As CIO, Oddbjørn has overall responsibility for Sicra’s internal IT and for building the structures, processes, and systems needed to support the company as it grows. His responsibilities range from internal IT operations, system ownership, and vendor management to ISMS, GRC, quality and environmental certifications, the IT budget, and internal security procedures. He is also responsible for the portfolio of internal improvement projects and for ensuring a high level of operational quality across IT operations.

Oddbjørn therefore works at the intersection of technology, security, governance, and business, with particular responsibility for ensuring that Sicra’s internal IT environment develops in step with the company’s growth.

What does the CIO role at Sicra involve?

The role is about ensuring that Sicra has an internal IT function that is secure, efficient, and scalable. As the company grows, its systems, processes, and responsibilities need to evolve along with the organization.

This includes responsibility for internal IT operations and staffing, system ownership, vendors and agreements, the IT budget, ISMS and GRC, certifications, and internal security procedures. I am also responsible for the portfolio of internal improvement projects, ranging from integrations and efficiency improvements to larger technology initiatives and organizational changes.

For me, the CIO role is largely about creating the right conditions for the rest of the business. Our technology and processes should make it easier to work efficiently, securely, and to a high standard, even as we grow and the organization becomes more complex.

What is the biggest security challenge organizations face today?

Many organizations experience that requirements related to security, documentation and compliance are becoming increasingly complex. At the same time, they must manage rapid technological change, cloud transformation, AI and increasingly advanced threats.

The challenge is often not a lack of technology, but a lack of holistic thinking and maturity. Many organizations have individual solutions, but lack alignment between security, operations, leadership and business goals.

You work extensively with NIS2 and regulatory requirements. What does this mean for Norwegian organizations?

NIS2 will impact far more organizations than previous regulations. It is not only about IT security, but about organizations’ ability to protect critical societal services and manage risk in a structured way.

For many, this means stricter requirements for governance, risk management, supplier control, incident management and documentation. But the most important thing is not the compliance aspect itself, the most important thing is building resilient organizations that can actually withstand incidents.

How should organizations think about information security?

The best organizations succeed in making security a natural part of business governance. Security cannot exist in isolation within the IT department. It must be anchored in leadership and integrated into how the organization works with technology, people and processes.

At the same time, solutions must be practical and understandable. If security becomes too complicated, people often find shortcuts, and much of the effect disappears.

What areas are you particularly interested in professionally?

I am very interested in the connection between technology, security, and business. Good security is not just about technical controls. It is about understanding risk, maturity, and how technology is actually used within the organization, as well as how investments in security and technology support the group’s strategic objectives.

I am also interested in how organizations can modernize IT operations and security without losing control or creating unnecessary complexity.

In the CIO role, I am particularly focused on how we can build an internal IT function that scales with the business. This means making good technology choices, establishing clear system ownership, building robust processes, and continuously improving, while also ensuring that our investments actually create value and make the organization more efficient.

AI is a natural part of this. I am interested in how organizations can adopt AI securely and responsibly, with strong AI governance, clear ownership, and appropriate control over risk, data, and compliance. The goal must be to take advantage of the opportunities the technology provides without losing control along the way.

You have experience with major transformation and outsourcing projects. What do you learn from that?

You learn how important people, communication and culture are in technology projects. Technology alone rarely solves the challenges. To succeed with change, you need to bring the organization with you, build trust and create understanding for why the changes are necessary.

As Group CIO at StrongPoint, I led a group wide IT improvement program across 8 countries and 24 offices, from consolidating three regional operations partners into one global partner to achieving a group wide ISO 27001 certification that created direct business value through new international customers. At Schibsted, I served as deputy project manager for the IT outsourcing program to IBM across more than 35 companies and 3,600 employees. A common factor across all of these initiatives is that leadership anchoring, clear governance models and business justification matter more than the technology choice itself.

What is important when IT needs to support a growing business?

It is easy to underestimate how much complexity comes with growth. More people, systems, vendors, and integrations also mean more dependencies and greater demands for structure and governance. The challenge is to professionalize IT operations without making the organization unnecessarily cumbersome. We need control over system ownership, security, costs, vendors, and quality while still being able to make changes quickly. The goal is for internal IT to enable growth, not become a bottleneck.

What characterizes good internal IT operations?

Good IT operations are often most noticeable when everything simply works. Users should have the right tools, systems should be stable and secure, and it should be clear who is responsible when something needs to be changed or improved. Behind this are good processes, clear ownership, security procedures, and continuous improvement. Operational quality is important to me. We should not just solve problems when they arise, but continuously look for ways to work smarter, more securely, and more efficiently.

What do you want customers to experience when working with Sicra?

I want customers to experience Sicra as a trusted and highly competent partner that understands both technology and business. We will help organizations navigate an increasingly complex security landscape in a way that is practical, realistic and value creating.

What motivates you in your work?

What motivates me most is making improvements that genuinely make a difference to organizations and people. I enjoy building structures, processes, and solutions that make organizations more secure and resilient over time. At Sicra, it is particularly motivating to apply this experience internally and help build an IT function that can support the company through its next phase of growth.

Is there something people may not know about you?

I am very passionate about hunting, fishing and outdoor life, and I spend a lot of time in nature. My interest in hunting and fishing has also led to a strong interest in cooking and growing my own ingredients.

I actually also hosted a podcast about gardening and cultivation together with a friend. We talked about everything from tomatoes and berry bushes to roses and vegetable gardens, which is perhaps a slightly broader set of interests than people expect from a CIO.