C-Level is amongst other things, a strategic and political position.
After an incident like this, it is understandable that people look at the profile of those entrusted with this responsibility.
If we look at Moxie's OSINT, we'd quickly see that he was perfectly qualified based on his presence in the ecosystem (conference talks etc).
A more suitable comparison would be the CSO of Equifax's competitor - which is Experian.
Do the same comparison with their CSO:
- Director of Security / Compliance,Capital One
- VP of Information Security, Citi Group
- Director Information Security and Risk Management, Thomson Reuters
- Director / CSO, Experian
Oh, this candidate also has relevant publications, certifications and a PhD in Computer Science..Whilst I think the education is relevant, I don't think it is the defining factor... But.. We should be careful to jump to "education doesn't matter".
Was this the right person to be entrusted with the strategy for OUR data security? We simply don't know... but what we have seen has caused concern.