Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsIn a July 2021 interview with CSO Online, Jonathan Scott-Lee, then HSBC’s Chief Information Security Officer for Asia Pacific, argued that cybersecurity employers should focus less on quotas and more on awareness, acceptance and practical support for neurodivergent employees.
Scott-Lee’s story is not evidence that neurodivergent people are automatically better at cybersecurity. It is a case for removing recruitment, communication and workplace barriers so people with different ways of thinking can contribute and progress.
As an Amazon Associate I earn from qualifying purchases.
Who was Jonathan Scott-Lee at HSBC?
At the time of the 2021 interview, Jonathan Scott-Lee was HSBC’s CISO for Asia Pacific. He had also volunteered as the bank’s regional neurodiversity ambassador for digital business services teams across Asia Pacific. A contemporaneous HSBC LinkedIn post presented his personal neurodiversity story and leadership role.
Scott-Lee described himself as having ADHD and Asperger’s. Because diagnostic language and personal preferences vary, it is more accurate to report the terminology he used in that interview rather than silently relabel it. Many people today prefer terms such as “autistic,” while others use different language.
#1 Best Overall
His wider background included technology, financial services, machine learning and legal and regulatory work. That combination mattered to the story because he was discussing neurodiversity not as an outside commentator, but as a senior cybersecurity leader who had navigated technical, organizational and stakeholder-heavy roles.
The available reporting is historical. It does not establish whether Scott-Lee remains at HSBC, whether he is still Asia-Pacific CISO, or whether the ambassador role continues in 2026.
What did he mean by championing awareness?
Scott-Lee’s objective was broader than recruiting a certain number of neurodivergent employees. He described awareness as a way to help both neurodivergent and neurotypical colleagues understand difference, support one another and create an environment where employees could bring more of their authentic selves to work.
Recommended Free Tools
That included making it safer for people to disclose or discuss less visible forms of neurodivergence. He also emphasized helping people who were already in existing jobs, rather than assuming that neurodivergent employees should be moved into specially designated roles.
This distinction is important. An organization can advertise an inclusion initiative while leaving its hiring interviews, meeting practices, promotion criteria and management habits unchanged. Awareness becomes meaningful only when it changes how work is designed and how people are evaluated.
Rank #2
Why cybersecurity can benefit from different perspectives
Cybersecurity involves a wide range of work: engineering, incident response, threat intelligence, investigations, governance, risk, compliance, communication and leadership. No single cognitive profile is suited to all of it.
Scott-Lee said that, in his experience, an interest in technical and quantitative subjects, comfort with detailed systems, intense focus on topics of interest and the ability to approach problems from different perspectives could be valuable in technical security work. He also discussed managing multiple workstreams and, in some situations, preferring structured or binary forms of problem-solving.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Those observations should be treated as personal experience, not as universal characteristics. Neurodivergent people are not a homogeneous talent category. Autism and ADHD can involve different strengths, challenges, communication styles and support needs. Nor does neurodiversity by itself prove better security outcomes.
The defensible argument is narrower: teams may become more effective when they include genuinely different perspectives, provided the workplace allows those perspectives to be used. Hiring someone for an assumed “neurodivergent strength” while ignoring their actual interests and needs simply replaces one stereotype with another.
The barriers are often organizational
Scott-Lee’s account also described the effort required to operate within conventional workplace expectations. At senior levels, stakeholder management became increasingly important. He discussed difficulties with implicit social rules, interpreting facial expressions and body language, knowing when not to interrupt and consciously performing behaviors that other people might handle automatically.
He described that performance as exhausting. He also discussed disruption caused by inconsistent routines and the difficulty of reading body language during video conferences. A remote meeting can remove many of the contextual cues people rely on, while still expecting quick responses and conventional participation.
Free tools Windows power users keep installed
One-click scans. No signup required.
A related eFinancialCareers report described his account of a later ADHD diagnosis, autism disclosure and social masking. These are reported personal observations, not proof that every neurodivergent employee experiences masking, exhaustion or social communication in the same way.
Recruitment can create similar barriers. Standardized tests, unstructured interviews and vague judgments about “culture fit” may reward speed, eye contact, small talk or conventional communication style rather than the ability to investigate an incident, understand a system or make a sound risk decision. That does not mean every test is unfair, but it does mean employers should examine what each assessment actually measures.
What support did Scott-Lee describe receiving?
Scott-Lee said HSBC’s culture enabled him to bring his authentic self to work and that colleagues supported him. He also described practical assistance from his business manager and secretary with organization and diligence.
That example illustrates two different kinds of inclusion:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Awareness and acceptance: colleagues understand that people may communicate or work differently and do not treat difference as a lack of commitment.
- Practical support: trusted colleagues or workplace adjustments help with organization, prioritization and day-to-day execution.
Neither approach requires lowering standards. The objective is to make expectations clear and assess agreed outcomes, rather than requiring everyone to achieve them through an identical working style.
Awareness is not the same as a quota
Scott-Lee explicitly resisted reducing neurodiversity to quotas or occupational targets. His preferred emphasis was awareness, mutual appreciation and teams in which people could support one another while contributing different strengths.
That is his stated philosophy, not proof that representation data is unimportant. Organizations still need to distinguish between several questions:
- Do candidates have fair access to recruitment and promotion?
- Can employees request accommodations without career penalty?
- Are neurodivergent employees retained and able to progress?
- Are they concentrated only in junior or narrowly technical roles?
- Do managers know how to provide clear, effective support?
A headcount target can reveal an access problem, but it cannot by itself show whether a workplace is inclusive. Conversely, a culture campaign without measurable outcomes can create the appearance of progress without changing employees’ experience.
Practical steps for cybersecurity and HR leaders
The following actions are broader workplace recommendations informed by the issues raised in Scott-Lee’s interview. They are not documented HSBC policies.
Best Value
Recruitment
- Write concrete job descriptions and separate essential technical requirements from vague requests for “excellent communication” or “culture fit.”
- Explain interview stages, evaluation criteria, expected working conditions and likely meeting demands in advance.
- Use structured interviews with consistent questions and scoring rather than relying mainly on informal impressions.
- Where feasible, offer more than one way to demonstrate competence, such as a work sample, written response or additional preparation time.
- Do not treat eye contact, rapid verbal responses or conventional social fluency as substitutes for security ability.
Onboarding and management
- Document priorities, ownership, deadlines and escalation paths.
- Provide agendas before meetings and written follow-up afterward.
- Make meeting norms explicit, including how people can contribute without interrupting or competing for airtime.
- Ask employees what support is useful instead of assuming that a diagnosis predicts a particular need.
- Give direct, specific feedback and evaluate performance against agreed outcomes.
Work design
- Protect focused work when operationally possible and reduce unnecessary interruptions and ambiguous task switching.
- Offer communication choices, such as written follow-up or asynchronous responses for suitable tasks.
- Provide quiet or lower-distraction work options where available.
- Make hybrid meetings easier to follow with clear agendas, captions, chat, recordings or written summaries as appropriate.
- Maintain predictable routines where possible and give advance notice of significant changes.
Career progression
- Ensure promotion criteria reward leadership, judgment, delivery and results rather than performative sociability alone.
- Provide mentoring and sponsorship, not just entry-level hiring initiatives.
- Give employees a route to management if they want it, while recognizing that leadership styles can differ.
- Do not funnel neurodivergent employees permanently into coding, testing or analytical roles based on assumptions about their diagnosis.
- Protect voluntary disclosure and accommodation information as sensitive workplace information.
How organizations can tell whether inclusion is working
Companies should measure more than participation in awareness events. Useful indicators can include applicant and hiring-funnel outcomes, retention and promotion rates, the time taken to resolve accommodation requests, employee experience and psychological-safety results, and managers’ confidence in providing support.
It is also worth examining whether neurodivergent employees are disproportionately concentrated in junior positions or narrow job families. Disclosure data must be handled carefully: disclosure should remain voluntary, confidential and clearly separated from decisions about performance or advancement.
None of the supplied reporting establishes that HSBC uses these measures. They are practical ways any organization could test whether an inclusion message is producing durable workplace change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is documented—and what is not
The documented account is a July 5, 2021 CSO Online interview in which Scott-Lee was identified as HSBC’s Asia-Pacific CISO and regional neurodiversity ambassador for digital business services teams. The interview records his self-description, his views on awareness rather than quotas, his account of workplace barriers and the support he received.
It does not provide HSBC-wide hiring, retention, promotion, disclosure or accommodation data. It does not detail the ambassador role’s governance, budget, training or success measures. It is also centered on one senior executive rather than a broad sample of HSBC employees.
More recent HSBC annual-report material describes a global CISO structure supported by business and regional CISOs and ongoing cybersecurity awareness activity, but it does not verify Scott-Lee’s current title or the continuation of this particular ambassador role. Readers should therefore treat the HSBC initiative as a documented 2021 example, not as a confirmed 2026 program.
The broader lesson for security employers
Scott-Lee’s message is strongest when it is not turned into a claim that autism or ADHD is a cybersecurity advantage. The lesson is that capable professionals can be blocked by recruitment systems, social expectations, unpredictable routines and promotion standards that measure conformity more readily than competence.
Neurodiversity awareness can open the conversation. Inclusion requires the harder work that follows: clear expectations, fair assessment, practical accommodations, capable managers, voluntary disclosure protections and career paths that do not depend on performing a single model of professionalism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
