CIO vs. CISO: Resolving the ROI-versus-risk conflict when you hold both

About this episode

For years, Georgeo X. Pulikkathara saw combining the CIO and CISO roles as a conflict of interest. A CIO manages toward ROI, and a CISO manages toward risk. Then he joined iMerit Technology as CISO, and the role came with infrastructure responsibility attached. His solution was to take the CIO title too and fund security controls directly from that budget. In this episode, he makes the case for when holding both roles works.

Part of what makes it work is how he asks for money. He doesn't bring risk scores to the board. He ties every security ask to a specific revenue deal and puts three options on the table: the premium version, the cheap version, and the one most organizations actually choose. That way, he never has to go back for emergency funds mid-year.

He built that fluency before stepping into the dual role, through Southern Methodist University's Tech CxO Excellence Program. He also keeps IT close to revenue by coaching his IT leads over a back channel during live client calls.

‍

Georgeo spent 26 years in the US Army Reserve, and he's brought a military decision framework into his IT org. PFC Romeo stands for Problem statement, Facts (objective only), Considerations (political and emotional), and Recommendations, which always include two real options.

"Two viable ones, not just one good one, one bad one."

He also walks Matt Peters through his tiered security architecture, anchored at Tier 0 with identity and MFA and built on the assumption that attackers have already bypassed endpoint protection tools like Defender ATP. That assumption comes from experience. When an AI company became a client, his team detected 13 North Korean threat actors in a single week, using IP proxies and AI-generated faces to get past HR screening that most organizations aren't built to catch. He also keeps a printed incident response plan at his desk for the day ransomware locks the network.

Georgeo closes with a 2016 interview at Santander Consumer Bank, where the CSO laughed so hard at his prediction that he'd be a CISO within five years that he refused to hire him, and how Georgeo proved him wrong on schedule.

What you'll learn in this episode

• When holding both the CIO and CISO roles is an advantage rather than a conflict
• How to fund security controls directly from the IT budget
• Why board security asks should be tied to revenue deals, not risk scores
• How presenting three options keeps you from asking for emergency funds mid-year
• How the PFC Romeo framework structures team escalations and decisions
• Why a tiered security model should assume endpoint protection has been bypassed
• How North Korean threat actors get past HR screening
• Why you need a printed incident response plan for ransomware lockouts

About Georgeo X. Pulikkathara

Georgeo X. Pulikkathara is the CIO and CISO at iMerit Technology, a global AI data solutions company serving Fortune 500 clients across agricultural AI, autonomous vehicles, medical AI, and government sectors. He brings over 35 years of IT and cybersecurity leadership experience across banking, healthcare, technology, and defense.

Georgeo served 26 years in the US Army Reserve, rising from Private (E-1) to Colonel (O-6) as a Cyber Operations Officer, with a DoD Top Secret SCI clearance. He was deployed twice in combat operations, to Eastern Afghanistan and Mosul, Iraq, and received the Bronze Star Medal twice for his actions in a combat zone.

He spent over 15 years at Microsoft, finishing at the Microsoft Security Response Center, before serving as CISO at Dovenmuehle Mortgage and DataStax and founding GXP Security, a CIO and CISO advisory firm. He holds a BBA in Finance from the University of Houston and an MBA from UNC Chapel Hill, and is currently a doctoral student in Cybersecurity at National University. He holds certifications including CISM, CPSP, and ITIL v3.

Resources mentioned

• Extreme Ownership: How U.S. Navy SEALs Lead and Win by Jocko Willink and Leif Babin
• Trust-Based Leadership: Marine Corps Leadership Concepts for Today's Business Leaders by Mike Ettore
• Tech CxO Excellence Program, Southern Methodist University
• Connect with Georgeo X. Pulikkathara on LinkedIn

About the host

Matt Peters is the CEO and Co-Founder of Fixify, where he's redefining the IT help desk for the AI era. Before founding Fixify, he was Chief Product Officer at Expel and held senior leadership roles at FireEye and Mandiant, where he helped pioneer some of the earliest managed detection and response services.