Education in a particular field of science is a good and often necessary thing, but that won’t provide the management skills required to run a security operation — that only comes with many years of experience in the field.
I’m not at all saying she’s not accountable. My point concerns the focus of failure which to me is a failure.
I’m not saying her security team must have a stellar educational background. Still, it wouldn’t hurt. As I alluded to earlier, at each management level, you need to be able to describe your process and make it clear you did your best to avoid problems.
How do you as mid a mid level manager justify hiring someone without a degree to lead a Security Department? The department manager’s qualifications would come into focus during any investigation. There’s enough blame to go around if the person does have an immaculate record, but if they don’t have a top level degree and resume, how can you expect the board or your supervisor to back you?
A good hire for direct hands on security could easily be someone without a degree, if they had 15-20 years management in the field, coping with similar concerns, with no major breaches, and also exemplary forward thinking objectives and goals.
Equifax is a top level concern, one of perhaps two or three major vendors in the field. This level of this enterprise demands absolute top rated talent.
Thanks for the comments. I agree with some of the things you mention.