When major cyber incidents strike – what many organizations see as their “worst day” – calm leadership and clear communication make all the difference.
For Jack Santaroni ’20, a Senior Security Consultant at Unit 42 by Palo Alto Networks, guiding clients through high-stakes situations like that is just another day at the office.
Santaroni began his military service as an Information Assurance Specialist in the Air National Guard before earning his bachelor’s degree in Information Technology with a concentration in Networking and Cybersecurity from the Mount in 2020. Balancing his military responsibilities with coursework gave him immediate, real-world context for what he was learning in class.
“While I was at the Mount, I was doing the military side, so I kind of got a lot of good experience taking what I was learning in the classroom and applying it. And then vice versa,” Santaroni shared.
Following his graduation, Santaroni transitioned to full-time military service while earning a master’s degree in Information Security Operations from Champlain College. That path eventually brought him to Unit 42, where he advises external organizations on cyber risk assessments, framework alignment, governance design, and tabletop simulation exercises.
“Essentially, what I do now at Unit 42... we work for other organizations,” said Santaroni. “We meet with customers, we ask, ‘What do you want? What are you looking to get out of your security program?’ I do more of the advisory and risk assessment side – cyber risk assessments, NIST Cybersecurity Framework, ISO frameworks, CIS benchmarks – and program design to help organizations develop policies, procedures, and stand up their governance programs.”
While technical know-how is vital across the industry, Santaroni highlighted that Governance, Risk, and Compliance (GRC) roles rely heavily on bridging the gap between technical teams and executive leadership.
“I’m more of a business liaison, which is what GRC is,” Santaroni explained. “I’m interfacing more with business leadership... If someone does a penetration test for a client, I would get on the GRC side and say, ‘Hey, what’d you find?’ and then take that to tell the CISO or the CEO and tell them what this means and what it’s going to cost to fix.”
Because of that role, Santaroni emphasized that active listening and genuine communication are what help candidates stand out in interviews.
“I’m more focused on communication and soft skills,” Santaroni noted. “Can you communicate well? Are you confident? And do you generally know what you’re talking about? If I’m asking you about a risk management concept, I don’t want to hear you give me a textbook answer... I care that you know the concept and you can generally speak through it.”
For anyone in the Cybersecurity field – including students – Santaroni cautioned against over-reliance on automated outputs without truly understanding the concepts behind them. In an environment where AI tools can easily generate complex jargon, Santaroni emphasized the lasting value of human judgment and critical thinking.
“Anybody can go out and run an AI script and it’ll spit out something, but there’s probably stuff in there that doesn’t make sense or is way too complicated,” Santaroni remarked. “You still need to be able to speak. The most important thing is having an understanding. I don’t think that we [Cybersecurity professionals] are going to be replaced [by AI] anytime soon. There’s always going to be a need for people to speak and solve problems.”
For current Mount students preparing to step into the workforce, Santaroni’s message was clear: stay curious, learn the fundamentals, and be ready to listen and learn.
When interviewing candidates, “I don’t expect you to know everything,” Santaroni said. “I know that I can teach you things. I just want somebody who is going to receive that well. Can we talk like humans on the interview? And are you showing me that you want to be here to understand this? That’s the most important aspect.”