I was senior security architect at a multinational manufacturer of connected water infrastructure. There I helped establish a product security programme, and went on to own and run it, with sign-off authority on product launch, and delivery of the first ISO 27001 certification for the platform.
Across my security architecture roles I've owned security strategy, budget planning, and risk management, as well as the on-the-ground technical work: threat modelling, secure software development processes, secure boot and firmware update process design, bug bounty and disclosure programmes. And before that, I spent twelve years writing software.
My experience means I know what is and isn't practical for a delivery team to take on. My solutions are always designed around what benefits the business and its people.
If I were a CTO at a growing company trying to get security right without standing up a full team, he would be my first call.