10 Microsoft security leaders
Microsoft's CISO organization is home, now or in the past, to half of these Microsoft security leaders: Bret Arsenault, CISO until 2024, two deputy CISOs, the organization's CTO and the vice president responsible for the Microsoft Red Team. The rest hold security product and engineering titles or have held CISO roles for Microsoft 365 and Nuance, which suits a security team deciding how to split corporate, product and customer security.
Professionals to explore
Bret Arsenault
LinkedInExperience: Former Corporate Vice President and Chief Information Security Officer · Microsoft
Bret Arsenault was Corporate Vice President and Chief Information Security Officer at Microsoft from 2015 to 2024 and held the title Vice President and Chief Information Security Officer from 2009. Since 2024, Arsenault has been Corporate Vice President and Chief Cybersecurity Advisor, described as CISO Emeritus and Global Chief Security Advisor, the clearest voice here on how Microsoft's internal security program took shape.
Is this you? Claim your profile and get paid for calls.
Chang Kawaguchi
LinkedInExperience: AI Security Architect · Microsoft
From 2017 to 2022, Chang Kawaguchi held CISO titles at Microsoft, first as Director, CISO, Office 365 (2017 to 2021) and then as VP, CISO Microsoft 365 (2021 to 2022). Kawaguchi has been AI Security Architect at Microsoft since December 2022 and was Group Engineering Manager (2014 to 2017), useful for questions on product-line CISO work and securing AI.
Is this you? Claim your profile and get paid for calls.
Craig Nelson
LinkedInExperience: Vice President - Office of the CISO · Microsoft
Craig Nelson has been Vice President - Office of the CISO at Microsoft since April 2024, responsible for establishing and operating the Microsoft Red Team spanning all Microsoft Clouds and infrastructure. Nelson describes the team as designed to challenge groupthink and shape technical direction, which makes red team scope, staffing and how findings reach engineers the strongest topics.
Is this you? Claim your profile and get paid for calls.
Hayete Gallot
LinkedInExperience: Executive Vice President, Microsoft Security · Microsoft
Identity, Threat Protection, Compliance, Data Protection and Management engineering teams fall under Hayete Gallot, Executive Vice President, Microsoft Security since February 2026. Gallot was President, Customer Experience Google Cloud (2024 to 2026) and, at Microsoft, Corporate Vice President, Commercial Solution Areas (2021 to 2024) and Corporate Vice President, Modern Work and Security (2020 to 2021).
Is this you? Claim your profile and get paid for calls.
John Lambert
LinkedInExperience: CTO of the CISO organization, Security Fellow, Corporate Vice President · Microsoft
Threat intelligence questions belong with John Lambert, who leads the consolidated research and intelligence teams for Microsoft Security and has been CTO of the CISO organization, Security Fellow, Corporate Vice President since 2025. Lambert was Corporate Vice President, Security Fellow (2023 to 2025), Corporate Vice President, Distinguished Engineer (2022 to 2023) and General Manager, Microsoft Threat Intelligence Center (2014 to 2022).
Is this you? Claim your profile and get paid for calls.
Michal Braverman-Blumenstyk
LinkedInExperience: CVP at Microsoft, Managing Director of Microsoft Israel R&D Center and CTO of Microsoft Security · Microsoft
With over two decades in cybersecurity, Michal Braverman-Blumenstyk holds two roles: CTO of Microsoft Security and Managing Director of the Microsoft Israel R&D Center, as CVP at Microsoft since 2022. Braverman-Blumenstyk was CTO, Cloud and AI Security Division (2017 to 2020) and General Manager, Azure Cybersecurity (2013 to 2017), a fit for cloud security technology and R&D site questions.
Is this you? Claim your profile and get paid for calls.
Terrell Cox
LinkedInExperience: Former CVP, Deputy CISO of Customer Security · Microsoft
Since March 2026, Terrell Cox has been CVP, Deputy CISO of Customer Security within Microsoft's CISO organization, after Deputy CISO for Privacy and Compliance (2025 to 2026). Cox was also Vice President, Microsoft Security & Privacy (2023 to 2025) and Vice President, Microsoft Defender for Cloud (2022 to 2023), and has led security, privacy, compliance and product engineering organizations serving enterprise customers, small and medium businesses and education.
Is this you? Claim your profile and get paid for calls.
Timothy Langan
LinkedInExperience: Corporate Vice President, Deputy CISO · Microsoft
Timothy Langan has been Corporate Vice President, Deputy CISO at Microsoft since January 2024, after Executive Assistant Director at the Federal Bureau of Investigation (FBI) (2022 to 2024). Langan's FBI titles also include Assistant Director -Counterterrorism Division (2021 to 2022) and Special Agent in Charge - Kansas City Division (2019 to 2021), useful where corporate security meets law enforcement.
Is this you? Claim your profile and get paid for calls.
Umar Waheed CISSP CISM
LinkedInExperience: Chief Information Security Officer (CISO) Nuance, a Microsoft Company · Microsoft
For security operations questions, Umar Waheed CISSP CISM brings Chief Information Security Officer (CISO) Nuance, a Microsoft Company since 2023, after Senior Director & Deputy CISO - Security Intelligence & Operations at Nuance Communications (2021 to 2023). Waheed was Head of Security Operations at the Financial Conduct Authority (2019 to 2021) and Security Operations Centre (SOC) Manager at Tesco (2014 to 2018).
Is this you? Claim your profile and get paid for calls.
Vasu Jakkal
LinkedInExperience: Corporate Vice President, Security, Compliance, Identity, and Management · Microsoft
Security market and positioning questions suit Vasu Jakkal, Corporate Vice President, Security, Compliance, Identity, and Management at Microsoft since July 2020, who also holds a Corporate Vice-President title there from the same date. Jakkal was EVP, CMO at FireEye (from 2017), has been Member Board Of Directors at Element since 2021 and serves on the Board of Directors of Aptiv.
Is this you? Claim your profile and get paid for calls.
Choose the right perspective
Corporate security program design fits Bret Arsenault, Timothy Langan or John Lambert; customer security, privacy and compliance fit Terrell Cox. Red teaming goes to Craig Nelson, threat intelligence to Lambert, security product strategy to Hayete Gallot, Vasu Jakkal or Michal Braverman-Blumenstyk, and security for one business to Umar Waheed (Nuance) or Chang Kawaguchi (Microsoft 365, through 2022).
Questions to take into the conversation
- 01How does Microsoft's CISO organization divide work between deputy CISOs for customer security, privacy and compliance?
- 02How should a company-wide red team that covers several clouds feed its findings back to product engineering?
- 03How does a business unit such as Microsoft 365 or Nuance run its own CISO function alongside the corporate one?
About this directory
This is a professional research starting point based on business profile data retrieved on . Titles and companies reflect that source snapshot; roles marked former had ended by then. Check the linked profiles for current details. Inclusion does not imply Instant Expert membership or availability.