CISA’s New Deputy Director Steers Amid Looming Staffing Challenges

CISA’s New Deputy Director Steers Amid Looming Staffing Challenges

Summary

• Madhu Gottumukkala has been appointed deputy director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
• He takes the job as the agency faces staff losses while its workload keeps growing.
• Before CISA, he was South Dakota’s chief information officer and commissioner of the state Bureau of Information and Technology.
• He says his focus is collaboration with state, local and private-sector partners.

Introduction: Transition in Leadership

CISA has a new deputy director. Madhu Gottumukkala joined the agency in May 2025, at a time when it is losing staff and facing pressure on its budget. The demands on it have not eased. Ransomware gangs, state-backed hackers and attacks on critical infrastructure keep CISA busy, and fewer people are now doing that work.

The Leadership Change

Gottumukkala comes from state government rather than from inside DHS. He served as South Dakota’s chief information officer and commissioner of its Bureau of Information and Technology from September 2024, after a short stint as the state’s second-ever chief technology officer. Before that he was senior director of IT for business solutions at Sanford Health. He holds a Ph.D. in information systems from Dakota State University.

He follows Nitin Natarajan, who held the deputy director post under the previous administration. In CISA’s announcement, Gottumukkala said he had seen “firsthand” the agency’s work as a former state and local leader and wanted to build on it.

Addressing Staffing Shortfalls

Staffing is the obvious challenge. CISA competes with private employers for the same scarce security talent, and it has lost people through departures and cuts. Keeping skilled staff and hiring new ones will shape how much the agency can do.

Training is one lever. Better development programs can help existing employees take on harder technical and analytical work, which matters more when headcount is falling.

Strengthening Infrastructure and Outreach

The other part of the job is outreach. CISA depends on partners in every critical infrastructure sector to share information and act on its warnings, and much of its value comes from those relationships.

Gottumukkala has said he wants to strengthen collaboration across all levels of government and the private sector. His background running a state IT department gives him a direct view of what state and local agencies need from CISA.

What Comes Next for CISA

CISA now has a deputy director with state-level experience at a moment when the agency is being asked to do more with less. How he handles staffing will be watched closely.

The stakes are high. CISA’s warnings and guidance reach thousands of organizations that run water systems, hospitals, power grids and local government networks. If the agency can keep its partnerships strong while rebuilding its workforce, those organizations will still have a federal ally when the next major attack hits.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.