Oritse J. Uku

CISO of two regulated subsidiaries, and enterprise business information security

The security responsibilities for two regulated subsidiaries, a federally chartered savings association and a registered broker-dealer, were on my plate from the day I joined Northwestern Mutual in 2022. In 2025 the boards of both companies formally appointed me their CISO. In both seats I was accountable for enterprise security, resilience, and regulatory engagement. I also ran business information security for the enterprise and, from 2023, IT governance, risk, and compliance.

Cyber threat management, incident-response doctrine, and the bank’s first cloud responders

Much of the team’s work was threat-informed defense. Prioritized patching was one application of it. CVSS rates a vulnerability in isolation, so we ranked ours across the estate by what adversaries were exploiting in the wild.

In 2019 I was one of two people asked to write the cloud security brief the CISO took to the board. I then led the eighteen-month effort that trained the bank’s first cadre of cloud incident responders, more than three dozen of them. They sat in teams across the bank, trained to a common standard. I wrote the third-party incident-response playbook and the major incident-response runbook. Incident response covered the bank’s footprint of about 160 countries. I planned for nation-state denial-of-service campaigns anticipated in response to US government actions. When Russia invaded Ukraine in 2022, Citi had offices in both countries. The exposure ran wider than cyber, covering a western bank’s people, premises, and data in both places, and I worked the information security side of the response.

Military intelligence, in Korea, Germany, and Afghanistan

The work was predictive analysis: building the adversary’s most likely course of action from their own doctrine, history, and worldview, filtered through the sources reporting on them, and tailored to the decision a specific commander actually had to make. In South Korea I was the intelligence officer for an attack helicopter squadron, a strategic asset in a potential conflict with the North, and I spent that year on North Korea. In Germany I was executive officer of a counterintelligence and human intelligence company.

Recalled from business school to deploy to Afghanistan, I spent most of the tour as the intelligence officer for the Army command advising Afghan army and police units across the western region, on the Iranian border. The shop I ran was staffed by Army, Navy, and Air Force intelligence personnel. I briefed the commander, coordinated with the Spanish and Italian contingents, and was the channel between allied teams that did not deal with each other directly. I kept a truck and crew so my shop was out among the Afghan army, the police, and the people in the areas we covered. For the last six weeks I was attached as intelligence officer to an Embedded Training Team with an Afghan National Army battalion, there so it won its fights with the Taliban.

Prioritizing patches on what adversaries are actually exploiting is that same course-of-action work, run against a different adversary set.