Reporting to Engineering

So, I'm a CISO/director reporting to Engineering. When I first started, I said (to anyone who will listen), this would be problematic since I work for the business, not IT technically. Well, it just got REAL problematic when protocols weren't followed by my own boss recently. They did 3 things in one week which are huge security risks. I had to report them for one (since it could come up during audits) and that did not go well - they …

boss business ciso cybersecurity director engineering own protocols real reporting security things week work