There is a Persian proverb that fits here perfectly:
“Every walnut is round, but not every round thing is a walnut.” «هر گردویی گرد است، اما هر گردی گردو نیست»
Two things can look the same from the outside and be completely different inside. Job titles work exactly like that. Someone’s title does not define them, and it does not define what they know.
Same title, different animal
We think words like senior, manager, VP and chief are standard. They are not. Every company gives them its own meaning based on its own culture, and the gap between two similar titles in two different organizations can be huge.
Information security and cybersecurity make it worse. This is a young field. There is no common rulebook for what a “Senior Director” is or what a “Chief” does. So when we read a title from another company, we translate it using our own culture, without knowing how that company hands out these words.
Remote work made it worse
Most collaboration today is online. You never shake the hand of a peer from another company. You never see their body language, and even with the camera on (which is getting rare), you only get a small box on a screen. So what is left? The title. We lean on it because it is the only thing we have.
What I have seen
I have seen a “commander” of a department who was just a people’s manager. Which, by the way, does not make anyone a leader. A title will not make you a leader, and every company has its own idea of what one looks like. Anyone can Google it or ask ChatGPT for the features of a leader. That is not the point.
I have seen a simple security analyst, sitting maybe six levels below the CISO, who was one of the most thoughtful and knowledgeable security professionals I have ever met.
I have seen senior directors in security who talked well and understood nothing. It shows very fast. Just watch them struggle to connect two simple dots of computer security.
I have seen an SVP of Security who was only a bridge. Get the budget from the C-suite, spend it on security infrastructure, done. And I have seen a SOC analyst who understood what a security incident does to the company’s mission better than any CISO I have met.
Flip it around
Now think about me, in one company, with the right connections, some lobbying, zero credibility and zero results, I could end up as a CISO. All because of that company’s perception and culture. In another company, I would be lucky to get hired as a Cybersecurity Apprentice. Same person, same brain.
“A label on a jar tells you what is written on it; it does not show the quality of the materials inside.”
So what do you do
Next time you deal with a peer from another company, a vendor rep, or anyone in digital tech, do not assume their seniority, their knowledge or their capabilities from the title. Do not be intimidated by it either. The differences between companies are huge, and they are real.
There are simple signs to look for, in your own org, with vendors, with peers, in meetings, in conferences, even in emails. But that is a different story for a different time.