Climbing the Stack

Fixify
  • 5.0 (1)
  • Technology
  • Updated Biweekly

How do you go from Director to CIO? Host Matt Peters, CEO of Fixify, sits down with IT executives who've made the climb to unpack the pivotal decisions, career-defining moments, and hard-won lessons that got them there. If you're a VP or Director of IT looking for practical advice to reach the C-suite, this is the podcast that finally focuses on your journey—not just the latest tech trends. Real stories. Real strategies. Real career growth.

  1. 3h ago

    How radical transparency built a team that followed me for three companies | Robert Former

    Robert Former spent years losing the risk argument, until he found a way to say it in the language executives speak, dollars. As Chief Information Security Officer at Acquia, he uses the FAIR methodology to turn security risk into one number the business can weigh against its appetite. He talks with Matt Peters about the two paths into the CISO seat, why compliance is an outcome of security and not its driver, and how radical transparency built a team that followed him through three companies. Accepting risk, he argues, is the business's decision, never his. Topics discussed: - Turning security risk into a dollar figure with FAIR - Why compliance is an outcome of security, not a driver - Two paths to the CISO chair, technical and business - Leading every function only after doing it yourself - Building trust through radical transparency and demonstrable honesty - Making risk acceptance the business's decision, not security's - Navigating the shared security responsibility model in PaaS - From security orthodoxy to weighing the upside of risk Listen to more episodes: Apple  Spotify YouTube

    How radical transparency built a team that followed me for three companies | Robert Former

  2. Sep 29

    Don't break into jail: How to present technology to the board | Brad Lontz

    You can spot a CIO who has made the climb by sitting in on their leadership team, where you cannot tell who runs technology. Brad Lontz, EVP and Chief Information Officer at CSAA Insurance Group, got there by leading with the business first. He walks Matt through the counterintuitive move that broadened his career, taking a smaller team to land his first CIO seat, how he learns a new business by starting with the value chain instead of the CFO, and why he keeps no separate AI strategy. Topics discussed: - Taking a smaller team to reach your first CIO seat - Trading quick technical wins for longer-term leadership problems - Connecting every technical role back to business impact - Learning the business by starting with the value chain - Building relationship capital before you need to spend it - Telling the right story for the board versus the team - Why AI belongs inside your business strategy - Becoming the leader nobody identifies as the technology person Listen to more episodes: Apple  Spotify YouTube

    Don't break into jail: How to present technology to the board | Brad Lontz

  3. Sep 15

    Trust your gut: The leadership advice I'd give my younger self | Darragh Curran

    Darragh Curran spent 14 years helping Fin, formerly Intercom, grow from six people to around 1,400. His sharpest lesson for engineers now is that writing code has become the trivial part, while deciding what to build is where the value sits.   He talks with Matt about distilling engineering values after early hires stopped working out, why he hires for durable traits, and how he pushed his team to treat AI as an advantage rather than a threat. He also makes the case that craft now shows up everywhere.   Topics discussed: - Trusting your gut and acting on conviction - Hiring for traits over skills or experience - Distilling implicit team values into explicit principles - Why writing code became the trivial part - Reframing AI from threat into an advantage - Owning problems end to end as a product engineer - Where craft lives in AI-assisted engineering   Listen to more episodes: Apple  Spotify YouTube

    Trust your gut: The leadership advice I'd give my younger self | Darragh Curran

  4. Sep 1

    Every AI agent is an identity: a CISO's security sequence | Kaarthick Subramanian

    Kaarthick Subramanian says AI initiatives rarely fail on model quality. They fail on foundations, governance, and adoption. Now Chief Customer Officer and CISO at Atlas Systems, he treats every AI agent as an identity that needs access, monitoring, and a SOC. He walks Matt through turning technology risk into business risk, why a partner wants the customer to win, and how shedding fear of a job title frees you to build a craft. Across his career, the real work was always the business problem behind the technology. Topics discussed: - Why AI initiatives fail on governance and adoption - Turning technology risk into business risk for the board - Treating every AI agent as an identity - Sequencing identity, visibility, and monitoring in AI security - What separates a true partner from a vendor - Building AI guardrails at the architecture level - Losing the fear that keeps careers stuck - Loving your craft instead of your company Listen to more episodes:  Apple  Spotify  YouTube

    Every AI agent is an identity: a CISO's security sequence | Kaarthick Subramanian

  5. Aug 18

    Why machines should stay in service of humans as AI goes always-on | Tope Iluyomade

    Tope Iluyomade thinks the job of a CIO and CISO is to teach companies how to do dangerous things carefully. He came up through defense and aviation, where errors get measured in body count, then fintech, where velocity is prime but velocity is blind. That range is why he does not ask whether the glass is half full or half empty. He asks whether the glass has a handle, since policies exist to throttle how fast new technology enters a business so leaders can keep a grip on it. As former CIO and CISO, now Advisor at BetterUp, he argues that the climb into the C-suite is less about having answers and more about building the operating system that helps a company keep making good decisions. He is candid that a director gets paid to provide answers with certainty, while a C-suite leader has to act at 51 percent certainty and earn trust by opening his own work to scrutiny, a habit he traces to brutal academic peer review. He explains how he learned finance by sitting in as a fly on the wall in CFO meetings until he understood that the job is to make an investment case rather than explain the technology. Tope connects his supply chain optimization work for Unilever, Pfizer, and Merck to why he joined BetterUp, since every efficiency gain eventually displaces workers and someone has to build the reskilling loop. He closes on where AI is heading, arguing that machines should stay in service of humans, that guardrails belong at inception rather than bolted on later, and that the harder question is always whether you should build something, beyond whether you can.   Topics discussed: - Teaching companies how to do dangerous things carefully - Asking whether the glass has a handle - Leading at 51 percent certainty in the C-suite - Learning finance as a fly on the wall with CFOs - Building a reskilling loop for workers displaced by efficiency - Designing AI guardrails at inception, not bolted on later - Weighing whether you should build it, beyond whether you can - Prom and recess: giving problems to the right level

    Why machines should stay in service of humans as AI goes always-on | Tope Iluyomade

  6. Aug 6

    From engineer to C-suite: why financial fluency and storytelling separate real executives | Matthew Sharp

    Matthew Sharp came up as a computer and electrical engineer, moved through independent testing and audit work, and then took a sales role he was convinced would be the devil's work. Four years selling specialized security services taught him the opposite. He often walked into meetings knowing more about a client's business than the CISO across the table did, down to how they segmented revenue on their financial statements. Now CISO at Xactly and co-author of The CISO Evolution, his argument in this episode is that technical leaders stall on the climb to the C-suite because they cannot connect security to the business, and the fix is more concrete than the conference-stage line about speaking the language of business. That fix starts with learning to read the three financial statements, and he points to John Tracy's How to Read a Financial Statement for the single graphic that ties them together. He gets into moral authority versus formal authority from Covey, why he steers clear of the RFP as both buyer and seller, and the body, mind, heart, and spirit sabbatical (Everest base camp, the Camino de Santiago, Mandarin study, a month teaching English in Vietnam) that gave him cross-cultural empathy for why someone in a hard economy might turn to ransomware. At Xactly he walks through the India-based Center of Excellence, a Snowflake security data lake, a 24x7 AI SOC, and machine learning that forecasts the sales pipeline so his team clears cyber diligence on the deals most likely to close. He closes on where this goes next, with third-party diligence negotiated between MCP servers and a human in the loop, instead of an army of people slinging spreadsheets.   Topics discussed: - Reading the three financial statements to speak to executives - Moral authority versus formal authority in security leadership - Steering clear of the RFP as buyer and seller - Body, mind, heart, spirit sabbatical and cross-cultural empathy - India Center of Excellence built on a Snowflake data lake - Machine learning forecasting the sales pipeline to prioritize cyber diligence - Jobs-to-be-done hiring that scales with AI agents - Third-party diligence negotiated between MCP servers

    From engineer to C-suite: why financial fluency and storytelling separate real executives | Matthew Sharp

  7. Jul 21

    A CEO sorted every employee into three AI buckets. Where would your team land? | Fred Bret-Mounet

    Fred Bret-Mounet, VP of Security, Compliance and IT / CISO at Accela, started his security career in 2001 at @stake, one of the handful of firms that invented security consulting. He was excellent at building Fort Knox. When he moved to the receiving end of those consulting reports, he realized recommending Fort Knox at all cost was the worst advice he could give. The framework he uses instead is the California speed limit. The sign says 65 or 75, but drive 85 without brandishing a gun or threatening anyone and there are no consequences. Those extra miles per hour are called velocity, and the CISO's job is to mark the line, explain what can be crossed, and let the business make an educated risk decision.   Fred tells Matt why AI has collapsed reinvention cycles from every five to ten years to six months, and how a CEO asked him to sort employees into three buckets: forward thinkers, trainable, and the resistance brigade. He grades his students on the same principle, failing anyone who submits AI as the end product and warning that skipping it as an input earns an F too. He predicts that organizations that do not automatically patch everything internet accessible will be dealing with breaches quarterly, if not monthly, by year end, since attackers will reverse engineer a patch in minutes. He also explains why your first line of response to security events must be entirely automated, and why he blows up relationships with his own team on a weekly basis, trading two-week fix demands for two months, to land the ideal business outcome.   Topics discussed: - Reinvention cycles collapsing from a decade to six months - Sorting employees into three AI adoption buckets - The Tesla full self-driving analogy for calibrating AI trust - Auto-patching everything internet accessible before attackers reverse engineer fixes - Fully automated first response to security events - Detecting phishing through intent rather than message syntax - The speed limit framework for advising on business risk - Publicly disavowing your team to reach the right business outcome

    A CEO sorted every employee into three AI buckets. Where would your team land? | Fred Bret-Mounet

  8. Jul 7

    CIO vs. CISO: Resolving the ROI-versus-risk conflict when you hold both | Georgeo Pulikkathara

    When Georgeo X. Pulikkathara joined iMerit Technology as CISO, the role came with infrastructure responsibility attached. His solution was to take the CIO title too and fund security controls directly from that budget. It's a structure he'd spent years viewing as a conflict of interest (CIO manages toward ROI, CISO manages toward risk), and this episode is his case for when it works. He also lays out how he presents security budget to boards: tied to specific revenue deals, never to abstract risk ratings, with three solution options already on the table (the premium version, the cheap version, and the one most organizations actually choose) so he never has to go back for emergency money mid-year. He shares PFC Romeo, the military decision framework now embedded in his IT org: Problem statement, Facts (objective only, no opinions), Considerations (political, emotional, who's going to take it the wrong way), Recommendations (always two viable options, not one good and one bad). He walks through his tiered security architecture, anchored at Tier 0 with identity and MFA through production cloud environments and CI/CD pipelines, and explains why he operates from the assumption that attackers have already bypassed endpoint protection tools like Defender ATP and are targeting identity and production infrastructure instead. That assumption comes from experience: when an AI company became a client, his team detected 13 North Korean threat actors in a single week, running IP proxies and AI-generated faces to get past HR screening that most organizations aren't built to catch. He closes with the 2016 interview at Santander Consumer Bank where the CSO laughed so hard at his five-year CISO prediction that he refused to hire him, and what Georgeo built in that window to prove it right on schedule. Topics discussed: Using CIO budget to fund security controls directly Building financial fluency through a 4-5 month SMU program pre-C-suite Real-time back channel coaching IT leads during live client calls Tiered security model anchored at Tier 0 identity with endpoint bypass assumption Tying board security asks to specific revenue deals with three solution options PFC Romeo framework for structured team escalations and decisions Physical printed incident response plans for ransomware network lockout Detecting North Korean threat actors through IP proxy and AI identity controls

    CIO vs. CISO: Resolving the ROI-versus-risk conflict when you hold both | Georgeo Pulikkathara
See All (20)

About

How do you go from Director to CIO? Host Matt Peters, CEO of Fixify, sits down with IT executives who've made the climb to unpack the pivotal decisions, career-defining moments, and hard-won lessons that got them there. If you're a VP or Director of IT looking for practical advice to reach the C-suite, this is the podcast that finally focuses on your journey—not just the latest tech trends. Real stories. Real strategies. Real career growth.

Information

  • Creator
    Fixify
  • Years Active
    2025 - 2026
  • Episodes
    20
  • Rating
    Clean
  • Copyright
    © Fixify
  • Show Website
    Climbing the Stack