Noopur Davis never planned a career in cybersecurity. She was a developer at Intergraph, and for many years that was all she wanted to be.
Comcast, founded in Tupelo, Mississippi, in 1963, is now a global media and technology company headquartered in Philadelphia, Pennsylvania. It has offices in North America, Europe, Asia, and Australia, and a global workforce of around 180,000 people. Noopur Davis is the organization’s Global CISO, leading multiple security teams distributed around the world and a total headcount of around 1,500 security team members.
Davis is not simply the Global CISO of a major enterprise. She is also President of the United States Appointee to the National Security Telecommunications Advisory Council at the White House, a member of the board at Regions Bank, a board member at Entrust, and an advisor to the investment firm NightDragon. But her route to this elevated position when starting as a developer is far from typical.
The route to cybersecurity leadership
Davis never had a pre-planned structured career plan. Rather, she is a person able to recognize, adopt, and adapt to new opportunities as they arise.
“I began my career as a software developer,” she said. This was with Intergraph. “I loved it. I must have done more than my 10,000 hours as a software developer” (referencing the ‘10,000 -Hour Rule’ outlined by Malcolm Gladwell in his book Outliers: The Story of Success). With increasing expertise and experience she began to develop and lead software teams as well as code.
By 1999 she was director of engineering, leading multiple teams across multiple sites, with a growing interest in the mechanics of how teams and knowledge workers operate. Then came one of those opportunities that she recognized and adopted. She left Intergraph and became a senior member of software engineering process management at Carnegie Mellon University.
“This was the time of the agile movement, with a focus on people and teams from an engineering viewpoint, but also on people-empowerment to make the best decisions for teams.” The Agile Manifesto was authored by 17 leading software practitioners in 2001.
“The software engineering institute at Carnegie Mellon did a lot of applied research,” she continued. “Whenever we came up with an organizational method, we would work with the best organizations in the world to test them. We worked with Citi, with Microsoft, with the Naval Oceanographic Office, Lockheed Martin, Hewlett Packard and others.”
“We learned about organizational behaviors and software engineering. How do you build a hypothesis, especially for something that is hard to measure like software or cyber? How do you set up experiments where the subject is very people-driven? And then how do you motivate those people? There was a lot of work in this area. And then I got into cyber.”
This was also the time when cyber was emerging as a profession, including within Carnegie Mellon. Bill Gates wrote his famous trustworthy computing memo, which he circulated to all Microsoft employees on January 15, 2002.
“He came to Carnegie Mellon and said, ‘Hey, can we work on this together?’ And I got pulled into that because I could still code. That’s how I got into cyber. So, it was really not anything I had planned. It was very happenstance – but I loved it.”
By now, through this happenstance, Davis had become an expert software developer and an experienced and knowledgeable leader with a growing understanding of and interest in cybersecurity. It was the ideal launchpad for leadership in cybersecurity – not because it had been planned, but because she took opportunities that interested her as they arose along the route.
She moved directly from Carnegie Mellon into cybersecurity in 2011, not as a security team member, but as VP of global quality at Intel – a position with responsibility for product security, security incident response, product and process quality, enterprise agility, and product lifecycle frameworks.
In 2016 she joined Comcast as SVP of product security and privacy, became corporate EVP, chief information security and chief product privacy officer in 2021, and global CISO and chief product privacy officer in 2023.
“My first CISO role – and this still just boggles my mind – was with a Fortune 30 company.”