Framework to Succeed in Corporate — A CISO’s Guide
Introduction
What if we thought about “corporate culture” in terms of technology metaphors? And described a company’s “corporate culture” as its “Corporate Operating System.”
The first thing we want when we step into a new “Corporate Operating System” is a guide. And yet, so often we’re left to figure it out ourselves. Understanding the Corporate Operating System and simultaneously understanding how to succeed within it, is a skill employees are expected to “figure out” (often without instruction). There is a framework and sequence for accelerating success in the Corporate Operating System that works.
Written with the security team in mind, this article outlines a sequence of behaviors and provides guidance to accelerate your ability to be both influential and impactful by iteratively integrating into the Corporate Operating System.
This sequence is for all levels; whether it’s your first corporate job and you want a roadmap for success, or you’re an experienced executive and are looking to accelerate your influence and impact. This sequence lays out the behaviors in the order in which they should be performed to enable success and accelerate effectiveness.
The Corporate Operating Sequence
The Corporate Operating Sequence has ten levels in total — organized in four main zones. Each level stacks progressively, much like the rungs of a ladder: work on level 1 before moving on to level 2 and so on.
The complete framework is pictured below.
The zones, pictured below, start with a focus on the self — things squarely within your control — and then progresses to shift your focus to an expanding circle of influence. It’s tempting to skip a few rungs of the ladder and jump straight into a more advanced level. Resist that urge. Jumping out of sequence is a common cause of future challenges and frustrations.
Practice each of these in their order and you should notice the ease and speed with which you are able to build trust and influence and thus effect change and progress.
Level 1. Do your job well
Trust develops when there is experience and history that you are performing quality work reliably. Keep track of the things that are important, and do the things you said you were going to do in the timeline that you promised. These behaviors lay the groundwork for trust and justify your value to the organization.
Doing your job well may not result in a visible change in the way others interact with you. However, in time, the reliability that you are trusted to do what you say you are going to do well gives you corporate “permission” to advance to the next rung on the ladder. You cannot possibly “shake things up” if you aren’t already confirmed to be “doing your job well.”
Level 2. Communicate clearly
Being recognized as a clear communicator is the first indicator that other people will (and are) listening to you. Clear communication is about managing three things: your message, your audience and your delivery. All of these should be considered in the context of what you want the recipient to do when they’ve received your message, i.e. what action or behavior or change are you seeking?
To be successful in communicating clearly, focus energy on planning and preparation. What is the message that you want to communicate? And how will your audience hear it, react to it, and respond to it? How will you adjust your delivery, pace, and format to optimize your message for your audience? Once you ‘know’ what you want to say, spend time on the preparation to ensure that it is clear and impactful. In other words, don’t skip the planning.
You know that you’re succeeding in communicating clearly when you are increasingly asked to review other people’s communications or be the spokesperson for their messages. Being asked to explain or simplify or clarify other teams’ messages to an increasingly broad audience is an indicator that your style of communicating is clear and effective.
◈ Start with the self
Before you can excel outwardly in your leadership role, you must be able to do the things that are uniquely within your control well.
When you do, it’s time to widen your corporate aperture and consider the people around you. The next three items are all about interacting with the people around you.
Level 3. Be easy to work with
A key part of cybersecurity is being a problem solver. The opportunity to solve broad cross-functional problems is a direct correlation to people wanting to solve those problems with you. Be easy to work with.
Two key points make you easy to work with:
Be responsive
Being responsive is balancing how urgently and how specifically to react to every request. When people feel like they can rely on you, they are more apt to involve and later partner with you. This will require organizing your day to ensure that you have time to react.Assume positive intent
People want to work with colleagues that they feel are on their side and invested in their success. Regardless of the tone that they bring to you, assuming positive intent will disarm and reduce friction quickly to accelerate outcomes.
Level 4. Take feedback, openly
Let’s be honest. Taking feedback is rarely comfortable. However, if we never receive feedback, we aren’t able to tune our operating model to the environment.
When you receive other people’s feedback graciously you indicate to them that you’re interested in tailoring your style to them and the environment. You are showing that you care.
Tip: Don’t know how to ‘start’ getting feedback… then ask for feedback soon after a meeting or presentation. Ask for it to be shaped in a constructive manner that will help you improve your effectiveness.
Level 5. Add value
Adding value is doing something that may not specifically have been asked of you but that would benefit the organization or department. To continue to expand your impact, think about how you contribute that benefits the overall enterprise. Adding value in the Corporate Operating Sequence means delivering beyond your immediate scope of expectations. You are doing things that will elevate and improve the day-to-day of colleagues and adjacent functions. By all accounts, you’re “exceeding expectations” of your core role.
When you add value, you are showing your value to the enterprise, to other teams. Rather than telling them what to do, or asking them for something, you’re giving them what they didn’t know that they were missing. You’re showing that you care about the people and environment around you. This will help advance your corporate impact.
Tip: It’s not uncommon that the newest members of the team may find opportunities to add value quickly because they are looking for resources they expect to find and proactively build them and share them with others.
◈The people around you
By being easy to work with, taking feedback well, and adding value, you expand your circle of influence as well as build trust and earn respect from your cohort.
It’s important to note that receiving feedback comes separately and distinctly before delivering feedback. Remember, this is a sequence, prove that you can receive feedback and then add value. Delivering feedback is coming up next.
Following the Corporate Operating Sequence, we start with doing our job well in the context of the environment. In levels 3 through 5 we focus on impacting the people around us. It is now appropriate to consider connecting more broadly with the ecosystem of the corporate environment.
Level 6. Share feedback
Sharing feedback is both an art and a science. As an art, it requires that you’re attuned to the recipient. As a science, consider the construct for how you organize and share your comments. When done well, others feel enriched and will seek more. In this way, sharing feedback increases your influence and potential impact.
Some key points to keep in mind are:
Consider starting with positive feedback — Recognizing positive qualities and giving words to another person’s impact (on you or the environment, or the work product) will accelerate trust. It is also a good way for the feedback-giver and feedback-receiver to build rapport. Feedback, in the corporate environment, is both to drive change but also to reinforce good practice.
Time, Place, Duration — Feedback should be recent and fresh. Consider the format and environment when you’re delivering it.
Level 7. Connect the dots
At this stage, you are trusted and have influence. Continue to widen your aperture and boldly (because you haven’t necessarily been asked) connect parts of the organization for the purpose of accelerating an outcome, sharing a vision and collectively driving an initiative forward.
Knowing what’s happening across functions and sharing the right information to accelerate momentum and harmony is viewed as a positive and valued contribution.
Level 8. Belong
Another way to think of this level is to be-long. Be in it for the long term. Demonstrate, through action, that you’re committed to the culture and people of the organization. You’ll naturally become a steward of the company. You might get involved with campus recruiting, or an affiliate organization like, “Women of Acme,” or “Acme’s Veterans.”
Your actions to demonstrate that you want to belong will distinguish you. It’s also a turning point. You like where you are. You belong. You are visible, and your values align with the values of the organization. This further strengthens trust and establishes influence.
◈ Connect with the environment
When you connect with your environment, you are connecting your success to the success of the corporation. You are taking the time and investing the energy in a way that improves other teams because you see yourself as a beneficiary too. When you demonstrate that you want to attach your brand to the brand of your organization, then you are actively demonstrating that you want to be-long.
Essentially, you are confirming that your vision is aligned with the future vision of your organization. You are being trusted to speak for the company and it feels good.
◈ Before progressing to levels 9 and 10
The order in which these steps are presented matters. We purposely kept the next two levels last on our list. They are also optional. You’ve already figured out how to succeed in the Corporate Operating System of your organization. It’s okay to stop here. It’s also expected that you’ll take your time and consider waiting before charging forward to Levels 9 and 10.
Level 9. Challenge the status quo
While it may be obvious on your first day that significant change is the answer, suggesting them too soon would be ineffective. Challenge the status quo too soon and you risk being ignored quickly — or worse, alienated for the future. After all, “what gave you the right to…?”
Anyone can challenge the status quo, but to be successful in effecting change and improve your likelihood of receiving a positive reaction, wait. Wait. Wait until you have built a track record of being effective and connected to the enterprise. Wait until you know how and when to present it in your environment.
Success in challenging the status quo will unlock significant value for your company and earn you trust with leaders and peers. Challenging the status quo sounds like: “Why do we?” “Couldn’t we just?” “What would happen if?”
Level 10. Challenge yourself
At the end of the day, real growth comes when we allow ourselves to take risks. We increase our chances for success (and, importantly, also happiness) by challenging ourselves at the right time. If you’re doing your job well, by connecting with your work environment, and by being effective in changing the status quo, it may be time to take on a bigger challenge.
Whether the opportunity is presented to you, or it’s joked about over a family dinner, consider it seriously if you have completed the first 9 steps successfully. Challenge yourself to try something new or different that draws on the skills you’ve developed. Perhaps that’s a new title, a new job, a new industry, or a new country. Go ahead and challenge yourself to take the risk. You are ready.
Everyone doesn’t necessarily want to take on uncharted challenges — they are also wildly successful in their Corporate Operating Sequence. Afterall, they are likely happy with where they are, and how they are perceived in the organization. Belonging feels good. And knowing that you fit in for the long haul feels secure. However, if the opportunity arises to challenge the way it’s always been done, or to take on a broader challenge, know that you are supported and prepared.
Conclusion
The Corporate Operating Sequence presented here is a guide to being successful in the corporate ecosystem. Being successful at corporate, enables security leaders to be more effective at driving security because of the trust they’ve earned. While every organization will feel and operate differently, the levels of the framework build on one another and progress from things within your control to expanding your sphere of interaction and ultimately your sphere of influence.
The Corporate Operating Sequence:
