Key Takeaways
- Ralph Johnson will step down as Washington state’s Chief Information Security Officer (CISO) in September after 3.5 years in the role.
- Prior to Washington, he served as CISO for Los Angeles County and King County, Washington, and held brief cybersecurity leadership roles in the private sector.
- Johnson views cybersecurity as a mission‑driven profession, emphasizing the importance of protecting public services and the people who rely on them.
- He plans to remain active in the field by offering advisory services to public‑sector and regulated organizations.
- Johnson’s career includes extensive teaching experience, notably as a capstone instructor at the University of Washington’s Information School.
- As state CISO, his duties encompassed setting statewide security standards, operating a Security Operations Center, monitoring threats, and leading incident response.
- He noted that state‑level CISOs face broader responsibilities and must navigate inter‑agency relationships rather than exercising unilateral authority.
- Current challenges include competing with the private sector for talent, reduced federal support, vendor restrictions on sharing threat intelligence, and the dual‑edged impact of artificial intelligence on both attackers and defenders.
Announcement and Tenure
Ralph Johnson announced via a LinkedIn post on Friday that he will resign from his position as Washington state’s Chief Information Security Officer effective September. Johnson has held the role for three‑and‑a‑half years, having joined Washington Technology Solutions—the state’s IT bureau—at the end of 2022. His departure marks the end of a notable stint overseeing the state’s cybersecurity posture during a period of increasing digital threats and heightened public reliance on government services. In the post, he expressed gratitude for the opportunity to serve and highlighted the privilege of working alongside dedicated colleagues across the agency.
Professional Background Before Washington
Prior to his appointment in Washington, Johnson built a diverse resume spanning both public and private sectors. He spent three‑and‑a‑half years as CISO of Los Angeles County, concluding in 2021, and before that accumulated nearly 18 years of service in King County, Washington—home to Seattle—where he finished as the county’s CISO and privacy officer. Intermittently, he also led cybersecurity operations at NantMedia Holdings, a media and publishing firm that owns outlets such as the Los Angeles Times and The San Diego Union‑Tribune. This blend of local‑government and private‑sector experience equipped him with a broad perspective on security challenges across different organizational contexts.
Mission‑Driven Perspective on Cybersecurity
In his LinkedIn message, Johnson characterized cybersecurity not merely as a job but as a personal mission and responsibility. He stressed that the work to safeguard systems, data, public services, and the individuals who depend on them holds profound significance. By framing his role within a larger sense of duty, Johnson underscored the motivational force that has guided his career and the collective commitment of his teammates to defend critical infrastructure against evolving threats.
Future Involvement and Advisory Role
Although stepping down from the state CISO post, Johnson indicated he will remain engaged in the cybersecurity community. He intends to provide advisory services to public‑sector and regulated organizations, leveraging his expertise to help those entities strengthen their defenses. This continued involvement reflects his longstanding orientation toward service, allowing him to contribute to the security posture of various stakeholders without the formal responsibilities of a statewide leadership role.
Teaching and Academic Contributions
Education has been a consistent thread throughout Johnson’s career. He spent seven years as an instructor at the University of Washington’s Information School, teaching a capstone course in information security and risk management. Additionally, he served nearly two years as an adjunct instructor at ITT Technical Institute, the now‑defunct for‑profit school chain. These teaching roles enabled him to shape the next generation of security professionals, imparting practical knowledge and fostering a culture of proactive risk management.
Core Responsibilities as State CISO
During a May appearance on a podcast hosted by Washington state’s Chief Information Officer Bill Kehoe, Johnson outlined the primary functions of his office. His duties included establishing statewide security standards, operating a Security Operations Center (SOC), continuously monitoring network traffic for anomalies, identifying emerging cyber threats, and directing the state’s cybersecurity incident response team. He succinctly summarized the essence of his work: “We manage risk.” This encapsulates the proactive, ongoing effort to anticipate, detect, and mitigate potential impacts on government systems and services.
Contrasting State and Private‑Sector CISO Roles
When asked how his state CISO role compared to previous positions, Johnson highlighted the broader scope of responsibility inherent at the state level. He noted that implementing changes to security controls often required navigating complex inter‑agency relationships and consensus‑building, unlike the more direct authority he enjoyed in private‑sector or smaller‑county environments where he could “simply make the change” without extensive justification. This distinction illustrates the unique governance challenges faced by state CISOs, who must balance technical decisions with political and bureaucratic considerations.
Current Challenges: Staffing, Federal Support, Vendor Limits, and AI
Johnson identified several pressing challenges confronting state and local cybersecurity operations today. Chief among them is the difficulty government agencies face in competing with the private sector for skilled cybersecurity personnel, often resulting in talent shortages. He also pointed to diminished federal support, which forces states to shoulder more of the burden while sometimes lacking additional funding to assist local jurisdictions. Vendor restrictions further complicate matters, as some providers prohibit the sharing of proprietary threat intelligence with state or local governments, limiting collaborative defense efforts. Regarding artificial intelligence, Johnson observed that AI lowers the barrier to entry for attackers and enhances the sophistication of phishing campaigns, making detection harder. Conversely, he acknowledged that AI is indispensable for defenders, given the massive volume of telemetry data that state systems generate; automated analysis tools are essential for sifting through noise, identifying genuine threats, and triaging responses efficiently.