There’s a veritable shell game going on in the c-suite of cybersecurity firm FireEye, which sells appliances to detect and block attacks in addition to data breach cleanup services. In its Q1 earnings report Thursday, the company followed mixed Q1 numbers with an announcement that CEO Dave DeWalt is moving aside for Kevin Mandia, FireEye’s current president. Mandia came on board as part of the company’s $1 billion December 2013 acquisition of his humbly named computer forensic firm, Mandiant. DeWalt, who joined the company four years ago, will become executive chairman effective June 15.

But wait, there’s more! Travis Reese, currently president of Mandiant, is scheduled to step into Mandia’s role as president of FireEye. And in a two-for-the-price-of-one move, Michael Berry, FireEye’s chief financial officer, will now also assume the role of chief operating officer. Enrique Salem, former Symantec CEO and sitting FireEye board member, will become the company’s lead independent director.

“Dave and our management team have succeeded in creating a security company with the technology, intelligence and expertise necessary to confront today’s advanced cyber risks,” said Mandia in a statement. “With today’s leadership announcements, I believe we’ve positioned FireEye for even greater success in the future.”

Meanwhile, whispers of winter is coming echoed eerily through Wall Street as shares dropped almost 19 percent by Friday. To be fair, though, Wall Street is always quick to see white walkers in the shadows.

In its quarterly report, FireEye adjusted its forecast to a range of $780 million to $810 million, down from $815 million to $845 million, as well as reported a 15.4 percent increase in losses year-over-year. However, its overall numbers were sound. The company announced $168 million in revenue from the first quarter of 2015, up 34 percent from Q1 2015, and closed 28 deals worth $1 million or more in the quarter.

“Kevin Mandia is the obvious choice to lead FireEye in the next phase of our journey, as we expand our product and service offerings, extend our reach worldwide, evolve our business, and influence the way the world thinks about cyber security,” said DeWalt in a statement.

Other than Mandiant, Mandia’s resume is remarkably light for the CEO of a major firm like FireEye. Before founding Mandiant, he served a three-year tenure as a director within McAfee’s professional services organization and another two as training director for Sytex Group, and IT services firm. Prior to that, he was an officer and special agent in the U.S. Air Force for six years.

However, Mandia was at the helm when FireEye investigated some of the biggest data breaches in recent memory, including those at Anthem (ANTM), Home Depot (HD), Target (TGT) and Sony (SNE). Mandiant rose to fame after publicly exposing a unit of the Chinese People’s Liberation Army as responsible for numerous hacks on American, Canadian and British companies dating back to 2006.

“Kevin was instrumental in bringing FireEye and Mandiant together and in the development of the security solutions, services and delivery models that are core to our strategy today,” said DeWalt. “We are fortunate to have Kevin – one of the security industry’s most powerful and respected voices and most sought-after cyber defense experts – as a member of our executive leadership team. Kevin and I share a common vision for FireEye and our industry, and I look forward to supporting him in his new role as FireEye CEO.”