Cezary Piekarski has spent almost eight years at Standard Chartered, joining the bank in 2019 as head of malware protection and network security before taking on a succession of increasingly strategic cybersecurity roles.

That journey, from highly technical security responsibilities to his current position as group CISO, has given Piekarski a broad perspective on how the role of the CISO is evolving alongside the technology and threat landscape.

Today, Piekarski has end-to-end accountability for cybersecurity risk across Standard Chartered, spanning technology security, business and process security and a range of threats facing the financial institution.

In this interview with Infosecurity Magazine, he discusses the changing role of the CISO, the need to build security controls ahead of technological adoption, the importance of securing the wider ecosystem and why, in cybersecurity, “staying restless” remains essential.

Infosecurity Magazine: What is Standard Chartered's definition of a Group CISO?

Cezary Piekarski: CISOs come in various flavors, shapes and sizes. This role can be very diverse and impactful and take different shapes across organizations. 

In Standard Chartered taxonomy, the Group CISO role means end-to-end accountability for cybersecurity risk across the totality of the group in all the locations in which we operate. This accountability spans both technology security and process and business security for all cybersecurity-related threats.

It's a lot of work, but at the same time it is a very rewarding place to be, both from the business perspective and the challenges that the financial industry is facing now in cyberspace. 

What is quite unique about the construct that we run in Standard Chartered is that we are huge proponents of the fusion concept, in which we run together various threats that converge from the criminal activity perspective. For example, I'm accountable both for cybersecurity risk and part of the financial crime risk encompassing economic crimes within the organization.

This means my teams can work on threats from the use of growing technologies alongside traditional threats to the financial sector, and they can respond to those threats better and in a more integrated way thanks to several teams working together. 

IM: You contributed to a World Economic Forum white paper on how CISOs are becoming strategic business leaders rather than purely technical defenders. Would you say you're more of an operational or strategic CISO?

CP: I was very fortunate in having an opportunity to contribute on multiple roles at Standard Chartered, starting from very technical roles. In my first role, I was accountable for endpoint security. Then moving through various technical and less technical roles gave me an opportunity to build a more strategic outlook, going beyond technology risk.

Nowadays, CISOs cannot choose to limit their function to a technical or operational role - especially in the financial industry, where cybersecurity is one of the key operational risks that we manage.

Banking is fundamentally a technology business nowadays, or at least a technology-enabled business. So, you need to be a very strong technologist to be great CISO, but you also need to understand banking strategy, and especially the evolution that is happening. Whether it comes to payment rails, digital assets, and everything that helps the growth of the banking business.

In finance, cyber risks are intimately connected to the way we build our business product offering and provide partnerships and, therefore, CISOs need to operate on the strategic level across the organization - becoming a trusted partner in discussions about our businesses and their evolution and to be very well versed in technology, its risks, and details of how we operate our cybersecurity controls.

Today's CISO is one of those roles in which you need to quite seamlessly move between your engineering domain, your security operations, and the boardroom, the business leaders.

I'm quite fortunate because in pretty much all layers of this organization, cybersecurity is a top priority, and you can have equally rewarding discussion with our board members, management team members and our teams across the company.

IM: The financial industry is one of the most heavily regulated sectors. How does this reality influence your role?

CP: For us, regulations are a license to operate. Nevertheless, I think it is extremely important to add that just meeting your regulatory obligations is not good enough. 

What you really need to do is to raise the bar for yourself and ensure that you not only rely on your compliance requirements, but you have very good understanding of the threat landscape, evolving technology ecosystem and evolving partnerships that your organization builds, as well as your clients and their needs and their risks, and how all of this comes together to be an efficient and effective leader in this industry. 

Therefore, while we have a very strong relationship with our regulators across all the markets in which we operate, we always make sure that we continuously raise the bar for ourselves, whether directly for us only, for the ecosystem or within the industry, to ensure that we stay ahead of the threats, not simply meet the requirements.

IM: What are the cyber threats that are top of mind now?

CP: I'm in one of those jobs in which you are paid to worry, right? So, there is a lot of things that I just keep thinking about.

Obviously, AI models and AI agents became extremely effective in exploiting some of the key weaknesses and vulnerabilities in technologies we use. We are looking on this risk as one of the most important risks out there, not only to the banking industry, but more broadly. Because when you think about how the ecosystem is changing, organizations like Standard Chartered do have the resources, commitment and will to stay ahead of the threats as they evolve, but not everyone out there have the same resources, focus and skills that are needed to be ready for those threats. 

Thus, our thinking is dedicated to how we help others, how we help the ecosystem to move along at the pace that will be sufficient to meet those emerging threats. 

What we are also observing is that the banking system, or more broadly the financial system, is to some extent getting rewired with product offerings like digital assets, but also in a sense that our clients interact differently now, whether with e-commerce and through their own adoption of AI - such as payments via AI agents. This changes the way you lookon transactions and on behaviors in digital channels, and this then poses additional challenges to the organization.

I would say that this technological disruption, and then the ripple effects of that, whether in terms of direct threat to the ecosystem, but also the changing behaviors of your customers, and therefore changes to the product offerings and how those products are being used, is what keeps me very busy and focused.

IM:  What does success look like as the Group CISO of Standard Chartered? 

CP: In cybersecurity, it's easy to see that your mission is relatively simple, you are ultimately here to protect your clients, the trust they have, and this trust can be translated into resources. Some of those resources are their dreams, their hopes, their savings for education of their children. So, in this sense, there is a very clear link between waking up, doing this job really well and delivering benefits that are clear to your clients, to your organization. When this happens, this is a success.

There is a sense of mission and drive behind this job, but more broadly, we need to stay very humble in this space because cybersecurity punishes people who are overconfident in what they do.

Still, we need to acknowledge things that went well and that we can be proud of, whether this is a new evolution of our business model, a particular product that we created, a specific cybersecurity capability that we see as innovative or simply outstanding on the market. To channel this confidence in a productive way, you always need to stay restless in this job and focus on continuously protecting your clients, because the moment you stop, the moment you are too self-confident, is the moment you lose. 

IM: What's your approach in cybersecurity solutions procurement within the company?

CP: There are two parts to this question. First, there is the question of security capabilities, which is in my remit. I'm accountable for running foundational cybersecurity capabilities for the organization, so in this sense, I'm my own CIO, and we found this model particularly effective, where we run both the operations and underlying technologies and platforms.

This helps with ensuring that not only cybersecurity is an independent source of truth, but also that we can iterate it rapidly in our product offering to ensure that we robustly convert insights, intelligence and signals into the continuous improvement of our foundational technologies. I think this model is one of the key ingredients in running a very robust security organization. 

The second part to your question is that, at the end of the day, security is not something that you can do yourself and just run and be happy about it. The other half of my job is making sure that we move with our technologies in a secure way, and that our architecture, including our security architecture is making us resilient, now and in the future. There is not a single recipe for this. It's a lot of discussions, a lot of planning, a lot of foresight, but also a lot of experiments with technologies that are available out there to ensure that we run the model that is economically sustainable, effective, scalable and ready not only for what we see now, but also for what we anticipate in terms of threats and evolution of our technology footprint. 

Say, for example, that you want to use your AI agents in a secure way in the future, then you probably should have started building your control environment around agents a year ago.

This disparity between the appetite of the businesses to innovate and your ability to build the foundational controls for it is something that requires CISOs to be always thinking about what's next. The better the whole organization is in articulating what's next in the technology landscape and aspiration from the business perspective, the better the job of the CISO can be because then those horizons align, and you can build for what is the future of the organization and its technological footprint.

IM: Standard Chartered runs the SC Security Centre, a cybersecurity service for your Straight2Bank customers. What is it exactly and what is role within this offering?

CP: I would like to broaden this slightly because the Security Centre is just one of the examples of our client partnerships and education that we do for our broader client and third-party ecosystem.

The reason why we did it, and why we continue investing in this, is that we realized that securing the bank is about securing the ecosystem, and this ecosystem is not only our suppliers. It is our clients, our partners, partners of our partners, so you can cast a really broad net.

We want to cascade some of our capabilities to this ecosystem, because they typically face the same threats we face.
IM: You are based in Singapore. How does it shape your practice? 

CP: On a personal level, Singapore is a great place to be and explore a very diverse set of cultures that are present here.

Then, our business is very much focused on emerging markets - some of the most exciting markets in the in the world. Being in Singapore gives us great time zone coverage for many of those markets, but also an opportunity to connect with our colleagues and clients frequently. 

Also, plenty of our key talents are nearby here in Singapore, Malaysia, India and China.

IM: It is reported that AI is making it harder for entry-level cybersecurity professionals to find their way into the industry. Is that a challenge for you? And if so, how do you overcome it?

CP: We are lucky to be present in some of the markets in which there is an abundance of talent. I already mentioned some of those markets, but I would add Poland, where we have a very large hub dedicated to cybersecurity - among other things. 

Those markets give us access to some of the wisest, best and most experienced people across the market, but it is also a proper funnel for entry-level talents in this space. So, we are not complaining about availability of talent, but I think in some sense you are right, the profiles and the skills are changing.

However, cybersecurity professionals in the past and over the years have proven to be very good in adapting to new technologies, threats and opportunities that are out there. I see no reason why it would be differently this time.

Image credits: Rocis / RidhamSupriyanto / Shutterstock.com