---
title: "Jim Routh -- The CISO Transition to the rest of life"
url: https://appsecpodcast.com/jim-routh-the-ciso-transition-to-the-rest-of-life/
date: 2025-03-11
duration_seconds: 2976
season: 12
episode: 7
guests: ["Jim Routh"]
topics: ["AI and LLM Security", "Careers in AppSec"]
audio: https://www.buzzsprout.com/1730684/episodes/16710695-jim-routh-the-ciso-transition-to-the-rest-of-life.mp3
video: https://www.youtube.com/watch?v=7UfsQUv2Zyg
transcript: true
---

# Jim Routh -- The CISO Transition to the rest of life

*March 11, 2025 · 50 min · Season 12, episode 7*

with [Jim Routh](https://appsecpodcast.com/guests/jim-routh/)

on [AI and LLM Security](https://appsecpodcast.com/topics/ai-security/), [Careers in AppSec](https://appsecpodcast.com/topics/careers/)

[Audio](https://www.buzzsprout.com/1730684/episodes/16710695-jim-routh-the-ciso-transition-to-the-rest-of-life.mp3) · [Video](https://www.youtube.com/watch?v=7UfsQUv2Zyg)

## Show notes

Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. Rather than viewing retirement as simply stopping work, Routh describes his three-filter approach: working only with people he respects and admires, doing only work he finds fulfilling, and controlling when he works. He shares valuable lessons learned about which post-retirement opportunities truly bring satisfaction and explains why he avoids certain roles. Routh emphasizes the importance of cybersecurity professionals taking ownership of their career development, recommending they focus on developing two specific skills annually rather than using tenure to guide career moves. Jim Ralph is currently on the boards of Savvy Security, Accountable Digital Identity Association, and the Global Resiliency Federation.

The Application Security Podcast is brought to you by [Security Journey](https://www.securityjourney.com/).

About Security Journey  
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.  
→ [Learn more about Security Journey](https://www.securityjourney.com/)

Connect with Jim Routh:  
→ [CISO Transition (LinkedIn article by Jim Routh)](https://www.linkedin.com/pulse/ciso-transition-jim-routh-uq5ze/)  
→ [Jim Routh on Twitter](https://twitter.com/jmrouth1)

Mentioned in this episode:  
→ [CISO Transition (LinkedIn article by Jim Routh)](https://www.linkedin.com/pulse/ciso-transition-jim-routh-uq5ze/)  
→ [Jim Routh on Twitter](https://twitter.com/jmrouth1)

Chapters:  
00:00 Meet Jim Routh: The CISO Transition to the rest of life  
03:15 Hey, I'm happy to be here, Chris. Appreciate the kind words  
04:50 Yeah, I was recently, I was introduced to pickleball this past  
07:12 Of course, it wasn't offered in school when I went to  
13:20 Jim, what does the word retirement mean to you  
16:02 Why  
16:58 There's a lot of inertia dealing with that resistance, and that's  
19:34 Yeah, that's very helpful just to get this kind of your  
32:16 I think this conversation is something that should be helpful for  
34:40 For instance, I wanted to serve on boards. Why  
38:16 Just listening to you as we've kind of gone through this  
42:05 Yeah, that's helpful. Unfortunately, no one has invented this time machine  
44:53 Like, you, as long as you, you know, performed well, you  
47:24 Opportunity that's helping you, enabling you to learn the skills you

## Transcript

*7,837 words · assemblyai*

**0:00 Chris Romeo:** Jim Ralph is currently on the boards of Savvy Security, Accountable Digital Identity Association, and the Global Resiliency Federation. Jim is the Chief Trust Officer for Saviant. Jim is a former CSO, CISO for American Express, DTCC, KPMG, Aetna, CVS, and MassMutual. Jim is currently an advisor for Wiz, Transmit Security, Netscope, Armis Security Scorecard, DEVO, Gurukul, DataTheorem, Calypso AI, Code Zero, Picnic, and Legit Security. He serves in an advisory capacity and investor for cyber-specific venture funds, including Cyn Ventures, CyberStart, Security Leadership Capital, Ballistic Ventures, and Rain Capital. Jim is an ICIT fellow and an adjunct faculty member where he teaches cybersecurity for the NYU Tandon School of Engineering. Jim also mentors over 80 cybersecurity leaders and potential leaders. Jim wrote an article on LinkedIn. caught my attention, so we invited him on the podcast to unpack the details. We discuss career trajectories, retirement, and how to get fulfillment from life after you wrap up your typical 9 to 5.

**1:09 Robert Hurlbut:** The Application Security Podcast is brought to you by Security Journey. We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC. Learn more at securityjourney.com.

**1:32 Chris Romeo:** Hey folks, welcome to another episode of the Application Security Podcast. My name is Chris Romeo. I'm the CEO of DaVinci and co-host of this much beloved podcast. As always, happy to be joined by my co-host and good friend, Robert Roma.

**1:50 Robert Hurlbut:** Hey, Chris.

**1:50 Chris Romeo:** Yeah, it's Robert and a threat modeling architect, actually principal application security architect as well, and working at Acquia and thinking about application security again today.

**2:01 Robert Hurlbut:** Yep.

**2:02 Chris Romeo:** And you've been off training the next generation of threat modeling people. I did.

**2:06 Robert Hurlbut:** Yes.

**2:07 Chris Romeo:** You've been doing that over the, over today. So that's always a rewarding experience to jump into classrooms and be able to share your many, many, many, many years of wisdom on how to be, how to be effective with threat modeling. So that's one of the most fun things I ever get to do is stand in front of a group of students and just let them kind of pick our brains, so to speak. But we're joined by Jim Ralph, who's been a frequent guest of the podcast and is still the hold, the, the, the record holder for our most downloaded episode. The one that we did, I think it was 2017 or something. We did an episode with Jim, which you'll find in the show notes. You can go back and listen to it where he was breaking down various software security programs that he was a part of over the years. And so it's still one of the most popular ones. So Jim, I always love the opportunity to interview you and just talk to you because I always leave the interview with a lot of things to think about and just really enriched by the process. So glad to have you back again as a guest.

**3:14 Robert Hurlbut:** Hey, I'm happy to be here, Chris. Appreciate the kind words, and I hope I live up to those expectations. I think Robert will take care of me if I don't. He'll put me in the trunk of a car and dump me somewhere, right? Yeah. Well, that's what they do in Jersey. I don't know.

**3:31 Chris Romeo:** I'm sure you'll, I'm sure you'll live up to it. So, um, because you've answered the security origin story question in a previous episode, one of our, our new questions that we'd like to, to start with is, what do you do that takes you away from computers and technology? What do you like to do?

**3:46 Robert Hurlbut:** Yeah, so that's actually an easy question for me because the way I line up my schedule on a daily basis is I allow time in the morning to do 2 things. Number one, I have some, an exercise routine that I do largely 'cause I've had in the past back problems and this solves that. So I do that.

**4:05 Jim Routh:** And the second is play pickleball.

**4:08 Robert Hurlbut:** And it's not that I'm like really good at pickleball, I just love to play it. I could play it every day. And if I'm not, you know, doing cybersecurity stuff, chances are I'm pretty good. I'm playing pickleball either competitively or socially, either way. So I do that quite a bit. I'm fortunate I live in a warm climate both in the winter and the summer because I move. And so lots of pickleball in both locations. So all is good.

**4:35 Chris Romeo:** Very good.

**4:37 Jim Routh:** I'm still struggling with my third shot drop.

**4:41 Robert Hurlbut:** And pickleballers will know exactly what that is, cuz that's kind of a line of demarcation between being social and being halfway good at pickleball.

**4:49 Chris Romeo:** Yeah, I was recently, I was introduced to pickleball this past summer and I had a blast playing it. Did not realize how active pickleball actually is. Like it's, people think about, oh, pickleball is like tennis, but you don't have to run as much. Like, you gotta run just as much. Like, even play, you know, we played doubles and because we had some people that were new to it and, and I was, I had a ball and I was pretty tired at the end of, of the game. I'm like, okay, who's got next? Because I think I'm gonna sit down on the bench over here and take a little break. So pretty active game.

**5:24 Robert Hurlbut:** Yeah.

**5:24 Jim Routh:** You're running a lot less than tennis, but it's more, it's more, I guess, quicker, quicker response.

**5:33 Robert Hurlbut:** You're moving faster and, and so you move, you feel like you're moving a lot more. It's actually not, not as big, not along a distance, but it's, but it is quick.

**5:45 Chris Romeo:** Yeah. And I did, I did get taught a few lessons in that the person I was, that was on the other team was an ex or a previous college tennis player. And so he was, he, he was, he was taking it easy on us to some degree, but He could, he could throw, he could put some shots where we just couldn't get it if he wanted to. And so, but, but he had mercy on us throughout the game and kept it competitive, but it was a, it was a lot of fun.

**6:11 Robert Hurlbut:** Nice.

**6:11 Chris Romeo:** So the reason that I reached out, Jim, was I read this article back in November, it was actually November 27th, 2024, and we'll put a link to this in the show notes on LinkedIn. You wrote this article on CISO transition. And it, it just, it was impactful for me. It was, as somebody who's in this stage of life where I'm like, you know, what do I want to be when I grow up? And, you know, what do I want to do with my life and how am I prioritizing my time? It was really hard-hitting. So I'm really excited to unpack that with you. But I think it'd be good just for you to take us through a quick career trajectory so that folks have some context on where some of what's influenced your ultimate way that you approach life now. I think it's helpful for people that may not know that background story. So if you could just take us through that, it'd be really, really good.

**7:06 Jim Routh:** Yeah, I've been opportunistic in that I never studied cybersecurity.

**7:12 Robert Hurlbut:** Of course, it wasn't offered in school when I went to school as an undergrad. I never studied computer science. I was a history major because I loved history. I still do a lot of history reading today, but I was opportunistic in that my wife insisted that we were to move back to the East Coast after spending 3 winters in Minnesota, and I realized that I didn't have a lot of choice here. And so I called up my boss, I said, you got to get me out of here, you know, what's available? And at the time I was working for American Express, and he was wonderful to me. And he said, "Yeah, we'll take care of you." But the role that we that you could play is not in IT, which is what I was in at the time. I said, "I'll do anything." Sweet, of course. So I came back.

**8:05 Jim Routh:** I ended up leading a 500-person team that were econometricians.

**8:10 Robert Hurlbut:** Now, I didn't really know what an econometrician was, and so, but I it's like I took the job accepted. You know. Bar none, I was like gonna do it 'cause I need the relocation. What I learned is econometricians are really statistics majors that typically get an advanced either graduate degree or a PhD in statistics.

**8:34 Jim Routh:** Now today, what do we call those people?

**8:36 Robert Hurlbut:** We call them data scientists, but back then we called them econometricians.

**8:40 Jim Routh:** And American Express did a lot of modeling of banking. Behavior, primarily buying behavior, to try to see if we could understand certain market segments, what prompted or triggered additional buying behavior. And so you might say, well, what does that have to do with cybersecurity?

**9:00 Robert Hurlbut:** And it's a great question.

**9:03 Jim Routh:** It taught me how to use the fundamentals of data science, and it was in a business context. And so I ended up being— I reported to—

**9:15 Robert Hurlbut:** they merged that group with a risk management group. I reported to the chief risk officer, uh, and for whatever reason found myself as the candidate to, uh, start a cybersecurity program.

**9:27 Jim Routh:** This was, uh, around the, uh, implementation of the Gramm-Leach-Bliley Act, which required financial service firms to have a CISO. So that's really why I got—

**9:36 Robert Hurlbut:** As a matter of fact, I don't think my boss wanted to meet with the OCC, the Office of the Comptroller of the Currency, so he stuck me with this. So that's how I got into security.

**9:46 Jim Routh:** Now, why is that relevant? I fundamentally believe that data science is foundational for cybersecurity, and it's really in 2 kinds of approaches.

**9:59 Robert Hurlbut:** One is just to make data quality a lot better as you prepare key performance indicators that measure the health of your cybersecurity resilience across the enterprise.

**10:08 Jim Routh:** The second is that you can design controls to use behavior deviation to trigger automated workflow and manage cybersecurity a lot more effectively at scale across large enterprises using data science as that foundation.

**10:25 Robert Hurlbut:** Now, the the majority of opportunities to do that in terms of control design are in identity access management, which is a pretty traditional conventional function in a cybersecurity organization or embedded in the IT organization.

**10:42 Jim Routh:** But it turns out you can fundamentally change and evolve the control capability in identity access management that makes it easier for the users and makes it lower cost. an operational perspective, and better security. All 3 at the same time. And you can't do all 3 of those things without using some fundamentals of data science. So it turns out that that opportunistic move for me in embedding myself in data science had tremendous implications in how I approached cybersecurity as a CISO, and it's what got me involved in software security, application security, as Robert said, in that I had a development background. I then had some data science foundation, and I put the two together to, you know, kind of evolve thinking around software security and design some new control capability that wasn't conventional, that's more innovative.

**11:47 Robert Hurlbut:** And I still, you know, today look for innovation in control design as technology changes, as we're moving into generative AI and large language models.

**11:59 Jim Routh:** There's a lot of technology that can drive control capability that we never would've imagined, you know, 10 years ago, but it's available to us today. So information security professionals were trained in a notion of understanding what the control objectives are and applying those control objectives effectively across the enterprise. And I subscribe to a notion that in addition to that, on top of that, we should design controls, new controls, specifically for emerging technologies. Now designing a control is a different skill set than implementing an existing control capability to align with a control objective.

**12:49 Robert Hurlbut:** And so the skill requirement is a little bit different as a result of that.

**12:55 Jim Routh:** And my observation is not every cybersecurity professional is comfortable in the design of skill, but if— design of a control. But if you have that foundation in data science, It actually equips you to do that more effectively.

**13:12 Robert Hurlbut:** So hopefully that answers your question. Yeah.

**13:20 Chris Romeo:** So Jim, what does the word retirement mean to you?

**13:22 Jim Routh:** I'll tell you, Robert, what it doesn't mean.

**13:28 Robert Hurlbut:** It doesn't mean the definition of retirement that was passed down to me from my parents' generation and their parents' generation.

**13:36 Jim Routh:** And that definition of retirement was a binary. You worked and then you stopped work. When you stopped work, you did other things, but it was binary. When you retired, you know, you didn't work anymore.

**13:53 Robert Hurlbut:** So, um, so that's really what, um, what my initial introduction in the whole notion of retirement was about.

**14:01 Jim Routh:** And it was probably maybe 4 or 5 years before I retired that I realized a couple of things.

**14:10 Robert Hurlbut:** I said—

**14:10 Jim Routh:** I realized, number one, that I could probably afford the luxury of doing work without the criteria of I have to earn a living or I have to earn a lot of money to, you know, support my lifestyle. And that's, that's a real A feeling of kind of breaking out and being no longer dependent on, you know, your salary plus your bonus plus your equity gains for compensation. And what that opens the door is for fulfilling work. Now, what's fulfilling work? Well, people get different types of fulfillment based on different types of work. Nobody's the same, but If you can remove the need for driving economic gain for yourself as an individual on behalf of your family, it opens up the opportunities to choose work based on what you like to do and frankly who you work with.

**15:12 Robert Hurlbut:** So, as an example, when you work in a big enterprise, and I'm talking, you know, 100,000 employees plus, You're forced to work with some very talented people, which is rewarding and beneficial and fulfilling.

**15:28 Jim Routh:** You're also forced to work with other people that are talented, but maybe they act like assholes.

**15:34 Robert Hurlbut:** I don't know if I can say that on a podcast, but you know, it's they do.

**15:38 Jim Routh:** You guys, you've all seen it.

**15:40 Robert Hurlbut:** It's you know what you run into sometimes.

**15:42 Jim Routh:** They just don't necessarily. They either have their their own best interests in mind 100% of the time.

**15:48 Robert Hurlbut:** and they're not thinking about anybody else, or they just act maliciously and in an unprofessional way to their— to other employees.

**15:59 Jim Routh:** Well, I can choose not to work with them.

**16:01 Robert Hurlbut:** Why?

**16:01 Jim Routh:** Because I can choose what work I do and when. So choosing work with people I love is my first filter.

**16:10 Robert Hurlbut:** People that I admire, I respect, that I learned something from, you know, present company included.

**16:15 Jim Routh:** that it's a worthwhile engagement. So that's kind of number one. Number 2 is I only do the kind of work I like to do. Now here's another throwback to large enterprise work. In a large enterprise, you spend 30, maybe 40% of your time pushing transactions through a system designed for saying no. And And so you have to be the exception that pushes through, and you have to do a lot of work and effort to do that.

**16:46 Robert Hurlbut:** And you know what?

**16:46 Jim Routh:** That work is tedious and it's not rewarding. It's a means to an end. It's something you have to tackle and do if you want results.

**16:58 Robert Hurlbut:** There's a lot of inertia dealing with that resistance, and that's built into the decision-making process to make it difficult to innovate and difficult to change and difficult to implement. your agenda, right?

**17:10 Jim Routh:** So, so I choose to choose work that doesn't involve any of that, and it's more pure, if that's a, a meaning, uh, for, uh, for your audience. But it's pure in that it gives me fulfillment, uh, because I'm creating and developing something that benefits others, uh, and that's a really powerful motivator and It turns out that when you do work that gives you fulfillment, it's not work anymore. It doesn't feel like work. You love doing it and you want to wake up every day and do it. And you're looking for more opportunities to do that. So choosing the type of work that you get fulfillment from is a really important filter And it's really hard, and I'll be happy to share with you later that there are some things that I learned along the way post-retirement that I really didn't know beforehand and have really helped me define what work I won't do going forward. The third thing is I only want work when I want to work, and so I have a Calendly link that I share with everybody who wants to meet with me. And I meet with anybody. I meet with companies that have new products in cybersecurity.

**18:34 Robert Hurlbut:** I meet with early-stage professionals. I'll meet with anybody. And I never say no to somebody who wants to meet.

**18:43 Jim Routh:** However, behind Calendly is my availability.

**18:47 Robert Hurlbut:** And I control that availability to make sure I have time for pickleball, as an example, and other things. Right.

**18:53 Jim Routh:** And so what I say to anybody and everyone, hey, Schedule time on calendar anytime you like, as much time as you want.

**19:02 Robert Hurlbut:** And so working when you want to work and controlling that is the third filter.

**19:08 Jim Routh:** So those are the three filters that really for me answer the question of well, what does retirement mean? Retirement doesn't mean stopping work. Retirement means I'm going to work only in things that fulfill me, that give me fulfillment. And that's a subset of all the things I could do. And I'm going to tightly control that using this filtering system.

**19:33 Chris Romeo:** Yeah, that's very helpful just to get this kind of your philosophy. I'll call it your philosophy of work now after retiring from a 9 to 5 or you were a CISO. Who am I kidding? 9 to 5. It's a 24/7, 360, 4.5 style environment there. I guess it makes me think though, is this something that's attainable? So when I think about the field of work that we've all landed in, you know, at this stage of our careers, right? We're focused on the, we're in the general cybersecurity world where people tend to be paid fairly well in the grand scheme of jobs that are available for you. I guess, what are your thoughts on the attainability of this type of a philosophy? Like, is this something that anybody could do? Is this something that an early-stage career person can be kind of planning for and dreaming about in the future? Or is this something that was kind of the result of just the career trajectory that you were on or kind of where you landed?

**20:41 Robert Hurlbut:** Yeah, Chris, that's a great question.

**20:44 Jim Routh:** And it's a great question because it makes me think, stop and think whether I could have understood all of this while I was a CISO. And here's why. When you're a CISO and really in a senior role in cybersecurity for any kind of enterprise of scale, What happens is you process information through this lens, and this lens says, does this information have anything to do with protecting the enterprise? And if yes, is it something I need to do something about now, later today, next week? or sometime in the future. And that lens is inherent in any senior cybersecurity executive because you're always making trade-off decisions in the allocation of your time and the time of all the resources with the enterprise. And hopefully you get it right as many as you can, but you don't always get it right. But, but you're going through that thought process. Well, here's what happens. Like, I used to schedule time with my family thinking and believing that I was in the moment, present for them at that time. And in some cases I was, but as soon as I got a stimuli of something, it could have been a notion of a new technology impacting the enterprise.

**22:26 Robert Hurlbut:** I'll give an example.

**22:27 Jim Routh:** Fake technology creating a synthetic voice, uh, a voice object that can be used to do authentication in a call center. Now, every major big call center does some sort of voice authentication, uh, and it's in the background.

**22:45 Robert Hurlbut:** A lot of times the consumer, digital consumer, is not aware of it, but every, uh, every shop has this in some level of sophistication.

**22:54 Jim Routh:** Well, today With the deepfake technology, a large language model and several of them can create, and actually there'd be a multimodal model, create an audio fingerprint, if you will, an audio print of your voice. And then that voice can be used for— so that now changes the control capability and the impact to the enterprise. So if I And literally at a, you know, some sort of social event and somebody said, oh, what do you think about deepfake technology? The first thing I hit is, oh geez, what does this mean?

**23:30 Robert Hurlbut:** Yeah, good point.

**23:31 Jim Routh:** You know, is this something I have to do? I have to process this information in some way today at this moment in time. Can it wait till tomorrow or maybe, you know, next, next week? But that I'm going through that kind of triage process based on any kind of stimuli That hits me, even if I'm not at work, even if I'm not in a work mode, even if I'm in a family mode and trying to get my best to my family and meet their needs, I'm still using that lens to process information. Now, I didn't know the lens was there when you and I first met and started working together, which is a long time ago, but I didn't know the lens was there.

**24:13 Robert Hurlbut:** So to me, that was just, I was saying, I was thinking to myself, oh yeah, I can compartmentalize and make sure I have carved out time for my family and my personal needs and so forth.

**24:24 Jim Routh:** And yeah, I got it, I got it nailed, no problem. Well, not really. In the background, this is, you know, what's doing it. And the more you're a CISO, the more it becomes reinforced because you recognize that, and this is kind of bottom line oriented, you're gonna get fired if there's a cybersecurity breach of significance on your watch.

**24:43 Chris Romeo:** Yeah.

**24:44 Jim Routh:** And nobody explicitly says that, but history is riddled with evidence to support that. And so, that causes you to kind of react in almost a survival mode to use this lens. And the question is, and getting back to your question, can anyone effectively plan for a future of work fulfillment? Exclusively, with with having that lens in place, because that lens tends to color how you allocate your time. And and and so anyway, I I think I went through the process thinking that retirement was stopping work. And what I learned, and before I retired, I kind of figured out that it meant doing work. that you like to do that has, you know, fulfillment. What I didn't realize, what I do realize today, is that not all types of opportunities that come to a cybersecurity professional post-retirement, quotes, uh, is actually fulfilling. And you, you might not necessarily know what's fulfilling or not.

**25:59 Robert Hurlbut:** So I'll give you a specific example.

**26:02 Jim Routh:** When I retired, I got a lot of phone calls for something called fractional CISO, which is a CISO that kind of jumps in on an interim basis and kind of sticks fingers in dikes and holds things together for a period of time just to kind of help the business at that time.

**26:22 Robert Hurlbut:** For whatever reason, the business didn't have an appetite to hire a full-time CISO. The fractional CISO does, et cetera. Yeah.

**26:28 Jim Routh:** So I used to think, oh well, that's a natural for me, right? It turns out that I hate that kind of work, and here's why. When you can plan long term, you can build a talented team and focus on maturity, achieving resilience across the enterprise.

**26:48 Robert Hurlbut:** Well, that takes multiple years, certainly, and the larger the enterprise, the longer it takes.

**26:52 Jim Routh:** And so, um, that's what I was accustomed to. And frankly, I was motivated and interested in doing that. But when you're a fractional CISO, you're basically a babysitter, and there's not a lot of change that you can introduce. Now, it turns out I really like being a transformative CISO, a leader that focuses on transformational change.

**27:15 Robert Hurlbut:** I like a lot of the people aspects of that change because if developed education.

**27:19 Jim Routh:** But you don't do that as a fractional CISO. So it turns out that that whole type of work opportunity that's available to me, I'm not interested in. And it turns out that consulting in general— now, I was a consultant, um, for 12 years, uh, 3 different companies, had a lot of consulting experience.

**27:38 Robert Hurlbut:** I love consulting, learned a ton.

**27:40 Jim Routh:** I gave it up because of the family needs of travel.

**27:43 Robert Hurlbut:** and, you know, triggering the change.

**27:46 Jim Routh:** Um, but I love consulting. Well, I don't love it today. As a matter of fact, I don't want to do it today. I've done several consulting engagements that I've kind of dragged in by people that I'm friendly with and have a relationship with, and they said, no, no, we need you, Jim.

**28:02 Robert Hurlbut:** We, we just need you. And so I've, I've kind of, uh, succumbed to the pressure and did that on a number of occasions.

**28:08 Jim Routh:** But I'll tell you, it's not for fulfilling work. And it's not fulfilling work largely because I'm solving the same problem I've solved before. And I'm doing that, solving that problem that I've solved before, in the constraint or with the constraints set by the customer, the client. And in some cases, I would never have used those constraints, um, or I would have found a way to get around those constraints to do the right thing from a long-term perspective, not necessarily from the short-term perspective. Right.

**28:40 Robert Hurlbut:** perspective. But when you're a consultant, you don't have that luxury. So you're operating really within the short-term perspective and you're constrained by that.

**28:49 Jim Routh:** It turns out that solving problems that I've already solved just to earn, uh, you know, a couple bucks an hour, uh, uh, in terms of a services engagement, um, it wasn't worth it. It wasn't fulfilling.

**29:03 Robert Hurlbut:** It didn't—

**29:04 Jim Routh:** I didn't walk away, learn anything from it. So I'll never do that type of work.

**29:08 Robert Hurlbut:** Yeah.

**29:09 Jim Routh:** I got drawn into being an expert witness on a couple of high-visibility cases involving cybersecurity, and I said, oh, this is a natural.

**29:22 Robert Hurlbut:** Oh, I know a lot about cybersecurity as a practitioner perspective.

**29:26 Jim Routh:** This will be great. Well, it wasn't.

**29:28 Robert Hurlbut:** It wasn't a great experience. As a matter of fact, you know, a couple of examples.

**29:32 Jim Routh:** In one case, I was not—I was asked not to testify, nor did I do produce any kind of artifact or document supporting a position.

**29:45 Robert Hurlbut:** The legal team involved did all of that, and they just kind of picked my brain over a period of time—months, months—but I was kind of in the background. And this is for Asiso, who's a buddy of mine, you know, a friend.

**29:58 Jim Routh:** Uh, and I want to do everything possible on his behalf. Well, the, the, the, uh, they lost. The legal team lost.

**30:06 Robert Hurlbut:** It had a significant impact on the industry, uh, in terms of Cecil's responsibility and obligation. And, um, and, and I felt frustrated. So even though, you know, I got paid, I did, you know, I paid pretty good hourly wage and, uh, did work to help the defense team, It was very much of an unrewarding result.

**30:29 Jim Routh:** I got recently a legal team asked me to produce a document that would have taken about 75 hours to produce, and I was asked on December 18th to do this.

**30:43 Robert Hurlbut:** And so the next day, like, my kids are coming down and, you know, joining me and visiting for the holidays and so forth, and I wanted to take time off and Spent it with them in the holidays.

**30:53 Jim Routh:** And I was, you know, up against this deadline that was pretty much of an artificial deadline. And, uh, I had to work like, you know, a lot of hours to try to do this. Once again, not fulfilling.

**31:06 Robert Hurlbut:** And, and, and I've learned—

**31:09 Jim Routh:** and this is a positive side of that— is I've learned what work to say no to right out of the gate and not to do, even though It looks kind of attractive, and it's a way to you know you know get some cash. But it just it's not worth it to me anymore. I've changed my entire way of thinking about defining fulfillment from work. And so the real interesting question which you asked is: Could I could I have done that five years before I retired, and then set up those kind of opportunities in preparation for when I retired?

**31:47 Robert Hurlbut:** you know, using our definition of retirement.

**31:50 Jim Routh:** And I don't know the answer to that, Chris. I don't know because I had that lens, you know, in place then.

**31:55 Chris Romeo:** Yeah.

**31:55 Jim Routh:** And I didn't realize it was in place there then. I just realize it now post-working. So, so it's a great question.

**32:04 Robert Hurlbut:** I'd actually like to learn from your audience, you know, what their perspective is because, um, yeah, I'm not sure I could have, you know, Understood what work fulfillment really was, meant to me.

**32:16 Chris Romeo:** Well, I think this conversation is something that should be helpful for a lot of folks because people just don't think about this. Like most people have that classic definition that you described, your parents passed on to you of retirement is this event where I no longer have to work anymore and then I try to figure it out. And so the thing I love about this philosophy that you're sharing here is that people can hear about it, learn about it, and that could be a goal for some people to say, hey, I want to reach a point. Because, because, you know, like we, like I said before, I mean, we tend to be pretty well paid in the world of cybersecurity. You don't have to be 65 years old to modify your approach to work. You know, people go through that cyclical nature of life, right? You get married, you have kids, those kids grow up, they go to college. The nest is empty and so you could kind of be, some people could transition to this earlier than either any of us for the stage of life we're in. Like you could be planning for this and getting to it if you're thinking about it, if you're being strategic about it, which I can't say that I was like, I've been head down. Let's, let's get this, whatever I'm working on, let's get it done. And never really spent a lot of time in my career thinking strategically about the future. But my hope is that this will, this will open the conversations up. Some people will go, ah, I never thought about that before. And maybe it runs in a background thread somewhere for some period of time for them.

**33:55 Robert Hurlbut:** Yeah. There are, there are some steps that you could take that professionals can take prior to retirement, like years before retirement, that I highly recommend to get you ready and prepared to some degree. And that is, number one, the pursuit of identifying what your fulfillment is from different types of work activities is probably paramount. Is that— if you think, really think through what kinds of attributes and characteristics you want to use to evaluate work opportunities for you?

**34:31 Jim Routh:** Because I've shared mine, but I think everybody has slightly different perspective and they need to go through that definition process.

**34:39 Robert Hurlbut:** For instance, I wanted to serve on boards. Why?

**34:43 Jim Routh:** Well, as a CISO for a public company, I worked with board members all the time and I worked with some really impressive people just as human beings. And as professionals, and I admire them. So in the back of my mind, I said, "I want to be a board member." Well, turns out it's easy to become a board member.

**35:03 Robert Hurlbut:** You just have to start with a not-for-profit because they're always looking for board members and you know looking for everything else as well. So so that's the place to start. And then secondarily, as a cybersecurity professional, you can go to either a venture capital fund or a private equity group that specializes in, you know, mid-sized businesses and above, uh, and, uh, or even some cases early-stage, uh, you know, cybersecurity companies.

**35:35 Jim Routh:** And they'll introduce you to their portfolio companies or companies that they're betting for potential investment, and you can pick and choose and say, hey, I'd like to be an advisor and then a board member.

**35:46 Robert Hurlbut:** you know, when you grow up big enough, I want to be a board member.

**35:50 Jim Routh:** And you can get board seats that way pretty effectively and easily.

**35:55 Robert Hurlbut:** Now, in some CISO roles, you can have that either a board seat or an advisor, and it's allowed and, you know, satisfies the compliance requirements while you're a CISO.

**36:09 Jim Routh:** And so you're building up your talent in investing from a professional development standpoint in how to be a more effective board member. Now, there's nothing to say that you should wait until you retire or leave your operational job in order to do that. There's a lot you can do to get ready for that on your own, just within the parameters and constraints that you have.

**36:34 Robert Hurlbut:** And I highly recommend people do that. I served on a board member from from different ISACs, and you really couldn't be an advisor to a cybersecurity company simply because there's this perception of conflict of interest. I think it's legitimate in that case. And so when I was serving as a board member for the Health ISAC— another great way to be a board member, by the way, and build up your competency, skill, and resume—

**37:05 Jim Routh:** but I really couldn't do any other advisory and board work outside of that in cybersecurity because there was, you know, this conflict of interest. So I retired from the health ISAC in this case, and the driver for that was primarily so I could do more board advisory work and get prepared for my next stage in my professional, you know, career. And I encourage people to think, you know, of ways to Get ready for whatever you, your definition of retirement is.

**37:37 Robert Hurlbut:** Get ready before you have to do that because it, if you're going to do your own type of work and have flexibility, you're going to create an LLC to protect your liability.

**37:47 Jim Routh:** And you're going to do that relatively early on, even before the transition. And you're going to try to get some, you know, like prime the pump, like get some clients, customers, whatever you want to call them as companies that can hire you as an advisor and/or a board member, if that's your path you want to take, line that up before you announce your retirement.

**38:15 Robert Hurlbut:** Yeah.

**38:15 Chris Romeo:** So just listening to you as we've kind of gone through this conversation, it made me think of a kind of a slightly different angle, but I'm curious to know what your answer is to this. So if you could send yourself an email in the past, you know, we had a DeLorean that could deliver emails or something. Let's say, I'm just going to pick a random, I'm just going to say your 30, you could send your 30-year-old self an email with some, just some wisdom that you have accumulated up to today that you just wish you had when you were 30 years old? Like what, what would you, I guess, what would be the 3 bullet points in that email that you would send?

**39:07 Jim Routh:** Yeah. Uh, great question.

**39:10 Robert Hurlbut:** The, my start in cybersecurity, which happened as we talked, you know, kind of serendipity-wise, uh, as, uh, something I bumped into. forced me or gave me the opportunity to learn from a guy named Steve Katz. You know Steve well, he's the first CISO. And Steve was my mentor because Steve had retired by that point in time. And what he taught me, and this happened the first day I was the CISO, I realized at American Express, I realized that we had an MOU, a memorandum of understanding that basically said that You gotta have a cybersecurity program, you gotta put it in place. So I literally, on my first day as the CISO, I had to prepare this strategic plan.

**39:56 Jim Routh:** It was due the second day, right? And so there was a calendar invite to a meeting at 2 o'clock presenting the information security strategy for American Express to the OCC.

**40:10 Robert Hurlbut:** And the OCC is pretty, you know, talented regulator that, uh, that that, you know, you don't mess with. They know what they're doing.

**40:16 Jim Routh:** So I, I called Steve cuz somebody gave me his name.

**40:20 Robert Hurlbut:** I didn't know who he was. I called him. I said, Steve, you gotta help me.

**40:22 Jim Routh:** Well, he dropped everything, got 2 other CISOs from 2 other organizations that were competing, relatively speaking, with American Express. They dropped everything they do and the 3 of them came and prepared the presentation for me, had me deliver the presentation that they created to them, role-playing it. Yeah.

**40:43 Robert Hurlbut:** To get me ready for the presentation the next day, which I did, and it went you know perfectly well.

**40:49 Jim Routh:** OCC sets good MOU satisfied. So what that taught me was that I had to serve others, that I had to help others in cybersecurity because that's what you did. It didn't dawn on me at that time that that would be one of the fulfilling work activities that I would do for the rest of my life. Um, and I didn't know it. So if I, I would have liked to have sent a memo back to me at that point in time that said, this is more important than any other work you're doing today, treat it that way. Um, that would have been really— because I learned that over the years, that it is really important work. But I now look at it differently because it's probably the most fulfilling work that I have. So there's 90 people that I mentor whenever they want. And I never say no if somebody asks me for mentoring help because it was so valuable and important to me early in my career. But it's also, it's so fulfilling to me at this point in my career. So I would have liked to have known what I know now.

**42:03 Robert Hurlbut:** back when I was 30 or so.

**42:05 Chris Romeo:** Yeah, that's helpful. Unfortunately, no one has invented this time machine that can send us emails from the future to help us understand. Before we go to Robert's lightning round, I'll throw one more question at you. Do you see this criteria changing over the next 10 years for you personally? Like, is there a ramping down or is this going to be Jim what Jim does forever until as long as he's on this earth?

**42:36 Jim Routh:** I think it's the latter in that I think this is the—

**42:43 Robert Hurlbut:** I don't think the filters are going to change.

**42:47 Jim Routh:** And the reason I say that is because what I'm doing today, I think, is as long as I have my health, it's sustainable. And so I fully intend to do it You know, my mentor Steve, he told me before he passed away that he's going to mentor me and everyone else.

**43:05 Robert Hurlbut:** And he had, you know, probably over 100 people that he was mentoring.

**43:08 Jim Routh:** He said he's going to do that from the afterlife.

**43:10 Robert Hurlbut:** Now, Steve can get away with that, but I'm pretty sure I'm going to be doing that to the end of my life to the best of my ability. But you know what, to give you a true answer, I changed my perspective of retirement as I got into retirement. And I think it will withstand the test of time for the rest of my life, but who knows? So I could be absolutely wrong and misguided. So we'll see. It'll be an interesting journey, but we'll see.

**43:46 Chris Romeo:** Yeah. Very cool. This is It's been really helpful just to unpack this philosophy that you're living out now. I know it's, I've already taken away some things from it that I'm going to apply to my life and my professional career where I sit right now. So this has been really good. Well, before we wrap up the conversation, Jim, I definitely want to give you a chance to just share a key takeaway or a call to action, something you want to leave our audience with here.

**44:18 Robert Hurlbut:** Yes, um, number one, um, top-of-mind topic for me, and I published a paper just recently on this, uh, is that all individuals, all professionals, are accountable and responsible for their own professional development. That wasn't always the case when I started in my professional career. That was back in the days where the company that you worked for told you what you were going to learn. They told you what classes you were going to take, and they gave you a career path.

**44:49 Jim Routh:** And they made the assumption that the employment agreement was for life.

**44:53 Robert Hurlbut:** Like, you, as long as you, you know, performed well, you could remain in company and they'd see you through to that retirement, which was stopping work, right?

**45:03 Jim Routh:** Uh, and to—

**45:04 Robert Hurlbut:** and of course, that notion is absolutely absurd today.

**45:06 Jim Routh:** Today, the employment model is the employee has responsibility and accountability for their own professional development.

**45:13 Robert Hurlbut:** And the organization and the leader behind it is a bit of an enabler that can support that development and make some adjustments to facilitate it. But nonetheless, you own your own professional development, both in the definition of the objectives and also the development activities.

**45:35 Jim Routh:** And so I think it's a really valuable exercise to, on an annual basis, to understand what 2 skills— and not 10 skills, just 2— what 2 skills do I want to invest my time in learning and/or mastering for whatever reason?

**45:56 Robert Hurlbut:** And in other words, it could be your own.

**45:58 Jim Routh:** Like, you could say, I'm getting ready to be a CISO. That could be a valid reason. Or I'm getting ready not to be a CISO. to do something else, and that could be a valid reason. So the reason is not important, but the— at least not important to anyone else other than you, but the definition of what skill at a granular level you wish to invest your time in developing and mastering gives you an opportunity to identify then the development activities that can enable that learning experience and give you a chance to practice and develop that skill. So you can demonstrate it. And that's something that you should use as a criteria for deciding when it's time to change your job. So I get asked a lot by early-in-career professionals specifically, I've been at this company for 3 years, I think it's time to move.

**46:53 Robert Hurlbut:** And I'll say to them, well, why do you think it's time to move?

**46:55 Jim Routh:** And they'll say, well, I've been here 3 years.

**46:58 Robert Hurlbut:** Well, tenure is not the right way of defining when it's time to move from either one company to another or one job within a company to another job. As a matter of fact, tenure is the least important variable.

**47:13 Jim Routh:** What's important is that if you can learn the skills you choose, then you should take advantage of that opportunity and the leader behind that opportunity.

**47:24 Robert Hurlbut:** opportunity that's helping you, enabling you to learn the skills you want to choose?

**47:28 Jim Routh:** And if you can't, if you're blocked from that, then it's time to find a new leader. That doesn't mean outside the organization. It could, but that's the time.

**47:40 Robert Hurlbut:** It's not when you've been here 3 years, 5 years, 10 years, 8 years, whatever it is, or how long you've been in your role.

**47:47 Jim Routh:** It's, can I learn the skills that I choose to learn?

**47:51 Robert Hurlbut:** Can I learn the skills that I think will make me most marketable? And this is by my choice.

**47:56 Jim Routh:** And if the answer is yes, then don't leave the company.

**47:59 Chris Romeo:** Yeah.

**48:01 Jim Routh:** And don't consider that and don't even factor in tenure.

**48:06 Robert Hurlbut:** Factor in whether you can learn the skills you wanna learn and you're supported in that.

**48:12 Jim Routh:** And the day that you're not supported in learning the skills that you learn, that's the day that you decide to leave.

**48:19 Robert Hurlbut:** Find a new opportunity and find a leader that will give you that opportunity to learn the skills that you wish to learn.

**48:24 Chris Romeo:** Yeah, that's more wise advice to share with folks, especially for those that are, I know, early stage. A lot of people like to bounce around and they feel like if they're not in motion, they're not growing their career. And I love that. It's, they should be, you should be stopping and using that criteria. Like if I don't have somebody who's enabling me to better, then that's when I need a new leader. Not just because all my friends are bouncing around to different companies and I feel like I'm behind if I haven't worked at 3 companies by the time I'm 22 years old. Right?

**48:58 Robert Hurlbut:** Exactly.

**48:59 Chris Romeo:** Well, Jim, thank you so much for sharing just your experiences, your philosophy of work now. And so it's always a joy to get a chance to talk to you and just pick your brain for an hour at a time. I always, I always will come away with lots of things to think about and lots of things that I've learned. So really appreciate you, appreciate your support of the podcast here. So thank you. We look forward to the next conversation.

**49:24 Robert Hurlbut:** Sounds good, Chris. And love the opportunity to work with you as we have in the past. That's the kind of fulfilling work that I like to do, and I'm sure you do as well. And look forward to the next opportunity.

---

Source: https://appsecpodcast.com/jim-routh-the-ciso-transition-to-the-rest-of-life/