Table of contents
About this episode
Don Silva Sr., Chief Information Security Officer and VP of Cloud and IT Operations at Raintree Systems, has guided security programs through numerous acquisitions. Before a deal closes, he works to understand the other company’s risk appetite, and he doesn’t take security claims at face value. A company calling itself “HIPAA compliant” means little until you’ve checked the controls behind it.
That approach reflects how Don sees the job. Security leadership is a business role. A board doesn’t want the technical breakdown. It wants to know what a risk costs and whether the company can live with it.
“All they really want to know is what the risk is, how it’s going to impact revenue.”
So Don frames every risk in dollars and risk appetite. When a full fix will take time, he puts a compensating control in place to buy time until it ships.
He walks Matt Peters through his climb from pulling cables on the third shift at Sun Microsystems, where he worked as a Unix and Solaris administrator, to the CISO seat. He fell into security during his years at PayPal, but one lesson from Sun’s customer support training has stayed with him. Security teams say no a lot, and what matters is how you package it. Don’s team is not the Department of No.
“I hear you. Here’s what I can do for you. Here’s what I need from you.”
Don also explains why the best technical leaders don’t need to be the smartest person in the room. Their job is to spot the smartest person, then get out of the way. That’s why he hires for attitude and fit before raw skill, and builds teams that complement him rather than copy him.
“I’m clearly not the smartest person in the room. Most of the time I’m in there to corral everybody and to help lead discussions and to empower people to make those decisions.”
What you’ll learn in this episode
- What an acquisition looks like from the CISO seat
- How to read a company’s risk appetite before an acquisition
- Why “HIPAA compliant” means little until you check the controls
- Why security leadership is a business role, not a technical one
- How to frame security risk in dollars the board will act on
- How compensating controls buy time until a full fix ships
- How to turn a hard no into a partnership
- Why leaders should spot smart, not be smart, and hire for attitude
About Don Silva Sr.
Don Silva Sr. is the Chief Information Security Officer and VP of Cloud and IT Operations at Raintree Systems, an AI-powered EMR and practice management platform for physical therapy and rehabilitation organizations. He started his career on the third shift at Sun Microsystems as a Unix and Solaris administrator, pulling cables and running data centers, before moving into security during his years at PayPal.
Over his career, he has led security, cloud, and IT operations at companies including PayPal, Integrate, WebPT, and SimonMed Imaging, and has guided security programs through numerous acquisitions. His work spans HIPAA, SOC 2, PCI, GRC, cloud security on AWS, and AI governance.
Resources mentioned
- The 7 Habits of Highly Effective People by Stephen Covey
- Extreme Ownership by Jocko Willink and Leif Babin
- Raintree Systems
- Connect with Don Silva Sr. on LinkedIn
About the host
Matt Peters is the CEO and Co-Founder of Fixify, where he’s redefining the IT help desk for the AI era. Before founding Fixify, he was Chief Product Officer at Expel and held senior leadership roles at FireEye and Mandiant, where he helped pioneer some of the earliest managed detection and response services.
