LevelUp Cyber

The episode contains several substantive ideas about industry maturity, CISO role evolution, and talent gaps, but much content consists of extended analogies, throat-clearing, and repetitive framing. The firefighter metaphor and lifecycle comparison of cybersecurity to law/medicine are genuinely useful frameworks, but they're padded with explanation and restated multiple times, reducing idea density per minute.

“if you look at cybersecurity as a concept, maybe fifty years cryptography aside, but fifty years okay. If you think of us as a child, we were like a five or six year old, okay, And the business are the parents and their first time parents”

“My job is not to try to put the fire out and save the entire company. My job is to save those parts of the company that are critical to the company's continued survival”

While the firefighter analogy is moderately fresh, the core arguments about CISO burnout, shifting from prevention to resilience, and talent shortage mismatches are well-circulated in CISO discourse. The lifecycle maturity comparison (cybersecurity as a six-year-old child) is conceptually interesting but not novel in the industry. Most frameworks and concerns are standard talking points.

“if you look at cybersecurity as a concept, maybe fifty years cryptography aside...we got another twenty five years minimum, okay, to be able to take cybersecurity as a concept and as a set of tool jockeys, and to establish a true profession”

“My job is to save those parts of the company that are critical to the company's continued survival...then you worry about the collateral damage to the house or the rest of the company”

Zalewski is a former CISO at Levi Strauss with 23-24 years in cybersecurity and prior software engineering background, plus current investor/advisor roles in the security community. He has operated at scale in both product and security roles. However, he's now in an advisory capacity rather than active practitioner, which slightly limits recency and depth of current operational constraints.

“I've been in cybersecurity probably about twenty three twenty four years. It was not my first career, so I spent the first half of my career building product right. I'm a software engineer by trade”

“I joined Levi Strauss and just tried something new again, which was you know, retail, and I tell people it is women selling genes to women, and was there for six years chief Security Architect, Deputy c SO/CISO”

The episode lacks concrete examples, named companies (aside from brief mentions of Kaiser Permanente, PG&E, and Levi Strauss in biography), specific metrics, or data. The talent shortage discussion is abstract ("million jobs," "budgets increased twenty thirty percent") without named sources or detailed case studies. The insights are largely conceptual rather than evidence-grounded.

“budgets were increasing twenty thirty percent a year, Teams were increasing the you know, new is talking about all the cyber attacks coming out in North Korea or Russia”

“a lot of companies can't carry the size of those cyber security team. It's just not economically viable right now”

The host asks reasonable open-ended questions but rarely pushes back, challenges claims, or probes for specifics. Zalewski's long monologues dominate; the host largely validates and reflects back rather than interrogating. There are few sharp follow-ups or moments of productive tension. The conversation feels more like a collegial chat than a rigorous interview extracting maximum insight.

“That's a great answer. So I want to kind of dive into some of the SISO stuff you alluded to”

“I like it. We mentioned a little bit earlier around just the idea of the entry level, right”