Jim Routh is chief security officer of Aetna, a Fortune 500 company offering health care, dental, pharmacy, group life, disability, and long-term care insurance and employee benefits. With annual revenue exceeding 60 billion dollars and nearly 50 thousand employees, there’s a lot to secure.

In this episode, we explore Jim Routh’s career path, the unique challenges he faces as CSO for such a large public company, how he delegates authority and manages his time, his approach to threat intelligence, and his somewhat contrary approach to communicating risk with the Aetna board. We learn about Aetna’s move away from using Social Security numbers as identifiers, as well as their efforts to phase out traditional password-based user logins, all in the name of improving customer convenience and security. He also explains his adoption of model-driven security and the rise of unconventional controls.