At school James Robinson was more sporty than STEM, but after school he rose from the track to cybersecurity leader at Netskope.
The journey to becoming a CISO
The young James Robinson attended a small high school in Central Illinois and describes himself as ‘more sporty than STEM’: “I wasn’t going to knock it out of the park in the English class – but luckily the English teacher was also the track coach, so that helped.” In his final year in high school, the principal suggested going on to something vocational or trades-related rather than university. A friend was already in a vocational school doing electronics engineering, so he went that route. That school had just been included in the Cisco Networking Academy (NetAcad).
Robinson threw himself into NetAcad learning. “It was like the world suddenly became my oyster. There was no stopping me. I started doing networking at home, got connected to the internet, and studied and studied.” This was the late 1990s while he was still at school.
After school, by the early 2000s, he became a network engineer at State Farm Insurance, but now with a Cisco Certified Internetwork Expert (CCIE) certification. He decided to join Cisco itself. At that time, Cisco was the darling of the tech boom, briefly being the most valuable company in the world with a market cap in excess of $500 billion.
But then the dot-com bubble burst. It would not be a stretch to say that Cisco was caught flat-footed. Its stock price plummeted from over $80 to under $10, and the firm was forced to lay off around 8,500 employees.
For Robinson, that route to Cisco was blocked and he was forced to remain at State Farm Insurance. He asked for a different position, and was told, ‘This security thing is going to be big. Go for that.’ While doing the interviews at Cisco, he had met a guy from AT&T who had talked about the idea of shutting off internet connection and all outside communications for security reasons, so this new security idea gelled.
Robinson was in his early 20s and looking for a new direction and new challenge. In his own words, “I just kind of fell into security. I saw the opportunity, took the shot, and went for it.” He became a technical (security) analyst at State Farm Insurance.
The combination of a solid background in technology, networking and an early and growing interest in security was a solid marketable quality. In 2006 he left State Farm Insurance to become a systems engineer (info protection security architecture and analysis) at Anheuser-Busch. He moved on to Emerson Electric in 2008 and became product security assurance manager and product security officer at Emerson Network Power in 2010. In 2012 he joined Websense and became security architecture and strategy officer in 2013. He then moved to Accuvant-FishNet Security as director of information security, becoming VP of third-party risk management at Optiv in 2015.
Always in security, never staying long in any one position, but always moving up the career ladder. In 2018 he joined Netskope as deputy CISO. He seems to have found his calling. He stayed in that position for more than five years – twice his average sojourn – and became CISO in 2024. He remains CISO at Netskope today.
Advice
Every successful person has had good advice along the way. That advice is often useful to everyone, not just security practitioners.
On his journey, Robinson received and followed the advice of numerous mentors. One was his mother-in-law. “If you want to do something,” she told him, “and you keep getting blowback or being told, ‘You don’t want to do that because…’ then you’re probably not right for that position, or company, or even that career anymore.”
He also had traditional professional mentors and tries to live by one specific piece of advice: “Get close to the business. Understand how the business works. Know what makes it perform well and what makes it perform poorly.”
Some advice was more esoteric. “If you see smart people doing dumb things, you’re just not in the know.” The implication is that you shouldn’t immediately dismiss strange actions as stupidity, but you should pause and consider whether there is something you’re missing or simply don’t understand. (He added this advice could apply to the world of politics just as much as the world of business.)
“Two other pieces of advice that I try to live by are: If the door is open, see where it takes you,” he said, “and never, ever stop learning, because learning is fun when you’re in the right job.” He clearly abided by the former in his early career, rarely staying in one position beyond two years, and he welcomes the fun part of where he is now. He believes people, and especially CISOs, should have fun whenever they can, “because things happen and come at you, and there’s a lot of stress.”
He illustrated this with the advice that is almost a cultural idiom, but true all the same: it’s not about the destination, it’s about the journey. “I was at a CISO summit just last night and was talking to a CISO. She said, ‘I don’t know what I’m going to do. I’ve done everything I set out to do.’ If you make the destination the goal, what do you do next? And if you didn’t enjoy the journey, what have you got now? Sometimes we want to go so fast we simply don’t get a moment to enjoy where we’re at in the journey.”
So, he continued, “Even with my team members, who I know want to go fast, I try to get them to pause and appreciate the moment – each moment of their journey.”
Another piece of advice he offers to his team members is to ensure they always have good friends and good mentors with them both in the journey and at the destination. “There was a point in my own journey when I was struggling with some things. And then I remembered I hadn’t spoken to any of my mentors for a while. So, I called one, and we had a conversation and talked through my problem. In that discussion I realized I already knew what to do – I just needed the extra confirmation.”
Having good friends is also important. “When you move up the security ladder you increasingly become the odd duck in the company. You’re a technologist, but you deal with people. You’re the one who delivers regulatory bad news, or information that slows people down, or the data nobody wants to hear. You can find yourself a bit isolated and alone.” This is where you need good friends. They’re almost like social mentors.
“I have a few. I know I can call them or text them and no matter what, they’ll get back to me. That’s really, really helpful. I think every CISO, even if they don’t have similar friends, should stress upon their team members that developing friends along the journey is really very important.”
He finally added a combined warning and advice for people wanting to succeed in a cybersecurity career. The warning is that security people shouldn’t measure their position by their hourly wage rate, but rather by the satisfaction of doing a good job. “Security tends to push you well beyond the working day. But it’s a job that attracts people with the curiosity that sustains you so that play becomes work and work becomes play. Fourteen-hour days are not a big deal when you’re having fun, learning new things and are not too concerned with how much money you’re making each hour.”
Building the security team
That curiosity is a key element he looks for as a CISO building his security team. “Even when I’m doing mock interviews for high school students, I’ll say, ‘OK, you want to be in security. What have you been researching? What did you read last night? What did you look up? What interests you?’” he explained.
If you want to work with James Robinson, give him some insight into what you do, because you always need that curiosity and you’ve always got to be feeding it.
He does consider security certifications to be useful in choosing his team. “But it’s more about the mindset and the person,” he said. “I’m always a little bit for the underdog, the person who’s willing to put in the hard work and the time. So, I look for indicators of that.”
He gave examples. “There was a person working in healthcare. He wanted to get into security. I had to tell him there was no position for him – but that if he went to St. Louis (where we have an office) he might get an interview for an intern position. He did that. He moved to St. Louis. That’s the kind of persistence and dedication to purpose that I seek.”
In another example, “A girl was a fresh grad in Northern Indiana, who wanted to get into security. I had to tell her the same thing: I’ve got nothing for you here, but perhaps if you move… She said, ‘Yeah, I’ll move to St. Louis. I’ll go for the job. I’ll go for the role. I’ll be there.’”
She did that. She got a position. “And she’s done an excellent job. She’s now a pen tester on our team, doing attack and penetration and vulnerability assessments. It’s that kind of mindset – I’m just going to go for it – that’s something I look for, because I know that person will put in the extra effort and appreciate the journey.”
He’s as pleased for her as she was for the opportunity.
Back to certifications. He never finished his own university degree, and accepts that at certain points in his own journey there were times he wasn’t considered because he didn’t have a degree. He has no regrets because that was his choice, but he adds, “It doesn’t mean I won’t complete my degree in the future. I’m sort of in a race right now, with my kids aged 16 and 18. The 18-year-old is starting college, but he’s got a long way to go. He’s doing neuroscience and neurobiology, so maybe I’ve got up to eight years to finish my own degree and win the race.”
So, the message from Robinson for people in or wishing to be in security is simple: certifications will be useful, but attitude is even more important.
So, what keeps James Robinson up at night?
From everything he’s said so far, it will be no surprise that it’s not what you might expect. “What I think about late at night, or jot down to get it out of my mind before I go to sleep, is whether or how I can get better performance from myself and the team, whether we’re making real progress on our projects. I’m always looking and reminding myself on ways to enrich the team culture,” he said.
“I want to make sure that every individual member of the team is recognized, and that I can connect with all of them. The best leaders I ever worked with weren’t always my own managers, but they were leaders who made time for me. I try to pay that back. So, my last thoughts before sleep are often, how can I do that? Am I doing everything that I can to be the best leader for the team and is the team’s health and performance strong? Security incidents come and go. They’re like waves. They’re the job, and you handle them.”
Individual incidents do cause stress, but concern over the team is constant. Even specifically asked if AI is a concern today, he replied, “If it keeps me up it’s because I’m trying to learn more about it. It’s the excitement of AI rather than the danger of AI. It’s the team and team performance that matters most; at least for the next few years. One day, maybe everything will be agentic, including my own job. But until we get there, it’s the team and team culture that builds the company and gets things done.”
Related: CISO Conversations: Chris Wheeler – Trust Is the Job, From the Navy to the C-Suite
Related: CISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOW
Related: CISO Conversations: Russ Kirby – Passion Is the Antidote to Burnout
Related: CISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AG
