Climbing the Stack

Aaron Pacheco started as a customer support intern and climbed, over a decade, to run an entire product line, then left to found OtterMon, where he is CEO and Founder. What carried him up was not the title. It was empathy, data, and the relationships he built at every level.

He talks with Matt Peters about why you cannot lead on authority alone, the listening tour that saved his career after a project failed spectacularly, what changes at every rung of the ladder, and the 15-year dream to stop preventable outages that became OtterMon.

Topics discussed:

- Starting in customer support and climbing to product lead

- Making the problem the enemy, not the customer

- Why data in a silo is useless without a coalition

- Leading multiple teams and finding trusted lieutenants

- Leading without relationships at a new company

- The listening tour that can make or break a new role

- Taking the leap from a corporate safety net to founding

- A 15-year dream to end preventable outages

Listen to more episodes:

Apple 

Spotify

YouTube 

Don Silva Sr. started on third shift pulling cables at Sun Microsystems and climbed to Chief Information Security Officer at Raintree Systems. What moved him up was realizing security leadership is a business role, where a board cares only about the risk, its revenue impact, and whether appetite outweighs the cost to fix it.

He talks with Matt Peters about turning technical risk into dollars the board can act on, retiring the Department of No, hiring for attitude over raw skill, and reading a company’s risk appetite from how it answers a few questions.

Topics discussed:

- From third-shift cable puller to Chief Information Security Officer

- Why security leadership is a business role, not technical

- Translating technical risk into dollars the board understands

- Using compensating controls while the full fix ships

- Replacing the Department of No with partnership

- Hiring for attitude and fit over raw skill

- What an acquisition looks like from the CISO seat

- Reading a company’s risk appetite before you acquire

Listen to more episodes:

Apple: https://podcasts.apple.com/us/podcast/climbing-the-stack/id1850604017

Spotify: https://open.spotify.com/show/5fJOhXU3qrODBA2BJcHQC9

YouTube: https://www.youtube.com/@FixifyHelpDesk

Listen to more episodes:

Apple 

Spotify

YouTube 

Robert Former spent years losing the risk argument, until he found a way to say it in the language executives speak, dollars. As Chief Information Security Officer at Acquia, he uses the FAIR methodology to turn security risk into one number the business can weigh against its appetite.

He talks with Matt Peters about the two paths into the CISO seat, why compliance is an outcome of security and not its driver, and how radical transparency built a team that followed him through three companies. Accepting risk, he argues, is the business's decision, never his.

Topics discussed:

- Turning security risk into a dollar figure with FAIR

- Why compliance is an outcome of security, not a driver

- Two paths to the CISO chair, technical and business

- Leading every function only after doing it yourself

- Building trust through radical transparency and demonstrable honesty

- Making risk acceptance the business's decision, not security's

- Navigating the shared security responsibility model in PaaS

- From security orthodoxy to weighing the upside of risk

Listen to more episodes:

Apple 

Spotify

YouTube 

You can spot a CIO who has made the climb by sitting in on their leadership team, where you cannot tell who runs technology. Brad Lontz, EVP and Chief Information Officer at CSAA Insurance Group, got there by leading with the business first.

He walks Matt through the counterintuitive move that broadened his career, taking a smaller team to land his first CIO seat, how he learns a new business by starting with the value chain instead of the CFO, and why he keeps no separate AI strategy.

Topics discussed:

- Taking a smaller team to reach your first CIO seat

- Trading quick technical wins for longer-term leadership problems

- Connecting every technical role back to business impact

- Learning the business by starting with the value chain

- Building relationship capital before you need to spend it

- Telling the right story for the board versus the team

- Why AI belongs inside your business strategy

- Becoming the leader nobody identifies as the technology person

Listen to more episodes:

Apple 

Spotify

YouTube 

Darragh Curran spent 14 years helping Fin, formerly Intercom, grow from six people to around 1,400. His sharpest lesson for engineers now is that writing code has become the trivial part, while deciding what to build is where the value sits.

He talks with Matt about distilling engineering values after early hires stopped working out, why he hires for durable traits, and how he pushed his team to treat AI as an advantage rather than a threat. He also makes the case that craft now shows up everywhere.

Topics discussed:

- Trusting your gut and acting on conviction

- Hiring for traits over skills or experience

- Distilling implicit team values into explicit principles

- Why writing code became the trivial part

- Reframing AI from threat into an advantage

- Owning problems end to end as a product engineer

- Where craft lives in AI-assisted engineering

Listen to more episodes:

Apple 

Spotify

YouTube

Kaarthick Subramanian says AI initiatives rarely fail on model quality. They fail on foundations, governance, and adoption. Now Chief Customer Officer and CISO at Atlas Systems, he treats every AI agent as an identity that needs access, monitoring, and a SOC.

He walks Matt through turning technology risk into business risk, why a partner wants the customer to win, and how shedding fear of a job title frees you to build a craft. Across his career, the real work was always the business problem behind the technology.

Topics discussed:

- Why AI initiatives fail on governance and adoption

- Turning technology risk into business risk for the board

- Treating every AI agent as an identity

- Sequencing identity, visibility, and monitoring in AI security

- What separates a true partner from a vendor

- Building AI guardrails at the architecture level

- Losing the fear that keeps careers stuck

- Loving your craft instead of your company

Listen to more episodes: 

Apple 

Spotify 

YouTube

Tope Iluyomade thinks the job of a CIO and CISO is to teach companies how to do dangerous things carefully. He came up through defense and aviation, where errors get measured in body count, then fintech, where velocity is prime but velocity is blind. That range is why he does not ask whether the glass is half full or half empty. He asks whether the glass has a handle, since policies exist to throttle how fast new technology enters a business so leaders can keep a grip on it. As former CIO and CISO, now Advisor at BetterUp, he argues that the climb into the C-suite is less about having answers and more about building the operating system that helps a company keep making good decisions.

He is candid that a director gets paid to provide answers with certainty, while a C-suite leader has to act at 51 percent certainty and earn trust by opening his own work to scrutiny, a habit he traces to brutal academic peer review. He explains how he learned finance by sitting in as a fly on the wall in CFO meetings until he understood that the job is to make an investment case rather than explain the technology. Tope connects his supply chain optimization work for Unilever, Pfizer, and Merck to why he joined BetterUp, since every efficiency gain eventually displaces workers and someone has to build the reskilling loop. He closes on where AI is heading, arguing that machines should stay in service of humans, that guardrails belong at inception rather than bolted on later, and that the harder question is always whether you should build something, beyond whether you can.

Topics discussed:

- Teaching companies how to do dangerous things carefully

- Asking whether the glass has a handle

- Leading at 51 percent certainty in the C-suite

- Learning finance as a fly on the wall with CFOs

- Building a reskilling loop for workers displaced by efficiency

- Designing AI guardrails at inception, not bolted on later

- Weighing whether you should build it, beyond whether you can

- Prom and recess: giving problems to the right level

Matthew Sharp came up as a computer and electrical engineer, moved through independent testing and audit work, and then took a sales role he was convinced would be the devil's work. Four years selling specialized security services taught him the opposite. He often walked into meetings knowing more about a client's business than the CISO across the table did, down to how they segmented revenue on their financial statements. Now CISO at Xactly and co-author of The CISO Evolution, his argument in this episode is that technical leaders stall on the climb to the C-suite because they cannot connect security to the business, and the fix is more concrete than the conference-stage line about speaking the language of business.

That fix starts with learning to read the three financial statements, and he points to John Tracy's How to Read a Financial Statement for the single graphic that ties them together. He gets into moral authority versus formal authority from Covey, why he steers clear of the RFP as both buyer and seller, and the body, mind, heart, and spirit sabbatical (Everest base camp, the Camino de Santiago, Mandarin study, a month teaching English in Vietnam) that gave him cross-cultural empathy for why someone in a hard economy might turn to ransomware. At Xactly he walks through the India-based Center of Excellence, a Snowflake security data lake, a 24x7 AI SOC, and machine learning that forecasts the sales pipeline so his team clears cyber diligence on the deals most likely to close. He closes on where this goes next, with third-party diligence negotiated between MCP servers and a human in the loop, instead of an army of people slinging spreadsheets.

Topics discussed:

- Reading the three financial statements to speak to executives

- Moral authority versus formal authority in security leadership

- Steering clear of the RFP as buyer and seller

- Body, mind, heart, spirit sabbatical and cross-cultural empathy

- India Center of Excellence built on a Snowflake data lake

- Machine learning forecasting the sales pipeline to prioritize cyber diligence

- Jobs-to-be-done hiring that scales with AI agents

- Third-party diligence negotiated between MCP servers

Fred Bret-Mounet, VP of Security, Compliance and IT / CISO at Accela, started his security career in 2001 at @stake, one of the handful of firms that invented security consulting. He was excellent at building Fort Knox. When he moved to the receiving end of those consulting reports, he realized recommending Fort Knox at all cost was the worst advice he could give. The framework he uses instead is the California speed limit. The sign says 65 or 75, but drive 85 without brandishing a gun or threatening anyone and there are no consequences. Those extra miles per hour are called velocity, and the CISO's job is to mark the line, explain what can be crossed, and let the business make an educated risk decision.

Fred tells Matt why AI has collapsed reinvention cycles from every five to ten years to six months, and how a CEO asked him to sort employees into three buckets: forward thinkers, trainable, and the resistance brigade. He grades his students on the same principle, failing anyone who submits AI as the end product and warning that skipping it as an input earns an F too. He predicts that organizations that do not automatically patch everything internet accessible will be dealing with breaches quarterly, if not monthly, by year end, since attackers will reverse engineer a patch in minutes. He also explains why your first line of response to security events must be entirely automated, and why he blows up relationships with his own team on a weekly basis, trading two-week fix demands for two months, to land the ideal business outcome.

Topics discussed:

- Reinvention cycles collapsing from a decade to six months

- Sorting employees into three AI adoption buckets

- The Tesla full self-driving analogy for calibrating AI trust

- Auto-patching everything internet accessible before attackers reverse engineer fixes

- Fully automated first response to security events

- Detecting phishing through intent rather than message syntax

- The speed limit framework for advising on business risk

- Publicly disavowing your team to reach the right business outcome

When Georgeo X. Pulikkathara joined iMerit Technology as CISO, the role came with infrastructure responsibility attached. His solution was to take the CIO title too and fund security controls directly from that budget. It's a structure he'd spent years viewing as a conflict of interest (CIO manages toward ROI, CISO manages toward risk), and this episode is his case for when it works. He also lays out how he presents security budget to boards: tied to specific revenue deals, never to abstract risk ratings, with three solution options already on the table (the premium version, the cheap version, and the one most organizations actually choose) so he never has to go back for emergency money mid-year.

He shares PFC Romeo, the military decision framework now embedded in his IT org: Problem statement, Facts (objective only, no opinions), Considerations (political, emotional, who's going to take it the wrong way), Recommendations (always two viable options, not one good and one bad). He walks through his tiered security architecture, anchored at Tier 0 with identity and MFA through production cloud environments and CI/CD pipelines, and explains why he operates from the assumption that attackers have already bypassed endpoint protection tools like Defender ATP and are targeting identity and production infrastructure instead. That assumption comes from experience: when an AI company became a client, his team detected 13 North Korean threat actors in a single week, running IP proxies and AI-generated faces to get past HR screening that most organizations aren't built to catch. He closes with the 2016 interview at Santander Consumer Bank where the CSO laughed so hard at his five-year CISO prediction that he refused to hire him, and what Georgeo built in that window to prove it right on schedule.

Topics discussed:

• Using CIO budget to fund security controls directly

• Building financial fluency through a 4-5 month SMU program pre-C-suite

• Real-time back channel coaching IT leads during live client calls

• Tiered security model anchored at Tier 0 identity with endpoint bypass assumption

• Tying board security asks to specific revenue deals with three solution options

• PFC Romeo framework for structured team escalations and decisions

• Physical printed incident response plans for ransomware network lockout

• Detecting North Korean threat actors through IP proxy and AI identity controls