Mind your business: The real secret to career growth

I recently participated in a CISO Ask Me Anything (AMA) on Reddit, where a recurring theme was career progression. People wanted to know how to get promoted, what steps to take to move forward, and how to stand out in their roles. My answer, again and again, was simple: focus on the business.

But... what does that actually mean?

What focusing on the business actually means

Focusing on the business doesn’t mean memorizing the company’s mission statement (though that’s not a horrible idea) or quoting quarterly earnings like you're auditioning for Larry Kudlow’s job. It’s not about sounding impressive or lacing your slides with jargon like confetti.

It’s about connecting your work to the company. Yes, know what the company sells and who it serves. But level up by understanding the drivers, levers, and strategy of the business. Running the same old security playbook without knowing the business context is like repainting your living room when your foundation is sliding. Technically, you're doing something, but you obviously don’t understand the big picture. The real win is when you tailor your technical decisions to where the company’s trying to go and its strategy. What keeps your leaders up at night? What’s on their KPIs? Where do they feel exposed? Answer those questions, and your work suddenly matters in new ways.

Strategy awareness

I once had a director call me and ask how to move into a chief information security officer role. She said, "They don’t respect me." And honestly? She might’ve been right. But it wasn’t because she lacked talent—it was because she hadn’t made the jump from executor to strategist.

I asked her, "What are your company’s top three strategic goals this year?" She paused. Then admitted she didn’t know.

Here’s the thing: if you want a seat at the table, you can’t just wait to be handed a fork. You need to bring something to the meal—context, insight, direction. Doing the work isn’t enough. You must understand the bigger picture and help the business figure out what work actually matters.

Being an order taker won’t get you there. You need to show that you’re thinking ahead, connecting the dots, and helping lead the way. That’s how you earn trust. That’s how you get taken seriously.

Understand your industry

Focusing on the business doesn’t stop at the company’s four walls. You also need to understand the industry you’re in and keep a finger on the pulse of what’s happening outside. Markets shift. Competitors pivot. Regulations change. If you're not keeping up, you’re falling behind—and so is your advice.

I knew my company was heading for a round of layoffs a full two months before anyone said a word. Not because someone leaked it—but because I was paying attention to what was happening in our industry, tracking macro trends, watching similar companies, and feeding my brain with external signals. That foresight let me quietly prepare my team—not by fear-mongering, but by reinforcing stability and focus. And when the layoffs came, they were more ready than most. It also gave me a better seat at the table when decisions were being made, because I wasn’t shocked—I was informed.

When you combine internal alignment with external awareness, you don’t just react better—you lead better.

Speak business fluently

Here’s the spicy truth: if you want to be a CISO—or really, any senior leader—you have to be more than the InfoSec Gandalf. You need to understand the language of business. That means getting familiar with terms like Customer Acquisition Cost (CAC), EBITDA (which is not a Scandinavian death metal band), Return on Investment (ROI), and Lifetime Value (LTV). If you hate spreadsheets, get over it.

Understanding the numbers is part of understanding the business. Know how to read a P&L, what the budget pressures are, and how to show that your brilliant new security initiative is going to bolster the company, protect revenue streams, or keep regulators off your back (ideally all three).

Good strategy and bad strategy

In his book Good Strategy/Bad Strategy, Richard Rumelt explains that good strategy starts with a diagnosis: what’s the real challenge here? Maybe it’s churn, scaling, compliance, market competition. Focusing on the business means going beyond the buzzwords to understand the root problem.

Next comes a guiding policy: a general approach for tackling the challenge. This is where your leverage comes in. How can your work—your team, your tech, your time—be applied with maximum effect? Strategy isn’t a luxury reserved for VPs. Everyone can play the game. (Pro tip: those who do, get promoted.)

And finally, coherent action. This is where people often trip up. If your plan to get noticed is “do more work,” congrats—you’ve just volunteered for burnout. Instead, do the right work. Work that solves business problems. Work that gets noticed because it makes things better, faster, cheaper, or safer. Bonus points if it also makes someone look good in a board meeting.

Go from busy to essential

Your ability to connect your work to what the business actually cares about is what gets you noticed—and keeps you relevant. Your title might be security analyst, but your real job is translating what you do into outcomes that matter to the business. That means shifting your thinking from "What did I work on?" to "What did I change for the better?"

You’re not just there to check boxes and close tickets. You’re there to protect what makes the company money, smooth out what slows it down, and support the things that help it grow. Imagine you're the security version of a Swiss Army knife—quietly essential and ready for whatever’s thrown your way. Instead of saying, “We patched the thing,” you’re saying, “We eliminated a vulnerability that could have knocked out our customer portal and cost us hundreds of thousands in downtime.”

Take this as a before-and-after moment in my own growth. Right now, I’m working with a global company that’s expanding its AI capabilities. That means helping them build a smart, scalable AI compliance framework that works across multiple jurisdictions without setting their budget on fire. Because I understand their business strategy and global footprint, my recommendations aren’t just secure—they're useful, sustainable, and tailored to help the company grow.

Now contrast that with early-career me, who once sent out a mass email telling everyone not to use hotel Wi-Fi. Why? Because it’s risky. But did I offer a better option? Nope. Just vibes and warnings. This was a company where executives traveled constantly, so all I really did was stress them out and create confusion. I hadn’t yet learned to connect my advice to how people work or what the company needed. I was trying to do my job well, but I didn’t yet know how to make my job helpful.

Reporting that matters

When you level up, your reporting should too. Executives aren’t asking, “How many phishing emails did we block?” They’re asking, “Are we safe?” and “How do we know?” and “How do we compare to our peers?” You need to anticipate those questions and answer them before they're asked. Assume they assume you're doing your job. Now the question becomes: how do you prove that the organization is better protected, more resilient, or more agile because of your work?

If your report to the executive team includes the number of spam emails filtered or how many machines received a patch on Tuesday, congratulations, you’ve officially written a bedtime story for your CXOs.

Translate operational details into business impact. Instead of listing alerts and technical minutiae, present metrics that align to risk reduction, regulatory readiness, business continuity, and financial exposure. Replace "spam filter stats" with "reduction in risk exposure from credential theft." Swap out "firewall hits" for "uptime protection of key revenue-generating systems."

Your reporting should reassure and inform. It should build trust and spark strategic discussion, not confusion or glazed eyes. If you’re not sure whether your report is useful, read it out loud to someone from finance or marketing. If they nod, you’re good. If they nod off, fix it.

Final thoughts

Want to grow in your career? Start thinking like a strategist. Ask curious questions. Follow the money. Pay attention to what your execs worry about and what success looks like to them. Be the person who sees the bigger picture, understands how everything fits together, and shows up ready to move the business forward in a way that matters.

Mind your business, and start thinking like a strategist.

About the authors

Hadas Cassorla, JD, MBA, CISSP has a lot of letters after her name, but the three letters she cares the most about are Y-E-S. Marrying her improv and legal background into technology and business, she helps organizations build strong, actionable and implementable security programs by getting buy-in from investors, the boardroom and employees. She has founded her own business, Scale Security Group, and has built corporate security offices from ground-up.