How To Hire a CISO

The Chief Information Security Officer (CISO) does what the title suggests.  They are responsible for information security both internally and externally in a business.  Every business, small, medium, or large, relies on information and technology to function, and the CISO is there to monitor potential technology threats to your company and mitigate risk.  Could your business survive a ransomware attack?  What would happen if your social or email server got hacked and deleted?  Knowing how to hire a CISO, especially a qualified top-class one, is more critical than ever.

In the modern age, digital information security is more important than ever, especially with the extreme financial repercussions that failing at regulations like GDPR can have on a business.  Additionally,  the damage to the brand and reputation of a hack or leak can devastate a company.  It is self-evident how fundamentally important a good CISO hire is for a sophisticated business.

In this guide, I will first explore what a CISO does, the responsible, and how the function should be compensated.  Before I share my best practices on how to hire a CISO, let’s define the position.

What is a CISO

The Chief Information Security Officer (CISO) is the most senior-level executive responsible for developing and implementing the company’s information security program.  This includes developing and refining procedures and policies which ensure the security and robustness of IT systems, communications, data, and digital assets from internal and external threats.

The CISO is sometimes referred to as the Chief Security Architect.   Sometimes the role is made to include the responsibility for physical security and then referred to as a Chief Security Officer (CSO).

Responsibilities of a CISO

The List of responsibilities for your next CISO may include:

• • Training employees on digital security
  • Ensuring digital security compliance
  • Ensuring the company is compliant with local, federal and global laws (GDPR)
  • Ensuring the security of the companies data
  • Developing and managing the company’s computer security incident response team
  • Managing and implementing various security and monitoring tools on employee devices
  • Conducting digital security audits
  • Ensure newly developed technology solutions are secure

Who does a CISO report too?

You need to consider who the CISO your hiring is going to report to.  Given your company’s structure and industry may impact the profile you are looking for.  Here are the typical reporting structures:

• • • The CISO traditionally reports to the CIO and or CTO. However, this is becoming less popular.  In order to avoid security risks involved in a project are not being underplayed by the CTO or CIO when communicating to directors or the CEO.
    • Now it’s becoming more popular for the CISO to Report to a Chief Risk Officer (CRO). Many businesses appoint a CISO and CRO to show how important they take cyber security and risk.  As multiple leaders specialize in risk mitigation, it’s far more difficult for any security risks to be overlooked and unaddressed.
    • Depending on the company’s size, CISO often sometimes reports to the CEO. Sometimes the reporting is done to ensure no observed risk gets watered down in the communication chain.  This generally requires the CISO to have a high level of business acumen and communication skills, so they can effectively talk to the CEO, board, and other c-level leaders as they aid in developing the business direction.
    • Another option is for the CISO to report to the COO.  This is done so that tools selected and implemented in the business are secure and compliant.  It gives cyber security and technology equal importance and is very popular in financial services, where security is paramount, and a high budget is allocated out of necessity.

How to compensate a CISO

In the USA, the base salary for a CISO is the following per percentile:

10% – $174,001
25% – $200,513
50% (Median) – $229,633
75% – $265,203
90% – $297,588

With the average including Salary + bonuses + benefits coming to: $365,140

In start-ups, we can see that CISOs are generally well compensated, and companies offer 1-3% equity.

What Qualifications should a CISO have?

A Bachelor and/or Masters in IT/computing and data security is important.  Qualifications are not always necessary, but they help you ensure that the CISO hire you are considering is experienced to the level they say they are.  Given your IT structure, you may need extensive experience with cloud security knowledge and enterprise server security.

Some qualifying acronyms that you may look out for may include CISSP, ISACA, (ISC)2, CISM, CISA, and CRISC.  Ideal candidates are wired for continuous learning.  The landscape feels like it is changing daily.

Working with executive search firms can help you understand your needs.  At Boyden, where I am Managing Partner, we have offices in 43 countries with recruiters that specialize in highly specialized technology functional roles like a CSO.  If you want me to connect you to the right people to help you with your search, please contact me!