Lead Under Pressure | Konrad Fellmann

The conversation frames cybersecurity leadership less as a matter of issuing restrictions than of helping an organization make sound progress under pressure. Host Bob Hansen begins with Konrad Fellmann’s early relationship with technology: a father who was an electrical engineer built computers in the basement, where Fellmann learned BASIC and saved programs to tape. That curiosity survived a detour into civil engineering—he says statics and dynamics convinced him to switch to computer science—and it eventually led him to the U.S. Marine Corps through an ROTC scholarship.

Fellmann served four years as a logistics officer, during peacetime in North Carolina and Yuma, Arizona. While still in the Marines, he completed graduate study in computer information systems in preparation for an IT career. His first civilian work was coding, but he wanted a different sort of challenge and moved into cybersecurity, a field he describes as still developing at the time. The career story matters here because it establishes the combination of operational experience, technical grounding and service orientation behind the leadership principles that follow.

The Marine Corps did not, in Fellmann’s telling, produce a caricature of command-and-control leadership. Instead, it gave him perspective. During a cyber incident, the leader’s behavior sets a working temperature for everyone else: panic spreads, while calm creates room to reason through the problem. He pairs that restraint with the obligation to care for and mentor the people doing the work. Teams, he argues, are not a leader’s audience; they are the expertise and capacity that make a response possible. That view also checks executive ego: the right move is to involve the person best equipped to decide or solve a particular issue, rather than pretending one leader can do everything alone.

His move from consulting into an executive security role was driven by a desire for accountability after the assessment. For roughly 12 to 13 years, he conducted gap assessments and returned to see some recommendations still unresolved. He wanted to own the hard part—building a program, aligning people around remediation and seeing the outcome. He uses a camera-aperture metaphor for the intellectual shift required to lead: early technical roles demand intense focus on a control, vulnerability or alert; executive work requires widening the frame to include revenue, user experience, operations, competing priorities and board expectations. Security can no longer be assessed in isolation from the business it is intended to protect.

That broader view is behind the episode’s central challenge to the stereotype of security as the department of no. Fellmann says that when a colleague requests something risky, the security team should not merely reject the requested mechanism. It should understand the desired outcome and help design a safer path to it. A request to open a firewall completely may be impossible to grant, for example, but the underlying access need may have a narrower solution. This is not a claim that risk vanishes; it is an argument for guardrails that let the business keep moving. His experience in consulting helped him develop the habit of asking questions, extracting the real problem and working toward a solution with the stakeholder rather than across a ticket queue.

Transparency is the companion principle. Fellmann recounts a formative mistake in his first CISO role: he did not escalate an issue that initially appeared minor, and later information made it a larger executive concern. The lesson was not to polish reporting until every measure appears green. Sanitized metrics obscure risk, prevent leaders from understanding what needs attention and make a future budget request harder to justify. Candor must therefore be paired with a solution or plan, not used as an excuse to hand someone else an unsolved problem. He also links good culture to direct conversation: a call or meeting can carry context and emotion that text alone frequently loses.

When the discussion turns to AI, Fellmann takes a deliberately unsensational position. He sees value in generative tools for individual productivity, such as refining the tone of a message or brainstorming a complicated problem. But he cautions against treating AI as a reason to buy a stack of new security products while basic disciplines languish. Identity controls, multifactor authentication, password practices, attack-surface awareness and visibility into how employees use AI remain the practical starting point. The question is not simply whether AI is dangerous; it is whether the organization can see and govern the routes through which risk enters.

Manufacturing sharpens that operational lens. Compared with financial services, he notes, the data profile may differ, but patches and controls cannot be allowed to stop production lines. He is interested in AI’s potential to improve supply-chain work, including bill-of-materials-related decisions, and in autonomous robots taking on menial tasks. Yet the episode consistently returns to context: technology adoption must support the work the business actually has to complete.

The closing mentorship discussion makes the episode more than a CISO playbook. Fellmann did not describe having formal early-career mentors; he learned partly by observing senior consultants. Now he gives time to veterans moving into IT and to a San Diego organization helping autistic people prepare résumés and interviews. His practical advice is to seek people with shared interests on LinkedIn, meet them at local events, ask for help and make time for mentorship with one’s own manager. An Officer Candidate School anecdote about missing a packing-list detail provides a light but fitting conclusion: sound leadership still begins with reading the instructions, noticing the details and being willing to learn.