Katie Hermans

'Curiosity, adaptability, and a willingness to step outside your comfort zone can be just as powerful as technical skills’

Part of the Tech Women Celebration 50 – a curated list of some of the most inspirational women working at all levels of tech

I began my career in 2005 as a graduate software developer at Liverpool Victoria Insurance and have remained in the insurance sector ever since. Over the next 14 years, I progressed into senior roles leading multi-million-pound programmes across digital, integration, and policy platforms.

In 2020, I pivoted into technology risk and governance, creating and leading a new team at Allianz UK; a shift that sparked a genuine passion for risk and governance. In 2023, I joined RSA as Director of Technology Risk, where I transformed the risk capability and culture.

In March 2025, following a successful interim period as Chief Information Security Officer, I was appointed to the role permanently.

My cross-functional experience across technology delivery, IT risk/governance, and cybersecurity enables me to "join the dots" and make pragmatic, safe, and business-aligned decisions. I'm also deeply committed to mentoring and take pride in supporting others; especially women as they grow their careers in technology and security.

Outside of work, I'm an avid paper crafter and love to solve a jigsaw, with a particular love for "speed puzzling."

What do you consider your biggest achievement to date?

Finding my voice as a leader and stepping into senior leadership with clarity and confidence. In June 2025, I told our CIO that I aimed to become a credible CIO candidate within five years, backed by a clear development plan. That moment of honesty marked a turning point. I pursued executive coaching, built senior relationships, expanded my cross-functional impact, and mentored women in and beyond the CIO community.

In August 2024, I earned a place on the competitive Game Changers senior leadership programme, which accelerated my growth through mentoring and a high-level business challenge. The real milestone came soon after, when I was appointed interim CISO, despite not having a technical background. I built trust quickly, delivered a six-point cyber strategy, and inspired renewed purpose across the team. In March this year the role became permanent - a “pinch me” moment that validated the journey I've been on.

From boldly stating my ambition to leading a critical function with impact, this year has been defined by growth, resilience, and purpose.

What is the most significant challenge you have overcome?

My unexpected pivot from Technology Risk Director to Chief Information Security Officer.

The challenge extended far beyond a lack of technical knowledge; it forced me to confront deep-rooted self-doubt and imposter syndrome. Rather than mask my uncertainty, I chose to lead with authenticity. I openly shared with my new team that I was outside my comfort zone.

That became a strength; particularly for the women in the team, who now see vulnerability as a leadership superpower. This openness has helped foster a culture of trust, inclusion, and psychological safety.

In March I hosted an all-team offsite, bringing together 70 colleagues; many of whom had never met in person despite working together for years. I shared my career journey, including the setbacks. Six women approached me afterward to say they felt inspired and more confident that they, too, could one day become a CISO. That feedback was deeply humbling and affirmed the importance of visible, relatable leadership.

The dual responsibility of my new CISO role and the continued oversight of my previous remit was another challenge. I struggled with capacity and there simply weren't enough hours in the day; but after three months, I made the decision to backfill my previous role, creating a promotion opportunity within the team. In hindsight, this wasn't a sign of failure - it was a sign of growth. I made a decision that was right for the business, the team, and my own sustainability as a leader.

This year has tested me in ways I never anticipated, but it has also shown me what I'm capable of when I lead with courage, humility and purpose.

Tell us something about yourself that people would find surprising?

What often surprises people is that I became a CISO without a traditional cybersecurity background, without initially aiming for the role, and without holding any formal cyber certifications. In a field where technical credentials and linear career paths are often seen as prerequisites, my journey has been anything but conventional. Over the past 8 to 10 years, I've deliberately taken sideways moves rather than chasing vertical promotions. Each role, whether in technical delivery, risk, or transformation, offered a new perspective and skillset. These varied experiences have become my greatest strength, allowing me to approach security challenges with a broader, more strategic lens.

I'm passionate about challenging the notion that success in cyber requires ticking every technical box. My path shows that curiosity, adaptability, and a willingness to step outside your comfort zone can be just as powerful. It's a message I share often, especially with those who feel they don't "fit the mould."