorf
Frankfurt
Hans Reus
Amsterdam
 Board
 Professional Services
 C-Level Executives @
vendor companies
 Product Security/IoT
Mindy Kairey
Chicago
Maneesh Dube
New Delhi
Michael Feldman
San Francisco
Eric Sigurdson
Chicago
Shawn Banerji
New York
Lisa Porlier
Toronto
Art Hopkins
Atlanta
Jennifer Rockwood
Houston

4. Private and Confidential 4
Trends in the Market

5. Private and Confidential 5
Cyber Risk Has Become the #1 Risk for Most Global Companies and Boards
Major Cyber Security Breaches
 Retail
 FS
 Government
 Online &
Content
 Healthcare
 Hardware
 Consumer
 Government
 Telecom
Financial
Crime
Hacktivists Sabotage Espionage
Intellectual
Property
“The numbers have become numbing. Year after year, cyberattacks continue to escalate in
frequency, severity and impact. Prevention and detection methods have proved largely ineffective
against increasingly adept assaults, and many organizations don’t know what to do, or don’t have
the resources to combat highly skilled and aggressive cybercriminals.”
- PricewaterhouseCoopers 2016 Global State of Information Security Survey
2016
2015
2014
 Higher
Education
 Healthcare
 FS
 Government
Extortion/
Ransomware
Life Safety
Attack on Ukraine
power grid

6. Private and Confidential 6
Recent Notable Cyber Attacks
“CARBANAK”
$1Bn from 10
banks in 30
countries
Ryanair loses $5m
in a fraudulent
transaction
France Shopping
Site TFI loses 2M
records
TalkTalk loses 4m
records
USA Europe
Asia
Latin
America
IRS is hacked,
exposing tax
information on
700,000 accounts
OPM is breached,
exposing data on 4.2
million federal
workers
Virtual toy maker
VTech is breached,
putting 5 million
people at risk
Credit card details of
20 million stolen in
Korea Credit Bureau
breach
Mexican bank Banorte
is breached,
compromising roughly
20,000 accounts
AT&T call centers in
Mexico are breached,
exposing 280,000 user
customer accounts
Brazilian Air Force has
its website defaced by
hackers from
Anonymous
Brazilian payments
system, Boletos, poisons
the DNS entry used by
the bank’s website to
redirect them to a
harmful site
Cyber criminals stole
$81 million from
Bangladesh central
bank
$81M cybertheft from
Bangladesh’s central
bank
SAT hacking by
foreign students
2016 DNC email
hacking scandal

7. Private and Confidential 7
The Chief Information Security Officer Role

8. Private and Confidential 8
Understanding What’s Out There
Beyond confronting a surge in criminal hacker activity, CISOs now face a wide array of risks that have
significantly increased the complexity of their role. As companies raise the profile and prominence of
the CISO role, they also must require that the responsibilities of top cyber security executives change
in important ways:
Profile 2:
Professional
Services/Audit
Often holdings degrees in
accounting, executives
typically begin their career
in the Audit or Compliance
function and then transfer
to IT Audit and ultimately
Information Security.
Frequently holding a
technical degree in
engineering or computer
science, these executives
normally begin their career
in corporate IT (e.g.,
networking, application
development) and migrate
to a specialization in
information security.
Less commonly holding a
technical degree, these
executives begin their
career in the military or law
enforcement, gaining best
practices on leadership and
defense and often having
hybrid responsibilities for
physical and cyber security.
More cutting-edge cyber
threat intelligence
specialists who are
extremely technical, often
coming out of
organizations like the
National Security Agency
(NSA) or DOD. They satisfy
the need to create a
“hunters” mentality to stay
one step ahead of the bad
actors.
A new profile we are
starting to see is of a
software developer with a
focus on cyber security,
specializing in IoT (Internet
of Things), brought in at the
beginning of the product
development life cycle.
Profile 1:
General
Technologists
Profile 3:
Military or Law
Enforcement Professionals
Profile 4:
Cyber Security Threat
Intelligence Specialists
Profile 5:
Product Security
Executives

9. Private and Confidential 9
Cyber security organizations can take
many shapes below the CISO. Equally
the reporting line is usually through one
other role to the board
Cyber Security Org Structure in 2016
CEO
Chief
Financial
Officer
General
Counsel
Chief
Information
Officer Chief
Risk
Officer
Chief
Information
Security
Officer
Governance,
Risk, and
Compliance
Identity &
Access
Management/
Data Privacy
Security
Operations
Security
Architecture
Threat
Intelligence/
Incident
Response
Business
Continuity/
Disaster
Recovery
Deputy
CISO
Head of 3rd Party/Vendor Risk
and Compliance
Business Line Information
Security Officer (BISO)
Head of Insider
Threat
Regional Chief Information Security
Officer (Asia, Europe)
Emerging Roles:
Head of Product Security
(IoT)
Board
Cloud
Security

10. Private and Confidential 10
What Kind of CISO Do You Need?
Type of CISO
Degree
of
Security
Knowledge
and
Technical
Insight
Identify critical assets and crown jewels Medium High High High
Protect High High High High
Detect Medium High High High
Respond Medium High High High
Recover Low Medium High High
Automate Low Medium Medium High
Involved in cloud migration Medium Medium High High
Innovate with data & analytics Low Medium High High
Innovate with consumer devices & mobility Medium High High High
Innovate with the Internet of Things (IoT) Low Medium Medium High
Knowledgeable of the regulatory environment High High High High
Responsible for physical and logical risk Low Medium Medium High
Version
1.0
Version
2.0
Version
3.0
Version
4.0
Influential at: IT Level
Operations
Level
Finance and
Risk Level
Board
Level
Competencies
Results orientation High High High High
Team leadership High High High High
Change orientation Medium Medium High High
Influencing and collaboration Medium Medium High High
Strategic capability Low Medium Medium High
Version
1.0
Version
2.0
Version
3.0
Version
4.0
In our Cyber Security assignments, we usually spot out the type of Chief Information Security Officer needed by our clients, and
validate such profile with you before starting the search.

11. Private and Confidential 11
Competencies Low Importance High
Technical
Cyber Security
Strategy/Vision
Business Acumen
Influencer
Risk Management
External Network
Professional Services
Evaluation Methodology - Experiences & Competencies Benchmarking
In our Cyber Security assignments, we set a list of core competencies against which all candidates will be benchmarked during the search.

12. Private and Confidential 12
The Talent Implications

13. Private and Confidential 13
Digital is Creating New Roles and
Fundamentally Changing Existing Ones
Key players in a digital transformation include new catalyst roles that have emerged to accelerate
transformation and existing roles that require increasingly digitally-savvy leaders.
Manage infrastructure to harness
data from across organization
to analyze into actionable
insight
Partner with key business leaders
to use analytics to inform
business optimize operations,
decisions and guide strategies
with business intelligence and
insight
Typically more focused on
internal systems and
operational technology. Key
enabler of digital
transformation by building a
strong technology
infrastructure
Partner with senior
leadership in defining and
executing digital strategy across
all functions and platforms,
accelerating digital
transformation
Chief Marketing Officer
Lead an increasingly analytical
data-based marketing function.
Partner with IT to leverage new
technologies for improved
customer segmentation and
personalization
Responsible for
information/cyber-security
vision and its execution across
organization, including risk
management and compliance
and privacy
Chief Information Officer
Chief Technology Officer
Typically the technology
visionary responsible for
understanding/
developing innovative technology
and its application to the
business
Chief Data Officer Chief Analytics Officer Chief Digital Officer
Chief Information
Security Officer
Business leader of digital
product or channel, often with
separate P&L, with
understanding of differences
between online/offline
businesses and how to
integrate with broader
organization
Digital GM

14. Private and Confidential 14
14
Why attracting Top Cyber Security Talent is Difficult Today ?
Demand far outweighs supply.
First-mover industries now face competition from
industries across the board. HR teams are having to
break with standards to accommodate highly
sought after information security executives. Some
companies are nearly doubling comp or offering
retention bonuses of proven security leaders
The role is changing and requiring
broader business executive skills.
As cyber risk has risen as a top priority, companies
are moving the CISO role up the corporate ladder
closer to C-Level execs and Board. Next generation
CISOs must possess strong business acumen and
executive presence.
The market is moving quickly.
All companies are waking up to this new cyber
reality and seeking leaders at the same time. The
best candidates are receiving multiple offers,
putting pressure on the typical recruiting process.
Product Security
AS the world becomes more digital and connected,
there is a new demand for leaders who not only
understand enterprise security, but also product
security to secure connected devices.
New security challenges abound.
Constantly growing threats require new types of
information security executives to combat and
minimize damage of breaches. New roles are
emerging, and organizations need to be optimized
for speed and agility to minimize damage.
Diversity is a growing challenge.
According to a major survey by ISC2, the largest
organization that certifies cyber professionals,
women account for just one out of ten cyber
security professionals, a gender gap that has
widened in recent years.
External Network/Information sharing
is critical.
You can never have enough friends. Companies
need trusted partners to tackle evolving
information security challenges. Information
sharing has become a key component of successful
strategies.
Communicating with the board.
Interfacing with the board regularly to ensure that
they understand the true nature of threats and
what investments must be made is critical to
running an effective security organization.

15. Private and Confidential 15
Our Track Record

16. Private and Confidential 16
Sample Assignments: Ongoing Searches
Cyber Security Senior
Manager
Partner – Europe
IBM Security Partner
Non-Executive
Director Specialized
in Cyber Security
Privacy and Data
Security Counsel
Cyber Security
Partner – Japan
Cyber Security
Partner – Germany
Cyber Security
Partner - Canada
Head of IS Policy &
Governance
Chief Information
Security Officer
VP, Corporate
Product and Cyber
Security
Chief Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Deputy Chief Information
Security Officer
SVP, IT Information
Security
Managing Director
Asia
Chief Information
Security Officer
Chief Information
Security Officer
WorldWide Director,
Cyber Security

17. Private and Confidential 17
Sample Assignments: Marquee Searches Across Industries
Consumer
Chief
Information
Security
Officer
Chief
Information
Security Officer
CISO, KFC
Healthcare
Chief
Information
Security
Officer
Chief
Information
Security Officer
Chief
Information
Security Officer
Chief Information
Security Officer
Financial
Services
Chief
Information
Security Officer
Non-Executive
Director
Specialized in
Cyber Security
Chief
Information
Security
Officer, North
America
Chief Security
Officer
Vice
President,
Information
Security
Global Chief
Information
Security Officer
Chief
Information
Security Officer
Chief Risk Officer
Assignments in Red = Diversity Hire
Global Chief
Information
Security Officer
Head of Business
Resiliency

18. Private and Confidential 18
Sample Assignments: Marquee Searches Across Industries
Technology
Industrial
Chief Information
Security Officer
Chief
Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Global Partner, Cyber
Security Assessment &
Responses
GM, Security
Business
Chief Information
Security Officer
Head of Global
Cyber Security
Practice
Chief Information
Security Officer
Global Leader of
Cyber Security
Chief Information
Security Officer
Chief Information
Security Officer
Corporate
Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Chief Executive
Officer
Chief
Information
Security Officer
VP and Chief
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Chief Information
Security Officer
Assignments in Red = Diversity Hire
Vice President,
Risk
Management
& Fraud
Prevention
Chief Information
Security Officer
Head of Security

19. Private and Confidential 19
Sample Search Process
Kick-off
 Conduct org.
analysis
 Draft position
specification
 Tailor search
plan / timeline
 Create list of
target
organizations
1 2 3 4 5 6 7 8
Enter the target
market
 Revise position
specification
 Identify target
organizations
 Build list of
prospective
candidates
Screen perspective
candidates
 Conduct RRA
interviews/
assess
competencies
 Interview internal
candidates
 Weekly status calls
RRA presents
candidates
 Candidate reports
 First round
interviews
with client
Client/candidate
interviews
 Additional first
round of client
interviews, if
needed
 Finalist undergo
RRA
psychometrics
& interviews
 Create short list
Final candidate
selection
 Prioritized 360o
reference call list
and background
checks
 Compensation
overview
 Identify the
successful
candidate
Make offer
and begin
on-boarding
 Signed offer
letter
 Announcement
of successful
candidate
Client and
candidate
feedback
 Client feedback
results
 Follow-up actions
 Thorough post-
completion review
 Successful
candidate review
0-3 weeks* 2-8 weeks* 4-12 weeks*
(+ 6 month review)
Open Search Narrow the Focus Complete Search
*All time periods are estimates only and actual times may vary.
With a proven and proprietary approach to finding exceptional leaders, we adapt to your unique
needs

20. Private and Confidential 20
About Russell Reynolds Associates

21. Private and Confidential 21
46
Offices
in the Americas, EMEA and
Asia Pacific
350+
Experienced Consultants
supported by global research,
knowledge and marketing teams
45+
Years
of firm experience
3,500+
Engagements
Annually
allow us to see critical
patterns in the market
Who We Are – At a Glance

22. Private and Confidential 22
How Do We Help You?
We help
you stay
competitive
Working as one to
find the best solution
As collaborators we work closely
with each other and have done so for
decades. We not only enjoy working
with one another, we believe that the
diversity of thinking it brings is crucial
to finding the best solution for you
Connecting you to
the best people
As relationship-builders we
build long-term, meaningful
relationships with exceptional
people around the globe. We
are, therefore, able to identify
and connect you with expected
and unexpected candidates
that are right for your culture
Helping you see
around corners
As insight-seekers we identify
global trends and their
impact on talent and
leadership issues. We share
the most relevant ones with
you, along with an actionable
plan, so you are prepared for
what’s next

23. Private and Confidential 23
We Have the Expertise
 Board Advisory Services
 CEO Succession Planning
 Cultural Assessment
 Digital Transformation
 Diversity
 Executive Search
 Family Business
 Leadership Assessment
 Board of Directors
 Chief Executive Officers
 Corporate Affairs
 Digital Leadership
 Financial Officers
 General Counsel and
Legal Officers
 Human Resources Officers
 Marketing Officers
 Risk, Information Security
and Compliance Officers
 Sales Officers
 Supply Chain Officers
 Sustainability Officers
 Technology Officers
 Business and
Professional
Services
 Consumer
 Education
 Financial
Services
 Energy and
Natural
Resources
 Healthcare
 Industrial
 Nonprofit
 Private Equity
 Technology

24. Private and Confidential 24
Our People

25. Private and Confidential 25
Search Leadership
Matt Comyns is the global co-head of the Cyber Security and Information Officers Practice within the firm's Technology sector. Matt
recruits Chief Information Security Officers and next level down top lieutenants in information security for large global corporations
and fast-growing private companies. He also recruits cyber security consultants for leading professional services firm's and top
executives for cyber security technology companies. Matt also has a successful track record of recruiting digital leaders for technology
companies and non-tech companies seeking transformative digital talent. He is based in Stamford.
Expertise
Technology, Information Security, Business and Professional Services, Digital Leadership, Technology Officers, Executive Search, Digital
Transformation, Board.
Recent Client Experience
Matt has recruited more than 50 Chief Information Security Officers, top Partners at the Professional Services level, and C-level
executives in the Cyber Security Services. He is also actively working on several Chief Information Security Officer searches for Fortune
50 companies.
Previous Experience
Before joining Russell Reynolds Associates, Matt completed the sale of Pacific Epoch, a venture backed consulting and research firm
that specializes in market intelligence consulting and research projects for U.S.-based companies that are trying to invest in and expand
into China. There, he served as CEO and was responsible for the firm’s strategy and operations. He also directed many large research
and consulting projects. Earlier, he was a founding partner at BlackInc Ventures, a strategic advisory firm focused on providing clients
within the digital sector with market-leading solutions on an outsourced basis for business development, sales, and corporate
development. Before that, Matt was with the pioneering Internet content company CNET Networks Inc. (acquired by CBS) for nearly
seven years. There, he managed strategic partnerships and held various positions including Senior Vice President of Business
Development. At the start of his career, he was a Sales Manager for Dow Jones Interactive in Asia.
Additional Professional Activities
Matt was recently appointed Director of Columbia University’s Cyber Security Program where he will be a faculty member and mentor
to the new Cyber Security focus at Columbia University’s Executive Master of Science in Technology Management program. Matt also
was recently recognized by HuntScanlon as one of the industry’s leading cyber security recruiters. Matt served as a founding board
member of The Online Publishers’ Association, and he is a member of the board of directors for MusicianCorps, a national nonprofit
movement that supports music as a strategy for public good.
Education
Matt received his B.A. from Bucknell University. He is conversational in Mandarin.
Matt Comyns

26. Private and Confidential 26
Search Leadership
Tim Cook, global co-head of the Cyber Security and Information Officers Practice, also runs the HR Practice in London. He
focuses on high impact Chief Human Resource Officers as well as Chief Information and Information Security Officers. His U.K.
and international search experience includes a variety of appointments across sectors and geographies including the Middle
East, and he has conducted a large number of leadership assessments across sectors. He has 14 years of executive search
experience, and joined Russell Reynolds Associates in 2008.
Expertise
Insurance, Technology, Data and Analytics, Digital Leadership, Human Resources Officers, Technology Officers, Digital
Transformation.
Recent Client Experience
Tim's recent assignments include placing the Cyber Director at a critical infrastructure utility, Chief Information Security Officer
at a global Oil company, Chief Information Officer at a global retailer, Chief Information Officer of a global professional services
firm, HR Director at a global retailer, HR Director at two FTSE 100 companies and a FTSE250 company. Previous placements have
included Chief Information Officers in insurance and utilities companies and public sector service including NHS, HMRC and
MOD. He has placed Chief Technical Officers at major international media organizations and online businesses.
Previous Experience
Tim was previously the CEO of Cherwell Scientific Ltd, a company specializing in online genetic risk assessment and the
development and distribution of scientific software. Prior to that, he held both sales and strategy roles with International
Computers Limited (now Fujitsu Services). Earlier, Tim served with the U.K. Armed Forces for several years and the reserve
special forces.
Additional Professional Activities
In 2011 Tim successfully led the world's first rowing expedition along 1,000km of the Upper Zambezi, from the Angolan border
with Zambia to the Victoria Falls raising $40,000 to put fresh water into remote villages in Southern Africa. In 2014 Tim is leading
a joint UK/Zambian 500km expedition across Lake Kariba and the Lower Zambezi in Southern Africa, called the Moon Row. Tim is
a Governor at St John's Beaumont School and a Trustee of the Make A Wish Foundation.
Education
Tim has a B.A. in English literature from Newcastle University, a postgraduate diploma from The London School of Economics
and Political Science, an M.B.A. from London Business School and an M.Sc. in health informatics from University College London.
He is a graduate of the Royal Military Academy Sandhurst.
Tim Cook