Cyber Security Stewardship Executive of The Year: Kris Virtue

Kris Virtue, Vice President of Cybersecurity for Qualcomm (NASDAQ: QCOM), has been named the 2023 Cybersecurity Executive of the Year.

“Kris mobilizes industry, academia and government to increase San Diego’s regional cyber resiliency; seed and diversify the talent pipeline; and drive collaborative cyber innovation,” said Lisa Easterly, one of six judges for the awards.

Easterly has gotten to know the virtues of Virtue firsthand in her position as president and CEO of the Cyber Center of Excellence (CCOE). Virtue is a founding officer and the current co-chair of the San Diego-based nonprofit, whose missions are to grow the regional cyber economy and create a more secure digital community.

“Kris is a dedicated cyber industry champion and is highly passionate about his work,” Easterly said, noting that his achievements also include raising regional cybersecurity awareness with small business programs in the cities of San Diego, Carlsbad and Vista, as well as the recently launched San Diego Regional Cyber Lab; strengthening national security innovation through leadership in the State of California’s CADENCE grant consortium as a member of the DoD’s Defense Manufacturing Communities Support Program; and partnering with the U.S. Department of Defense and regional partners to create infrastructure-championed challenges to source collaborative solutions from industry and academia.

Keeping the Qual-Calm

Virtue – yes, that is his real name, and yes, he does live up to it – by the way also has one of the most difficult full-time jobs in San Diego. He leads Qualcomm’s Global Information Security and Risk Management divisions, overseeing information security capabilities and efforts within the Fortune 500 company and ensuring that its digital information assets and systems are protected.

“It’s always a challenge just to keep up with the pace of Qualcomm, kind of running as fast as we can all the time,” Virtue told the San Diego Business Journal during a Zoom call, noting that he was “super, super honored” to receive this award from the SDBJ, especially because it represents recognition from his peers.

“But security is really a team sport,” he said, “and the thing I’m most proud of is that we’ve built a team of really strong individuals who are up to the task.”

That task is a huge one. The FBI reports a 300% increase in cybercrimes across all industries since 2020, with the global cost of data breaches climbing over $4.4 million. Pair that with the global shortage of cyber professionals to thwart these attacks – to the tune of 660,000 openings in the U.S. and 9,000 here in San Diego – and cybersecurity has suddenly become, as Easterly put it, “everyone’s business.”

That’s especially true of Virtue’s employer, though. As one of the best-known brands in semiconductors, software and wireless services, Qualcomm – with more than 12,000 employees in San Diego and 50,000 overall – is one of the most obvious targets for cybercrimes like those that recently befell Clorox, MGM Resorts and Caesars Entertainment.

“Does it keep me up at night? Sure,” Virtue said. “But I’ve got confidence in what my team is able to do. Everybody is collaborating to share information and best practices, so that we hopefully all lift each other up to prevent attacks. And that’s ultimately what helps me sleep.”

A Fateful Offer

While majoring in computer science at UC San Diego, Virtue – who grew up in the Los Angeles suburb of Rowland Heights – figured he’d end up “as a software engineer somewhere.” But UC San Diego recognized his outstanding abilities early on, offering him to stay on as a fulltime program analyst in its bioengineering department.

“My boss at the time had left to go to Qualcomm,” Virtue said. “When I told him about the job offer, he said, ‘No, you’ve got to come over here. They are the smartest people I’ve ever met.’”

Virtue said he had never heard of Qualcomm, “but I really looked up to this guy, so I figured I might as well apply.” That was 26 years ago.

Back then, there were no chief information security officers and companies didn’t have big cyber teams. But Virtue, anticipating the market, began tailoring his skillset to the burgeoning need for cybersecurity and switched over from IT as soon as he felt ready.

Different Drumbeat

Something that even many of Virtue’s employees don’t know about him is that, before attending college, he played drums in a ’90s alt-rock band. Called Pear, they were regulars on L.A.’s Whisky a Go Go and Roxy circuit.

“You wouldn’t recognize photos of me from then,” Virtue said. “We didn’t hit it big, and so everyone went off to actually have a real career.”

There is a parallel to be drawn between Virtue’s two seemingly disparate paths, and it’s in the position he chose to occupy in both. Virtue is most comfortable being the one keeping time in the back seat, not the one facing the customers and doing the inventing and the showmanship up front.

If his old bandmates flubbed a guitar riff or forgot a song lyric, they could always laugh it off and the song continued. But if Virtue’s beat stopped, the concert crashed to a dead, mortifying halt.

“I like that analogy,” Virtue said. “I’m going to have to use it.”

Keeping the beat for Qualcomm in the background is also what led to what Virtue cites as the greatest challenge of his career – a humbling but, ultimately deserved, rebuke from the head of a business unit team launching a new Qualcomm service while Virtue still worked in IT.

“He had some critical feedback for us,” Virtue recalled, “and it really gave me a new perspective for sitting in the seat of one of our executives who’s leading the business and dealing with customers. The teams on the back end will always get to go on to work on the next project. But, at the end of the day, if a service doesn’t work, it’s the business people who are going to feel the pain.”

That customer-first perspective, Virtue explained, is something that he’s carried with him ever since.

“It’s especially important on the cyber front,” Virtue explained. “Our goal is to protect the company, not to shut it down. It’s easy to be super cyber secure. I can just unplug the internet and we could just not go online. And we’d be perfectly safe. But that’s not really going to help anybody.”

Click Image Below To View the Entire Cyber Security Stewardship Awards Section: