Executive record

Heather Ceylan

Heather Ceylan is Chief Information Security Officer at Box, as of October 20, 2026, per box.com (company's own site).

Seat verified October 20, 2026 · Added to the record October 20, 2026 · no move on the Wire yet

Tracked record

2026-10-20 · Roster verification

Heather Ceylan, Chief Information Security Officer at Box, verified October 20, 2026

Source: box.com (company's own site) ↗ · Company record

No appointment or departure for Heather Ceylan is on the Wire. This page rests on the roster entry above: a verification, against the source cited, of who held the Box seat on that date. It is not a career history and states nothing beyond that entry.

Elsewhere

Public profiles we matched to Heather Ceylan by exact name and the company on our record. Links only; we do not copy from them.

LinkedIn ↗

CISO Voices: in public

What Heather Ceylan has said in public while in the seat: posts on LinkedIn, X, Bluesky and Mastodon, bylined articles, podcast appearances, talks and videos, described in our words. We link to each one and never reproduce it. All voices · The speaking circuit

October 26, 2026 · LinkedIn post · Other
On career aspirations and childhood narratives
Read on LinkedIn ↗
September 1, 2026 · Podcast appearance, CyberWire Daily · Other
On Windows 11 security concerns
Nightmare on Windows 11.
Listen at CyberWire Daily ↗
June 1, 2026 · Podcast appearance, CyberWire Daily · AI & agents
On artificial intelligence integration in military command structures
AI joins the chain of command.
Our takeOpinion
Box's CISO appears on this CyberWire Daily Industry Voices segment. The guest segment covers governed AI and the unstructured data problem, set inside a news roundup that also touches battlefield AI, a Netlogon flaw under active attack, and CIRCIA reporting debates. We think the pairing is apt: most governance programmes for AI agents begin with policy and model approval, yet the exposure sits in the sprawl of documents, messages and files that an agent will happily retrieve. Permissions on that content are usually inherited from years of loose sharing, so an assistant simply surfaces what people were always technically able to see. We would start by inventorying where unstructured content lives and who can reach it, and fix oversharing before switching on any retrieval feature. Classification labels only help if the agent's access layer honours them at query time, so test that directly rather than trusting vendor claims. Watch whether agent identity and audit logging mature quickly enough to let teams reconstruct what an agent read and why.
Written from the episode's published description. How we write these
Listen at CyberWire Daily ↗

This record begins with CISO Tribune's tracking in 2026 and is not a complete career history. Corrections welcome via the desk.

Related guides

CISO Podcasts: The Shows That Interview Sitting Security Leaders
Four active podcasts interview sitting CISOs: CISO Series Podcast, Defense in Depth, The New CISO and Risky Business Features. Hosts, cadence, sponsors.
CISO, CSO, VP of Security, Head of Security: What the Titles Mean and What the Record Shows
A chief information security officer (CISO) owns information security. A chief security officer (CSO) usually adds physical security and investigations.
How to Become a CISO: Career Path, Experience and Certifications
There is no CISO degree and no single route to the seat. What the certification bodies, career guides and CISO Tribune's own record show about the path: typical prior roles, the certifications that actually come up, and how long it takes.