Security Confidential S6 E6 Endre Walls

Manoj Tandon:
Hello everyone, this is Manoj Tandon, your host. Welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have another great guest joining us—Andre Jarraux Walls. Andre is the EVP and CISO for Customers Bancorp and Customers Bank, where he leads technology risk, digital compliance, and security operations. He’s held all three major C-level roles in technology as an award-winning CIO, CTO, and CISO. He’s been recognized as one of the Top 40 Under 40 leaders in the Greater Philadelphia region, a Top 100 CISO, a Top 10 Global CISO, and a recipient of the American Cyber Awards. Andre, welcome to the show—we’re so glad you could join us. With that kind of background, I have to ask—how did you get into cybersecurity? It sounds like you could have gone in any direction.

Andre Jarraux Walls:
It’s funny—I actually started in IT by accident. My first job was a summer role at Breyers Ice Cream as a hardware technician. Basically, when someone’s computer broke, I’d swap it out and take the broken one back to be fixed. That’s literally what I got paid to do. But I started getting more interested in technology—networks, systems—and decided to stick with it. Before I knew it, I was working on servers and networking, then got a project management opportunity at Arkema Chemical, and things just kept progressing. My real fascination was networking. I became Cisco certified and worked on designing secure networks for large organizations like GE Nuclear and major law firms. That’s where I really got into security, and from there, I never looked back.

Manoj Tandon:
That’s an incredible journey. You mentioned GE Nuclear—do you think sectors like that are moving to the cloud?

Andre Jarraux Walls:
I think any prudent organization is at least evaluating the cloud. There are clear advantages—scalability, cost savings, and even security in some ways. The cloud can provide better control granularity and reduce the burden of managing infrastructure. But there’s a key point people miss: cloud providers secure the infrastructure, not your applications. You still have to configure and secure your own environment properly. What shifts is your focus—from infrastructure to applications, platforms, and controls. And the cloud makes it easier to test those controls, which is a huge benefit.

Manoj Tandon:
That makes sense. We still see hesitation though, especially in industries like manufacturing and banking where there’s a strong traditional perimeter mindset.

Andre Jarraux Walls:
Absolutely—and in banking, a lot of that hesitation comes from regulators. When you move to the cloud, you introduce third-party and even fourth-party relationships, which complicates oversight. Regulators now have to look beyond your organization into your vendors and their vendors. That blurs the boundaries and makes things more complex. That said, some regions—like the Northeast—are becoming more progressive and better equipped from a technology standpoint.

Manoj Tandon:
Speaking of your sector, what do regulators see as the biggest threats in financial services today?

Andre Jarraux Walls:
Third-party risk, without a doubt. If you look at the biggest breaches in recent years, many of them originate from vendors. There’s always some third party involved—something misconfigured, something overlooked. From the customer’s perspective, it doesn’t matter who caused it—they trusted you, and you lost their data. So organizations need to do a better job with due diligence, understanding third- and fourth-party relationships, and clearly communicating those risks.

Manoj Tandon:
That’s a huge topic. Practically speaking, how do organizations assess third-party risk?

Andre Jarraux Walls:
It starts during onboarding. You build it into your vendor vetting process—questionnaires, site visits, evaluations across security, legal, and financial risk. You want to ensure that vendor will still be viable years down the line. But you also have to think beyond security—things like reputational risk. If a vendor ends up in the news for misconduct, that impacts you too. For existing vendors, the best time to reassess is during contract renewal, but you don’t have to wait—you can revisit and enforce expectations at any time.

Manoj Tandon:
What about smaller vendors—HVAC providers, copier maintenance, those types? They often have access but limited security maturity.

Andre Jarraux Walls:
That’s where standards come in. You define baseline requirements and communicate them upfront. For smaller vendors, you may scale those requirements down, but you compensate by limiting and closely monitoring their access. It’s also about partnership—helping vendors improve their security posture ultimately strengthens your own. There’s value in investing that time.

Manoj Tandon:
That’s a great approach. Let’s talk about personal devices—BYOD. How do you secure those without overstepping privacy?

Andre Jarraux Walls:
It’s a balance. There’s cost savings and productivity benefits in allowing personal devices, but you need visibility. We use mobile device management (MDM) to maintain that visibility without controlling personal data. The key is communication—making it clear we’re not trying to invade privacy, just ensure corporate data is protected. There’s also a benefit to users—they get added protection and support for their devices.

I like to describe our security organization as a fire department. Our job is to prevent fires where possible and minimize damage when they happen. Too many security teams act like police departments—enforcing rules and controlling everything. But when you focus on prevention and enablement, people engage with you differently.

Manoj Tandon:
That’s one of the best analogies I’ve heard. It really changes how security is perceived across the organization. So how do you communicate risk to the C-suite in a way they actually understand?

Andre Jarraux Walls:
We keep it simple and consistent. Every month, we present to the board with clear metrics—where threats are coming from, what we’re seeing, and what it means in plain English. We also involve leadership in training—phishing tests, awareness programs, and interactive sessions. Even our CEO participates.

We also publish an annual “state of security” report for the entire company. Transparency is key. Security isn’t a black box—everyone knows what we’re doing and how they fit into it.

Manoj Tandon:
Do you think most organizations understand that cybersecurity is a business problem, not just a technology problem?

Andre Jarraux Walls:
Some do, but there’s still a long way to go. The industry is heavily focused on technology, but most breaches start with people—someone clicking a link, a misconfiguration, a process failure. Technology only does what people tell it to do. Without the right processes and awareness, it won’t save you.

Manoj Tandon:
That’s exactly right. We hear it all the time—“We have MFA, we’re secure.” But that’s not reality.

Andre Jarraux Walls:
Exactly. That’s why we focus on de-risking. Moving toward passwordless systems, improving device trust, and reducing reliance on human error. But more importantly, we involve everyone in security. It’s not a back-office function—it’s something the entire organization participates in.

Manoj Tandon:
How did you build that culture?

Andre Jarraux Walls:
It started with communication. When I joined, we shifted how we talked about security—making it clear that everyone is part of the team. When people ask how big my security organization is, I say it’s the size of our entire company.

We also made a deliberate decision to separate security from IT. Security isn’t just a technology function—it’s about people and processes. When it sits under IT, it often gets deprioritized in favor of productivity. Separating it allows security to support the entire business more effectively.

Manoj Tandon:
That’s a big—and sometimes controversial—point. But it makes sense, especially when governance and accountability come into play.

Andre Jarraux Walls:
Exactly. It’s hard to govern something when you report to the person you’re governing. Separation creates clarity and strengthens both functions.

Manoj Tandon:
Let’s talk about frameworks—COBIT, ISO, MITRE. How should organizations actually use them?

Andre Jarraux Walls:
Frameworks are essential—they give you structure. But you can’t do everything at once. Start with what matters most—your people, your visibility, and your internal controls. Then expand outward.

Also, pay attention to work styles. When tools don’t align with how people work, they find workarounds—shadow IT. That creates risk. Security needs to work with the business, not against it.

Manoj Tandon:
That ties back to your earlier point—if you’re always saying “no,” people will find a way around you.

Andre Jarraux Walls:
Exactly. People will always prioritize getting their job done. Security needs to enable that, not block it.

Manoj Tandon:
Let’s touch on adversaries. What motivates attackers today?

Andre Jarraux Walls:
It’s evolved significantly. It used to be curiosity or disruption—now it’s a business. Ransomware-as-a-service, organized groups, even customer support lines—it’s incredibly sophisticated.

Motivation is largely financial, but there’s also reputational and geopolitical intent, especially with nation-state actors. And those threats are extremely difficult to stop.

Manoj Tandon:
That’s a sobering reality. Before we wrap up, any advice for organizations or leaders?

Andre Jarraux Walls:
Focus on talent differently. Build internship programs, look beyond traditional pipelines, and prioritize creativity over credentials. Some of the best security professionals are self-taught and think like adversaries.

Also, we need more diversity in cybersecurity. Expanding our networks and opportunities helps bring in new perspectives, which ultimately strengthens security. And finally, don’t rely solely on traditional career paths—look for motivated individuals who are eager to learn and contribute.

Manoj Tandon:
That’s fantastic advice. Andre, thank you for joining us—this was an incredible conversation.

Andre Jarraux Walls:
My pleasure. Thank you for having me.

Manoj Tandon:
And thanks to everyone listening—we’ll see you next time.