In this Help Net Security interview, Sandra McLeod, CISO at Zoom, reflects on her first year in the role. She talks about moving from reactive firefighting to business strategy, and what she heard from engineers, the board, and customers during her early months.
McLeod discusses how she prepared for incident management, the dual job of handling crises and explaining them afterward, and her experience as a woman in technical leadership at Zoom. She closes with honest advice for women in security considering whether to pursue leadership roles themselves.
There’s a version of the CISO role that’s essentially a technical firefighter, and another version that’s a business strategist who happens to understand threat vectors. Where did you land when you started, and where are you now?
When I first moved into the CISO role, I’d say I was a bit closer to the technical firefighter end of the spectrum. My initial focus was probably more heavily weighted toward immediate response and reactive measures as I gained a deeper and broader understanding of our current security posture. That foundation was critical before I could shift gears to more of a proactive and forward-looking focus.
Now, a year in, I’ve been able to transition toward the business strategist role. With a clearer picture of our security landscape and established priorities, I’m spending more time on strategic initiatives. Building maturity into our security programs, aligning security investments with business objectives, and adopting a more forward-looking, proactive approach. It’s been a deliberate evolution from ‘understanding and stabilizing’ to ‘anticipating and enabling,’ and I’m pleased with the progress we’ve made in that direction.
The first 90 days in any executive role involves an enormous amount of listening. What did you hear from engineers, from the board, and from customers that surprised you?
What surprised me most was the consistency of what I heard across all three groups. Engineers, board members, and customers were all looking for the same thing: confidence. Not just confidence that I could manage the responsibility of securing Zoom, but that I understood how to balance security imperatives with business needs and priorities.
From the engineering teams, I heard a desire for direction, prioritization and, frankly, empowerment. They wanted assurance that security wouldn’t be a blocker to innovation or growth, but rather an enabler. They needed to know that security decisions would be made with an understanding of technical realities and constraints, and that leadership would be able to prioritize effectively and make trade-offs where necessary.
The board’s perspective reinforced this theme from a governance standpoint. They weren’t just concerned about compliance checkboxes or audit scores, they wanted assurance that my security strategy would result in real, tangible reduction of risk to Zoom, while at the same time being tightly integrated with our business strategy. They needed to know that our security investments were focused on impact, driving down risk and protecting the company’s reputation and customer trust while supporting, not hindering, our ability to innovate and introduce new products.
From our customers we consistently hear they are looking for reassurance that we are dedicated to building security into our products and platforms and that their data and privacy is protected. At the same time, we also understand that they expect security to be natively and seamlessly integrated in a way that empowers them to own their security decisions while also providing a frictionless experience. Customers want confidence that Zoom’s security leader understands their needs and also understands what it takes to deliver on that.
Security needs to be an enabler that builds trust with customers, gives the board confidence in our risk posture, and empowers engineers to build great products safely. That clarity helped me shape my approach from day one. My approach to security has to ensure rigor and diligence, but it also has to be pragmatic and aligned with what the business is trying to achieve.
When a security incident occurs, the CISO is both the person managing the crisis and the person who will be asked to explain it afterward. How did you prepare yourself mentally and operationally for that duality before the inevitable moment arrived?
The incident management aspect wasn’t entirely new to me. I previously led product security incident response, so I was familiar with the operational cadence of managing crises in real time. What has been different in the CISO role is the judgment required around escalation: deciding which issues need C-suite visibility and how to communicate them effectively at that level. The other shift has been in accountability.
I’m now responsible not just for managing incidents as they occur, but for ensuring we fully understand root causes and proactively implement measures to prevent recurrence. It’s moved from tactical response to strategic ownership of our security resilience. Over time, I’ve come to view those parallel responsibilities as complementary demands: effective operational response lays the groundwork for credible, transparent post-incident accountability, and that mindset has been central to how I lead our security resilience efforts.
There is a documented pattern where women in technical leadership are questioned on credentials in rooms where their male counterparts are not. Have you developed a response to that dynamic, or does it still cost you energy every time?
I haven’t experienced that dynamic at Zoom. We have strong representation of women in leadership here at Zoom, and I’m fortunate to work with peers and cross-functional partners who have never made me feel I needed to prove my credentials in that way. Having been part of the security organization for four years before stepping into the CISO role also helped. I moved into this position with established trust and credibility already built with my cross-functional partners. That foundation has been invaluable.
If a woman who is currently a security engineer, a GRC analyst, or a SOC lead is reading this and considering whether leadership is for her, what is the most honest thing you can tell her about what she is walking into?
For anyone who is thinking about moving into leadership, I would encourage you to first ask yourself why you want to lead and what kind of leader you want to be. Reflect back on the leaders you’ve worked with—the ones who inspired you and the ones who didn’t. What made the difference? That clarity will guide you more than any job description.
If you’re genuinely curious about leadership, my advice is to test it out. Seek opportunities to lead projects, mentor others, or drive cross-functional initiatives. See if you find energy in enabling others’ success, navigating ambiguity, and making decisions that balance competing priorities. Leadership isn’t just a promotion, it’s a fundamentally different way of contributing. If those experiences resonate with you, then yes, this path is absolutely worth pursuing.
Webinar: The IT Leader’s Guide to AI Governance
