The Skills That Take You From Helpdesk to Head of Security

Main ideas / lessons

• Career pivoting is possible (and often accidental)

  • Christina starts in help desk/desktop support, then grows into identity-focused security by following what she learns—especially Active Directory concepts.
  • She emphasizes that many people don’t plan their path; they follow opportunities, interests, and adjacent problems until they naturally expand into broader roles.

• Hands-on technical grounding matters

  • Early experience with infrastructure concepts (e.g., network/system administration, legacy systems, then Active Directory) built a foundation that later enabled identity/security work.
  • Even as she becomes more senior/broader, she still remains hands-on due to how her organization operates (“all hands on deck”).

• Identity is a gateway to wider security responsibilities

  • In her early days, “cybersecurity” wasn’t the framing; identity and access management was part of a larger security context.
  • She moves from identity product work to broader security leadership by learning additional domains and understanding how security programs are built.

• Curiosity + willingness to expand beyond comfort zones

  • She repeatedly stresses: don’t limit yourself to “only this one thing.”
  • When teammates/teams come with needs (e.g., onboarding apps), treat it as a chance to learn, connect systems, and become a more rounded problem-solver.

• Community engagement accelerates growth

  • Being active with the community (and having conversations with peers aiming for similar leadership roles like CISO/CIO) helps her understand shared challenges across verticals, including budget constraints.

• Continuous learning must be paced and practical

  • Don’t try to learn everything at once.
  • Use an approach like:
    • pick a tool/topic relevant to current work,
    • build small labs to test features,
    • read docs,
    • then move on to the next learning focus.

• Soft skills are critical (and hard)

  • Skills include:
    • simplifying complex concepts,
    • storytelling,
    • writing documentation/emails,
    • communicating with executives who may not be security/identity specialists.
  • The goal is to explain security needs in terms of business value and reduced friction—not jargon.

• In a fast-changing world (AI/agents/cloud), “doing” is the real teacher

  • Learning by reading/watching isn’t enough for AI/agentic tools; you must use them to understand what works and how it changes month-to-month.

• Adaptability and attitude determine career progress

  • She ties success to being dynamic and pivot-ready—similar to dynamic IP vs static IP:
    • assume change will continue,
    • keep moving,
    • embrace pivoting rather than fearing it.
  • She highlights that generic advice is less useful now; mentorship should be tailored based on a person’s interests and due diligence.

Methodologies / instruction-like guidance

Building a career from identity toward security leadership

• Start with a technical base (even if not initially “security”):
  • help desk/desktop support → network/system administration concepts → Active Directory/identity understanding.
• Pivot using what you already know:
  • if your work touches identity (users, access, provisioning, mailboxes, SSO), use that as a bridge into security.
• Seek adjacent security exposure:
  • use opportunities that naturally arise from your identity expertise (e.g., “joiners/movers/levers” → IAM security roles).

Becoming broader than one product (hands-on expansion)

• Stay hands-on when possible:
  • even at higher levels, find ways to remain involved in deployment/architecture when your org is lean.
• When you encounter unfamiliar security areas:
  • GRC and AppSec are called out as areas she had less practical experience with—she emphasizes learning them quickly when needed.
• Don’t restrict yourself to one identity product/tool:
  • learn related ecosystems and how solutions integrate (e.g., identity with other security tools).

Learning strategy (continuous but not overwhelming)

• Use project-based learning:
  • learn what you need while deploying or working on a concrete problem (e.g., data security tools).
• Pace your learning:
  • dedicate time blocks (e.g., a month or two or 3–6 months) to a visualization/tool topic rather than trying to learn everything at once.
• Choose balance options:
  • niche depth vs breadth + some depth:
    • niche experts risk disruption,
    • breadth helps with cross-domain understanding and leadership conversations.

Community and mentorship approach

• Treat others’ requests as learning opportunities:
  • when teams ask for onboarding/integration help, collaborate to learn the full stack and workflow.
• Engage in leadership-oriented conversations early:
  • talk to people pursuing CISO/CIO roles to understand common constraints and strategies.

Teaching/communication (soft-skill methodology)

• Simplify concepts before pitching:
  • identify what’s distinct,
  • explain step-by-step for non-experts,
  • adapt message to executive audience needs.
• Tie technical changes to business outcomes:
  • explain in terms of friction reduction, visibility/security benefits, and ROI—not just “deploy X tool.”
• Communicate in multiple formats:
  • verbal explanation,
  • emails,
  • documentation.

AI/agentic learning rule

• Move from passive learning to active use:
  • start using tools quickly,
  • measure what works vs doesn’t,
  • account for rapid tool changes (monthly/ongoing updates).

Advice for next generation (anti-generic)

• Don’t give one-size-fits-all instructions like “get 5 certs” as a guaranteed job strategy.
• Instead:
  • ask what the person likes/interested in,
  • check their due diligence and research,
  • tailor mentorship to their situation and goals.

Speakers / sources featured

• Christina Marilo — Senior Director of Information Security, New York Football Giants (main interviewee).
• Krishna — interviewer/host (also described as having worked at Microsoft on identity-related work, and discussing their perspective on Entra/identity career paths).
• Satya Nadella (referenced indirectly as “Satia”) — mentioned as an influence/encouragement about pushing organizations to do more.
• Microsoft Entra — product category/source referenced throughout; not a speaker.
• Microsoft Learn — source referenced as documentation Christina uses.
• John Savile — referenced as an inspiration for simplifying and teaching complex topics.