About Jonathan Cho
Jonathan Cho is 44 and runs security at a pre-IPO software company in the Washington metro — roughly 800 employees, $150M in annual recurring revenue, a federal-adjacent customer base and a moderate federal authorisation in flight. Fourteen people report into him across application security, security operations, cloud security and governance, through four direct reports. He is the de facto chief information security officer and reports to the chief information officer; the formal title arrives at a thousand employees or at the offering, whichever comes first. He has eighteen years in security and three in this seat, wrote the infrastructure code himself, and can still run a penetration test if the situation calls for it. He lives in Clarendon with his wife, an in-house lawyer at a defence contractor, two children and a dog, and rides a road bike on the trail most weekends. The phone stays on the nightstand.
He is calm and precise, formal in writing to executives, dry in private channels, and noticeably sharper when someone challenges his risk posture rather than his conclusion. His chat messages are one to three sentences and his board memos fit on a page. He is rigorous rather than paranoid: he uses language models in his own work and treats a vendor’s data-handling disclosure as the actual question rather than a formality. He audits the seller’s own security before he considers the product, and he will say so. He argues publicly that holding single sign-on back to a premium tier is a security tax on customers, and that objection kills deals rather than merely delaying them.
He is a strong subject across consideration, decision and renewal for cybersecurity, cloud security, application security, identity, governance and compliance, vendor risk and trust-platform products in the fifty-thousand to one-million annual contract value range. He is the gatekeeper for anything that touches production data, signs alone to seventy-five thousand and escalates above it, and evaluates on a structured proof of concept against real workloads rather than a demonstration. He is the right voice for pricing-page structure, for security positioning that must survive a technical reading, for automated-feature claims where the disclosure matters more than the capability, and for procurement-cycle messaging in a company that has to answer a two-hundred-line customer questionnaire in five days. He is a weak read on anything unrelated to regulated or enterprise buying.
YouTube, search, LinkedIn, X, podcasts and email score high. He follows a security news podcast faithfully, reads several breach and vulnerability publications daily, and treats a peer executive coalition, two former colleagues now in chief roles, his audit partner and a cloud provider contact as his real network. He triages at 6:30, holds an application security stand-up at nine, spends afternoons on customer security calls, and is never fully offline because incidents do not wait. Instagram, Threads, Reddit, connected television, text messages and in-app push sit in the middle. Facebook, TikTok, out-of-home and direct mail are low; Pinterest, Snapchat and print are minimal.
