Manny Khan is the Deputy Chief Information Security Officer for BitGo.
As Deputy CISO Chief Information Security Officer, I helped scale BitGo from Series C through its NYSE IPO and helped achieve OCC-chartered national trust bank status. These were companywide achievements, built on the work of leaders and colleagues across departments to whom I remain grateful. My experiences reinforce a central lesson: a CISO must work with executives across the business, scale alongside business strategy and engineering execution, and demonstrate executive accountability.
Start With Customer Assets And Business Priorities
Protecting customer funds from theft and loss is my mission. Translating that responsibility into action begins with building relationships across departments and understanding their priorities. Partnering with engineering and product helps connect security decisions to architecture, delivery and customer outcomes.
For CEOs, COOs, and bank presidents leading financial services, fintech and digital asset businesses, security must protect customers, enable product development and demonstrate readiness for greater operational complexity and regulatory scrutiny.
The transaction lifecycle provides a practical framework for alignment: authentication, authorization, execution, settlement and recovery. What authority does an identity hold? Where would a single point of failure have financial consequences? How should controls limit exposure while preserving availability and data integrity?
An OCC National Trust Bank Charter Requires An Operating Model
Helping achieve OCC-chartered national trust bank status reinforces that regulatory readiness must be built into operations. Policies establish expectations. Operational practices turn those expectations into defined controls. Evidence demonstrates whether the controls work.
Leadership should understand who owns each critical service, which controls the bank operates directly and which depend on shared infrastructure or third parties. Shared services require clear accountability, access boundaries, monitoring, escalation paths and recovery arrangements.
The three lines of defense model reinforces accountability while preserving appropriate independence. Departments operating controls need clear responsibilities; risk and compliance functions provide oversight; independent assurance needs reliable evidence.
Ongoing testing of control design and operating effectiveness should inform compensating controls and remediation plans with timelines. Achieving a charter is a milestone; sustaining the discipline behind it is an ongoing leadership and companywide responsibility.
Build Security Into Growth And Scale
I work with engineering and product to embed threat modeling and security review into product requirements, technical design and release processes. Together, we bring security decisions earlier into development while preserving developer velocity.
When departments are building APIs, customer onboarding, data pipelines and cloud infrastructure simultaneously, shared engineering standards become essential. Departments need a consistent baseline for identity, authorization, sensitive data handling, logging, testing and production readiness.
Embedding standards in reusable infrastructure, development workflows and automated checks reduces repeated negotiation and gives engineers a clearer path from design to release.
Before production, departments should understand what success looks like, how failures will be detected, who has authority to pause deployment and how service will be restored. Rollback plans should account for data changes and financial transactions; reverting application code alone may not reverse a financial consequence.
When delivery pressure conflicts with material customer or operational risk, security should explain the failure scenario, identify necessary safeguards and help departments choose a practical path forward.
Translate Technical Risk Into Executive Decisions
For executives, board members, customers and regulators, I am responsible for translating technical risks and how I’ve addressed these risks as the bank scales. A vulnerability becomes meaningful when its potential consequences are understood: unauthorized fund movement, service disruption or sensitive information exposure. I connect those consequences with existing safeguards, residual risk and future investment priorities.
Controls include identity management, privileged access, isolation of critical components and resilience. Critical systems should avoid single points of failure, and controls should be layered in depth and breadth. Work backwards by taking an assume-breach and assume-compromise position to build resilience.
Engineering, product and operations bring different responsibilities to the same decision. Success between departments depends on tradeoffs being explicitly understood and accepted.
My approach is to explain the failure scenario, identify necessary controls and work with colleagues on a path forward, translating technical complexity into business owner accountability, without creating security drag for the business.
Measure Protection And Delivery Together
A security operating model should improve both protection and execution. Executives need to understand whether exposure to material loss is declining and whether departments are delivering safely. Useful measures include remediation of critical exposures, control effectiveness, incident response, release failures and recurring delivery blockers. Findings should lead to changes in architecture, tooling, ownership or training.
Coaching matters alongside standards. Executives need to set clear priorities, make timely decisions and help remove obstacles. Repeated exceptions signal a need to examine the standard, implementation or underlying platform.
Apply The Principles To AI
Your AI or SI “Super Intelligence” should apply a risk-based approach for decision-making prior to taking an action. It’s very important to keep a human in the loop for highly consequential decisions. How much of a human in the loop, where and when, should be determined based on your bank’s risk tolerance and risk appetite.
AI-assisted development and autonomous agents introduce different forms of authority. A development assistant may propose code; a production agent may access customer information or initiate actions. Each requires controls suited to its permissions and potential consequences.
For financial workflows, preparing a transaction, approving it and executing it should be treated as distinct authorities. Access limits, independent authorization, audit trails and mechanisms to stop execution should reflect the consequences of misuse or error.
Faster code creation increases the importance of review, testing and production validation. Security should help engineering adopt AI effectively while maintaining accountability for what reaches customers.
Team Effort
Scaling through an IPO and helping achieve an OCC-Chartered National Trust Bank status reinforced my view that effective security leadership connects engineering, operations, governance and business strategy.
The practical test is whether the organization becomes more capable as it grows: protecting customer funds and data, delivering reliable products, demonstrating effective controls and responding decisively when conditions change.
This article is for informational purposes only and is not financial advice. The views expressed are my own and do not necessarily reflect those of BitGo or its affiliates.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?