“If you want to keep [those department heads], think like a founder, not a function. Give them ownership, not just oversight. People stay when they’re building something that matters, not just protecting something that might break,” said de Silva, who until last year was the global head of compliance testing at Citi, a role he held for seven years. “Retention isn’t about perks. It’s about purpose. If your team has no voice in shaping security culture, don’t be surprised when they find a company that gives them one. They want agency, not just direction.”
Although burnout is often seen as a driving force behind job dissatisfaction, de Silva disagrees.
“The problem isn’t burnout. It’s the bottleneck beneath the CISO. Mid-levels are carrying risk without being allowed to lead. If the only way forward is more pressure with no growth, they’ll leave,” de Silva said. “Drop your top performers into cloud, fraud, or ops. It signals trust, builds range, and keeps them engaged. Boredom is a bigger flight risk than burnout.”
