Is there any better way you could set this up? Just asking for a friend.

Get the downside risk people in tech to report to somebody who is accountable for managing downside risk at the same level of the CTO.

Typically an intelligent and tech literate CFO or Chief Risk Officer.

If the Head of Security and the CTO can’t come to a deal, it reaches the ExCo or board for a decision.

I call this “creative tension” and it works better than the alternative.