Former Uber CSO Joe Sullivan, who was fired last November following disclosure of Uber's 2016 data breach, is joining Cloudflare as its CSO
I love working as a Chief … Parikshit Mishra / Reuters : Former Uber cyber security chief Sullivan joining Cloudflare
Context & Ripple Effects
Joe Sullivan's move to Cloudflare closes one loop and opens another. Uber lured him from Facebook in 2015 as its first-ever chief security officer, then fired him last November once the company disclosed that a 2016 breach of millions of users' and drivers' records had been kept quiet — and Uber has since installed former NSA general counsel Matt Olsen in the role via its own CSO reset.
For Cloudflare, the hire brings in an executive who has lived through the worst-case version of a security leader's job: a major breach, a disclosure fight, and a public firing. What neither company could have known at announcement time is that the decision would follow him — federal prosecutors later charged Sullivan with obstruction over the concealment, and his trial became the reference point for whether CSOs personally face criminal exposure.
First-order effects
- Cloudflare gets a CSO with direct experience managing breach response and law-enforcement disclosure decisions at consumer scale, while Uber's security leadership transition to Matt Olsen is now fully decoupled from Sullivan's next move.
Second-order effects
- Sullivan's later obstruction charge and trial forced every company that employs a CSO — including Cloudflare itself — to confront how much personal legal risk sits in breach-disclosure judgment calls, with some CSOs publicly arguing he did nothing wrong and that the case tests penalties they could face.
Third-order effects
- If the pattern holds, breach handling stops being a corporate reputational matter and becomes a personal-liability one: security executives will demand legal cover, documented escalation paths, and counsel before disclosure decisions, reshaping how the CSO role is scoped and contracted across the industry.
The trend: Security leadership is shifting from a purely operational role to one carrying personal legal accountability, with the Sullivan arc from hire to firing to prosecution marking the clearest data point yet.