Kamal Sharma joins Vandana Verma to share lessons from a career spanning traditional networks, service delivery, GRC, and CISO leadership. Their conversation focuses on continuous learning, earning board support, and building a security program after a breach.
Kamal began his career in the late 1990s with TDM multiplexers and voice and data networks, then moved into IP networking and network security. Work with BS 7799, an early information-security standard, introduced him to governance, risk, and compliance. He later led regional and global service delivery, spent roughly a decade working in the Gulf, and served as both a cybersecurity services leader and CISO.
His career included significant highs and difficult periods. After returning to India, he faced personal and professional challenges and found that his profile and earlier achievements did not automatically create the next opportunity. A better role in 2018 marked a new phase, but it also exposed an important lesson: during a comfortable stretch, he had stopped keeping pace with technology.
Cloud security highlighted the gap. While leading a young team through a cloud assessment, Kamal suggested bringing in outside experts because even he found the environment difficult. His manager challenged the assumption that the younger team could not learn it. Kamal treated that moment as a trigger rather than a verdict.
He went on to study AWS, Azure, and several security frameworks and certifications. Reading, podcasts during long drives, conferences, and active participation in communities became part of his routine. He is candid that no leader is ever fully updated, but consistently showing up creates opportunities to learn from experienced peers and younger practitioners alike.
The struggle for security investment has not disappeared. In one CISO role, Kamal joined after a breach, which created immediate awareness but did not remove the need for a business case. His team assessed the current posture, identified gaps, and built a roadmap that connected security improvements with customer expectations.
Customer requests for ISO 27001 and CSA STAR assurance provided evidence that security could influence revenue and trust. Regular management updates then showed what attacks were occurring in the industry, how affected organizations recovered, and why the same risk could reach their company.
The team also brought options rather than a single expensive demand. By comparing the security value and cost of different approaches, they showed that they had performed due diligence and were protecting company resources as well as systems.
Kamal recommends beginning with the environment: understand its systems, controls, risks, and operational ownership. In his case, IT had been managing antivirus, firewalls, and other basic measures because there was no dedicated security function. He also reviewed recent customer RFP responses and discovered a gap between controls customers had been told existed and what was actually in place.
Leadership awareness sessions explained how the proposed program would protect the company and support sales. Each of roughly 20 departments nominated a representative, creating a virtual security team of about 25 people who could carry initiatives into their own functions.
The program used ISO 27001, CSA STAR, and SOC 2 requirements to organize the work. Although compliance alone is not security, Kamal argues that implementing a framework in its proper spirit can produce meaningful protection. The approach took time but helped stabilize a company that had previously experienced breaches.
Future CISOs need broad conceptual knowledge and deeper expertise in at least one area. GRC is especially useful because it teaches leaders to discuss risk in business terms. Yet technical and governance knowledge are not enough: hiring, developing, and retaining the right people are core leadership responsibilities.
Communities help leaders find talent, exchange experience, and support the next generation. Kamal credits strong teams for standing by him and believes that helping others grow ultimately expands what a leader can accomplish.
