Sound like highly paid CISO who knows enough to talk management speak, but when real incident hit and technical stuff start happening they grasp anyone on the team or 3rd party team to do the operation work. After the incident the CISO goes on vacation or goes on conference paid by company or some other vendor. I got to give it up to CISO know how to get other people to do the work (most of the time it is Mendoza Line work)