The Cyber Security Matters Podcast

In this episode of Cyber Security Matters, hosts Harry Baldwin and Matt Rose are joined by Quincy Castro, Chief Information Security Officer at Chainguard.

Quincy shares his unconventional journey into cybersecurity, from studying economics and political science to working at the NSA, leading security at GE Transportation, Wabtec and Redis, and eventually joining Chainguard.

The conversation explores how AI and open source software are reshaping cybersecurity, why people and culture are more important than security budgets, and how the rise of citizen developers is introducing new software supply chain risks. Quincy also discusses the evolving relationship between CISOs and boards, why vulnerability patching has become a strategic business concern, and his prediction that the CISO role could look completely different in five years.

Key Topics Covered
• Quincy's unconventional career journey, from economics and political science to the NSA and cybersecurity leadership
• What offensive security experience teaches defenders about understanding attackers
• Choosing the right CISO opportunity and building security teams that challenge conventional thinking
• Why people, culture and leadership matter more than cybersecurity budgets
• The challenges facing cybersecurity startups and the growing cyber poverty gap
• How Chainguard is approaching open source security and software supply chain risks
• The rise of AI coding tools, citizen developers and new security vulnerabilities
• Open source attacks, including the axios compromise and Shai-Hulud worm
• How AI can combine low-severity vulnerabilities into more significant security threats
• Why vulnerability management and patching are becoming board-level priorities
• The future of the CISO role, regulatory liability and the EU Cyber Resilience Act
• Career advice for aspiring cybersecurity professionals

About Quincy Castro
Quincy Castro is Chief Information Security Officer at Chainguard, a company focused on securing open source software and strengthening software supply chains.

Before joining Chainguard, Quincy spent four years as CISO at Redis and previously led cybersecurity at Wabtec Corporation and GE Transportation. Earlier in his career, he held roles at the NSA, General Electric and within the US federal government.

Alongside his leadership experience, Quincy advises and invests in early-stage startups and has taught cybersecurity and national security at Marquette University. He holds an MBA from the University of Chicago Booth School of Business, an MA from Marquette University and a BA in Economics from the University of Washington.

This episode is brought to you by neuco, a global specialist recruitment and executive search partner supporting organisations across Cyber Security, Satellite & NewSpace, Connectivity, and Media & Sports Technology.

In this episode of Cyber Security Matters, hosts Harry Baldwin and Matt Rose are joined by Alfredo Hickman, Chief Information Security Officer at Kai.

Alfredo discusses his journey from a 1990s fascination with early internet technology, through infantry service in the US Marine Corps, national security roles, and nearly eight years building the security organisation at Obsidian Security, to his current role at Kai. The conversation explores why AI is fundamentally reshaping the balance between attackers and defenders, what needs to happen before organisations can hand more autonomy to AI in security operations, and whether the industry is heading toward a genuinely new security operating model rather than another generation of point solutions.

Alfredo also shares his thinking on what separates the best cybersecurity professionals, the mentors who shaped his career, and the achievement he is most proud of.

Key Topics Covered
Alfredo's path into cybersecurity through 1990s internet and hardware culture
Serving as a Marine Corps infantry sergeant in counterterrorism after 9/11
The mentors who shaped his career, including his mother and Dmitri Alperovitch
Rising from individual contributor to CISO in one continuous run at Obsidian Security
Why he joined Kai to help build autonomous defence for security teams
What separates the best cybersecurity professionals from the rest
How AI is changing the role and required skill set of security professionals
Kai's mission to give defenders an asymmetric advantage through autonomous defence
The structural imbalance between AI-augmented attackers and resource-constrained defenders
What's needed - governance, guardrails, and a "trust fabric" - before AI can safely take autonomous security actions
Emerging AI governance standards, including ISO/IEC 42001 and Cloud Security Alliance guidance
Whether the future of security is a new operating model or another generation of point solutions
His five-year prediction that at least 60% of manual security work will be automated
The career achievement he describes as his proudest moment
His advice for people entering cybersecurity: get comfortable being uncomfortable

About Alfredo Hickman
Alfredo Hickman is Chief Information Security Officer at Kai, an agentic AI cybersecurity platform built to help defenders execute security work at machine speed. Founded by Galina Antova (co-founder of Claroty) and Dr Damiano Bolzoni (co-founder of SecurityMatters), Kai emerged from stealth with $125 million in funding to build autonomous defence capabilities for enterprise security teams.

Before joining Kai, Alfredo spent close to eight years at Obsidian Security, rising from an individual contributor to Chief Information Security Officer and building the company's security organisation from its earliest days. Earlier in his career, he led security product engineering at Rackspace Managed Security, and held roles at the Center for Strategic and International Studies and the US Department of Defence. Alfredo's path into technology began in the early-to-mid 1990s, teaching himself to code and reverse-engineer software. That early interest was interrupted, and ultimately redirected, by his decision to enlist in the US Marine Corps as an infantry sergeant following the September 11th attacks, where he was later exposed to cyber operations in a national security and counterterrorism context.

His work today sits at the intersection of cybersecurity leadership and AI governance, with a focus on helping organisations safely realise the benefits of autonomous, AI-driven defence.

This episode is brought to you by neuco.

In this episode of Cyber Security Matters, hosts Harry Baldwin and Matt Rose are joined by Gal Ordo, Co-founder and Chief Product Officer at Native. Gal shares his journey from studying mathematics and developing early expertise in cybersecurity to leading product at AWS Security Hub and later founding Native. 
 
The conversation explores why cloud security needs to move beyond simply detecting risk and towards secure-by-design environments. Gal explains how Native approaches cloud security across multiple cloud providers, and why AI is changing both the threat landscape and the role of security engineers. He also shares his views on product management, building early-stage teams, leadership, and the professional achievement he is most proud of. 

Key Topics Covered 
Cloud security moving from detection to prevention 

The shift towards secure-by-design cloud environments 

Why multi-cloud consistency matters across AWS, Azure, Google Cloud and Oracle Cloud 

Native’s approach to cloud security controls 

The challenge of turning security outcomes into practical cloud controls 

How AI is changing the cloud threat landscape 

Securing AI agents through deterministic controls 

Why AI can support security engineering without replacing human expertise 

The changing relationship between product management and engineering 

Building lean product teams at an early-stage start-up 

Hiring and developing strong security engineering talent 

Gal’s “disagree and commit” approach to leadership 

His transition from AWS to founding Native 

The professional achievement he describes as his proudest moment 

His advice for people entering cybersecurity: treat security as a puzzle to solve 

About Gal Ordo 
Gal Ordo is Co-founder and Chief Product Officer at Native, a cloud security company focused on helping organisations build secure-by-design cloud environments. Native describes itself as a cloud security control plane that turns security outcomes into enforceable controls across AWS, Azure, Google Cloud and OCI. 
 
Before founding Native, Gal was a product leader for AWS Security Hub, where he worked closely with large enterprise customers and gained first-hand insight into the challenges organisations face when securing increasingly complex cloud environments. This experience helped shape the founding idea behind Native: that organisations need to move beyond identifying cloud risks after the fact and instead embed security outcomes directly into their cloud architecture. 
 
Gal began his career in cybersecurity before pursuing an MBA in the US. His work today sits at the intersection of cloud security and product development, with a focus on helping organisations translate security objectives into practical, enforceable controls within their cloud environments. 
 
This episode is brought to you by neuco.

In this episode of Cyber Security Matters, hosts Harry Baldwin and Matt Rose are joined by Liz Drysdale, Chief Marketing Officer at Outpost24, to explore what makes cybersecurity marketing different, why trust sits at the centre of the buying journey, and how marketing teams can stand out in an increasingly crowded security market.

Liz shares lessons from more than 25 years of international marketing experience and her work across cybersecurity companies including CyberArk, BeyondTrust and SentinelOne. She discusses building brands across different cultures, the balance between global consistency and local relevance, and how she approached refreshing the Specops brand after joining Outpost24.

Key Topics Covered:
• Cybersecurity marketing is a journey of trust - Why trust is central to cybersecurity buying decisions.
• Building strong marketing teams - Liz's three key qualities: resilience, coachability and resourcefulness.
• Global vs local marketing - How to scale marketing while adapting to different cultures and markets.
• Standing out in a crowded cybersecurity market - Why the right message and channel matter more than simply being louder.
• AI and the future of marketing - Where AI adds value and where human expertise remains essential.
• The importance of curiosity - Liz's advice for anyone entering cybersecurity marketing.

About Liz Drysdale:
Liz Drysdale is Chief Marketing Officer at Outpost24, where she leads global brand strategy, market expansion and customer engagement across the company's exposure management and identity security portfolio. She has more than 25 years of international marketing experience, including extensive experience in cybersecurity, and previously held senior marketing leadership roles at CyberArk, BeyondTrust and SentinelOne.
Outpost24 describes itself as a global cybersecurity provider focused on exposure management and identity and access management, helping more than 3,000 organisations identify, manage and reduce cyber risk across digital and human attack surfaces.
This episode is brought to you by neuco.

In episode 79 of Cyber Security Matters, hosts Harry Baldwin and Matt Rose are joined by Aimée Roerink, Chief Marketing Officer at Detectify, for a wide-ranging discussion on cybersecurity, marketing, AI and the growing complexity facing modern security teams. Aimée offers a different perspective on the industry focused on customer value, clarity, commercial outcomes and the importance of translating complex technology into something people can actually understand and use.

This fascinating conversation explores why businesses can end up with “scaling confusion” when they add more people, processes, channels and technology without first establishing clarity. Aimée discusses the dangers of buying cybersecurity tools because of fear of missing out, why AI should be treated as a means to solve a real problem rather than a reason to buy another platform, and what the rise of shadow AI can reveal about the environments employees are working in.

Key Topics Covered
• Clarity over complexity: Why Aimée says clarity matters more than skill, and how organisations can scale confusion without clear problems, priorities or value propositions.
• Alignment beats local optimisation: How strong individual teams can still slow the wider business when they optimise towards different priorities, channels or value propositions.
• Building teams that can thrive: The value of curiosity, drive, ownership, commercial judgement and low ego, plus a willingness to challenge without becoming territorial.
• The changing role of marketing: Why marketing now reaches beyond lead generation into positioning, market selection, sales effectiveness, retention, pricing and revenue.
• The human advantage in an AI world: Why judgement, customer insight, creativity, credibility and trust become more valuable as AI handles routine execution.
• What Detectify does: How Detectify helps organisations understand their attack surface and find exploitable vulnerabilities through payload-based testing, security research, ethical hackers and AI.
• Cybersecurity FOMO and tool sprawl: Why organisations buy fashionable tools without accounting for integrations, training, governance, maintenance and ownership.
• Buy less, simplify more: Why a new security tool should replace, simplify or meaningfully improve something, not just add another layer.
• Marketing AI without the hype: Why AI messaging should start with the customer problem, not the technology, and focus on what Alfred AI enables.
• Shadow AI as a symptom: How unauthorised AI use can point to slow processes, unclear policies and inefficient workflows, not just poor employee behaviour.
• Creating practical security cultures: Why secure behaviour should be built into everyday workflows so the safe option is also the clear and practical one.
• Making it safe to admit mistakes: Why blame makes people hide errors, and why teams need a culture where issues can be reported quickly.
• Advice for entering cybersecurity: Challenge what you see, understand what companies really do, and choose work that aligns with your values.

About Aimée Roerink
Aimée Roerink is the Chief Marketing Officer at Detectify, where she leads the company's marketing and commercial positioning.
Aimée came into cybersecurity from a commercial leadership background rather than as a security practitioner. Across her career, she has focused on understanding complex markets, identifying where businesses can create customer value and building teams and commercial systems that turn strong products into sustainable growth. In the episode, she explains that what attracted her to cybersecurity was the combination of an urgent customer problem, sophisticated technology and an industry where trust is particularly important.

Episode created by neuco
neuco is a global specialist recruitment and executive search firm supporting companies across cyber security, satellite, space and defence, and media and sports technology with hiring and talent solutions.