Marc French — The AppSec CISO

Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader. Drawing on experience running both product and security functions, he explains how delivery commitments change the way risk decisions look. The conversation examines the CISO's communication-heavy day, reporting relationships, alternative career paths, and the growing importance of application and product security as infrastructure becomes code. Marc offers practical advice for people pursuing leadership: understand the business, gain experience outside a narrow security role, and find mentors who will challenge your assumptions. He also discusses programming skills, developing future AppSec talent, and why a title alone is not a useful career plan.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Marc French:
→ LinkedIn

Mentioned in this episode:
→ Boston Application Security Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:09 How Marc's AppSec CISO perspective developed
05:30 Running application security inside product management
08:59 Balancing vulnerabilities and business commitments
10:37 Learning outside a security role
12:36 What a CISO actually does
14:24 Reporting relationships and the org chart
16:15 The limits of a purely technical career plan
18:26 Leadership paths beyond the CISO title
21:03 Breaches and leadership expectations
22:16 Where application security fits
25:02 Advice for aspiring CISOs
29:51 The rise of product security leadership
32:20 Advice for students entering security
35:32 Why programming skills matter
41:21 Finding a mentor