How I Became a CISO: Jonathan Trull, Qualys

Technology was more of a hobby than a career choice for Jonathan Trull, but protecting people was always job number one.

Jonathan Trull, chief information security officer for Qualys, says he was always in the protection industry. Like many CISOs, Trull did not set out for a career in infosec, but rather stumbled into it in a happy accident. While some CISOs began their journeys as far afield as
physics
,
law
,
auto repair
, and
liberal arts
, Trull from the beginning was doing security -- just a rather different sort.
Trull got his Bachelors degree in criminal justice (and later a Masters in public administration) and proceeded to become a correctional officer. He was an intelligence officer in the US Navy Reserves for eight years.
In his off-time, he was tinkering -- fiddling with client computers and servers, developing websites for friends and family, nerding out about Linux in open-source community groups. Yet he had always seen it as more of a hobby than a career.
Computer-based threats were becoming a bigger and bigger issue for the military, though, and Trulls role as lieutenant commander adapted accordingly.
In 2011, he took a position in the State of Colorados Office of the State Auditor. Being an auditor satisfied Trulls interests in public service and IT risk. But there was something missing.
I wanted to not just
tell
people to institute security practices, he says. I wanted to do it myself.
So, when Colorados CISO job became available, Trull applied and landed the job, managing information security for a cloud-first state government with 2,500 servers, 26,000 employees, and nearly as many missions. A daunting challenge, especially if you consider the CISO role to be about more than flashing lights and whirring machines.
Being a CISO in any company is much more than technology, says Trull. You should have a very good breadth of the business youre in, because security touches everything.
Fortunately, Trull enjoys those softer aspects of security leadership -- like building relationships with other departments and educating users on subjects like cloud computing risks and rewards.
While at Colorado, however, he decided he wanted to be CISO for an innovative company, and says he found just that when he joined Qualys in May.
As CISO of a security company, he must exercise and maintain his techie know-how much more than he did in Colorado. His team gets to play a role in product development, and at Qualys he doesnt have to sell the concept of secure development, as his colleagues at other tech companies might.
Our software developers [at Qualys] are well educated in secure coding, but thats not always the case.
Along the way, Trull has earned certifications for auditing (CISA), fraud examination (CFE), and offensive security (OCSP). My philosophy is. Im responsible for my education, whether an employer will pay for it or not.
Nevertheless, he doesnt think that those abbreviations tacked on the end of his name helped him get his CISO positions. Making connections with people, he says, is more important.
Im a huge proponent of social networking, says Trull. He has met people helpful to his career at conferences and through group conversations on LinkedIn. Theres value in those conversations, he says, even if theyre casual, and particularly if you volunteer yourself to collaborate with others: Put yourself out there.
More critical even than meeting new peers, says Trull, is to find a mentor -- a CISO with the time and generosity to help you develop your skills, plot your path, and meet the right people.
If he wasnt a CISO, Trull suspects that he would work for a non-profit organization, perhaps as an international health aid worker.

Last News
▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security	▸ Fully committed to the future world of technology. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
How I Became a CISO: Jonathan Trull, Qualys