Federico Ciulla

About

I never set out to become a Field CISO. I started working at eighteen, fascinated by networks and with a habit of taking gear apart until I understood how it worked — and I turned that curiosity into seventeen years of hands-on roles and a stack of certifications (CISSP, CISM, CCSP, CCSK), each earned the hard way, one exam at a time.

That path took me from configuring networks for Italy's Civil Protection Department and the European Space Agency, to leading Field CISO engagements at Workday across Europe and South Africa, to designing cybersecurity architectures for government and defense customers at Fortinet. Today, as Principal Cybersecurity Advisor for Continental Europe at Salesforce, I sit at the intersection of security, regulation, and business — helping CISOs, CIOs, and DPOs at public-sector and highly regulated organizations navigate GDPR, NIS2, DORA, the EU AI Act, and digital-sovereignty requirements without slowing down their cloud adoption. Day to day, that plays out through executive presentations and briefings, speaking at industry and marketing events, and leading in-depth technical discussions with customers on the security of the products they adopt.

What I actually enjoy is the translation work: taking something dense — a regulation, an audit finding, a compliance blocker — and turning it into a decision an executive can act on with confidence. I do the same thing on stage: I've trained 250+ security professionals for their CISSP exams, because I like handing people the same shortcuts nobody handed me.

Outside of work, most of my time goes to my family — I have twins who keep life full and rarely quiet — and to the things that recharge me: a game of tennis and, above all, cooking, which is my favorite way to slow down and bring people together.

Experience

1. Sep 2025 – Present

   

   Principal Cybersecurity Advisor, Continental Europe

   Salesforce

   • Regional Principal Cybersecurity Advisor for Continental Europe, advising public-sector and highly regulated organizations on cybersecurity, privacy, compliance, and digital sovereignty in Salesforce cloud adoption — contributing to $10M+ in ACV across 99 accounts and 126 opportunities as embedded Security Architect, spanning public sector, social security, and defense customers.
   • Advise C-level and technical stakeholders on AI governance and security for Agentforce and other AI-powered deployments — spanning AI risk assessment, model governance, data privacy, and human-in-the-loop controls — and authored technical compliance guidance adopted for new product launches.
   • Lead technical and regulatory responses across healthcare, social security, public procurement, and pension-fund customers — covering CLOUD Act exposure, ACN Regolamento Cloud, and NIS2 compliance — unblocking stalled procurements, including a $3.9M+ engagement.
   • Delivered SPID/CIE/SAML technical reviews for public-sector deployments and built ACN QC2 qualification arguments; authored technical compliance guidance for new products and led cross-functional escalation of an ACN QC2 certification blocker, driving product-side remediation commitments to unblock major deals.
   • Partner with Sales, Product, Legal, Compliance, and Engineering to translate data-protection, international-transfer, and resilience requirements into trusted architectures, and represent Salesforce externally as a thought leader in trusted cloud and AI adoption.

2. Jul 2024 – Sep 2025

   

   Senior Cybersecurity Sales Engineer, Public & Defense

   Fortinet

   • Led all technical evaluation efforts (RFIs, RFPs, POCs) for multiple central-government clients and defense administrations as primary security architect, aligning solutions with regulatory and operational requirements.
   • Designed tailored cybersecurity architectures with customers to address specific pain points, positioning Fortinet as the best-fit solution against competing vendors.
   • Delivered weekly technical and executive presentations that translated complex security concepts into clear value propositions — driving a 25% improvement in deal-closure rates and $11M in ACV closed within one year.

3. Jul 2015 – Jul 2024

   

   Principal Cybersecurity Advisor / Field CISO — Europe & South Africa

   Workday

   Progressed over nine years: Network Security Engineer (2015–17) → Cybersecurity Advisor, Field CISO (2017–19) → Senior Cybersecurity Advisor, Field CISO (2019–21) → Principal Cybersecurity Advisor, Field CISO (2021–24).

   • Advanced from Network Security Engineer to Principal Cybersecurity Advisor / Field CISO for Europe & South Africa, driving a record $500M in influenced revenue in 2023.
   • Acted as primary technical advisor to CTOs, CISOs, CIOs, and CSOs, aligning Workday's security capabilities with customer objectives to accelerate cloud adoption and close high-value HR, Finance, and IT deals.
   • Trusted advisor on ISO 27001/27017/27018/27701 certifications, SSAE18 SOC-1/SOC-2 Type II audits, EU Standard Contractual Clauses, Binding Corporate Rules, and GDPR; led vulnerability assessments, threat intelligence, and breach-notification processes.
   • Earlier in tenure, designed next-generation data center security architectures and established Workday's first European network security laboratory.

4. 2008 – 2015

   Early Career — Network & Security Engineering

   ESA · Italian Civil Protection · WIND · Lottomatica · BT Italia

   • Built a technical foundation across telecom, public sector, and mission-critical environments: designed secure network architecture for the European Space Agency's Earth-observation satellite network.
   • Led national emergency-response and seismic-monitoring network infrastructure — including a nationwide autonomous BGP system and a 20 Gbit/s network migration — for the Italian Civil Protection Department over four years.
   • Delivered multi-vendor security solutions, RFP leadership, and technical presentations at Ikran Services, WIND Mobile, Lottomatica, and BT Italia.

Get in touch

The best way to reach me is on LinkedIn — always happy to talk cybersecurity, cloud trust, and the messy space between regulation and adoption.

• LinkedIn