How to become a Chief Information Security Officer

Chief Information Security Officer or CISO is a person who is responsible for devising strategies and providing leadership to the information security teams. This is to ensure that all the information assets of a company and every software, application, and tool are free from vulnerabilities and bugs. The job is to keep each and every asset related to information technology completely safe and secure. It is a senior-level executive position, with the responsibility for developing and maintaining the strategy, vision and program for the company’s IT assets. CISO is a leadership position and the person are expected not just to devise strategies but also mentor other staff and help them understand and implement information security policies of the company.

CISOs are the first ones to respond to any incident and develop strategies, set standards, define controls, manage security technologies and supervise the implementation of policies and procedures. It is the responsibility of the CISO to ensure compliance related to the information.

Despite the importance of this role, there are many organizations around the world who don’t have a permanent position of CISO and such companies mostly rely on IT security consultants or IT managers. This shows that choosing CISO as a career path would be a prudent choice, surely the path that leads to CISO is not an easy one. Let this article be your guide and help you understand how you can become a Chief Information Security Officer in public or private companies.

Roles and Responsibilities of CISO

Chief Information Security Officer is the person who is supposed to set the directions for the IT team and work with other top-level executives to get cybersecurity services and products. Whereas it is also the responsibility of a CISO to manage disaster and have a backup plan ready in case information assets of a company are compromised by cyber-criminals or hackers. Normally, CISO's influence affects the entire organization. Responsibilities may include, but are not limited to:

• Security Architecture
• Regulatory compliance of information
• Privacy Policy
• IT investigations, digital forensics, eDiscovery
• Information technology controls for systems and other
• Information Security Operations Center
• Information security and protection control
• Information Risk Management
• Identity and access management
• Disaster Recovery and Business Continuity Management
• Cybersecurity
• Computer Emergency Response Team/Computer Security Incident Response Team

A CISO may also be referred to in an organization as information security director may, chief security architect, security manager, corporate security director or information security manager, depending on the structure of the company and the existing titles. Regardless of the name a company may refer to its CISO, the expectations from the position holder are to protect complete corporate security including the data related to customers, employee details, and other corporate functions.

A CISO is expected by employers to plan in advance and not wait for a security incident or data breach to happen. This is more of a job that is linked to prevention rather than reaction. A CISO is expected to analyze all the threats and risks associated with a company’s system and work for creating a robust IT security policy that ensures the prevention of such events. Another responsibility of a CISO is ensuring smooth coordination with other department heads so that all the functions of an organization continue as they are expected to and reduce the risk of any potential attack. 

Other responsibilities, which may vary from company to company include conducting training to create awareness among employees about IT safety, devise strategies to ensure safe and secure communication within the organization and with other stakeholders, identify objectives of security policies, and select the right vendors for purchasing security-related equipment. It is also the responsibility of a CISO to ensure that the company has policies and practices in place that are in compliance with international standards.

Based on ISO27001, theoretically the CISO is responsible for 14 domains that ISO defines, but this depends on the size of the company, how the company is organized in the related technical functions and the hierarchical position of the CISO in the structure. So, we can say that basically, the CISO is responsible for defining policies and ensuring the implementation and effectiveness of the following technical domains:

• Access Control
• Acquisition, Development, and Maintenance of Systems
• Asset Management
• Conformity
• Continuity Management
• Encryption
• Information Security Incident Management
• Organizing Information Security
• Physical and Environmental Safety
• The relationship in the Supply Chain
• Security in Communications
• Security in Human Resources
• Security in Operations
• Security policy

Other duties and responsibilities that CISOs play includes ensuring that the privacy of a company is secure, managing the computer security incident response team, and conducting digital forensics and IT audit.

Qualifications and Certifications required to become a CISO

As explained in the roles and responsibilities of CISO that leading and managing IT and cybersecurity teams are part of the job but it is worth noting that CISO must have excellent communication skills and great command over complicated security concepts. Excellent communication skills are really important as often CISO has to explain technical concepts to non-technical people including the board of directors and other stakeholders. A CISO should also have the ability to assess risks, propose risk mitigation strategies, and perform an IT audit.

Nowadays CISO is considered an Information Security Risk Administrator. We all know that 100% security does not exist in the cyber world, but to achieve the level of security closer to that is generally expected from a CISO.

A CISO must be able to assess the inherent risk of the scenarios and the reality of the company in order to propose and implement the required level of protection based on the impact and likelihood of an event occurring. Generally, companies expect CISOs to have advanced degrees not only in computer science/ computer engineering/ mathematics but also in business as the person is expected to lead a company and should have the ability to assess the impact of any event on the overall business of a company. However, merely obtaining advanced degrees is not enough as to become a CISO you have to have extensive work experience.

Relevant certifications and training can also help you in becoming a CISO as they give you additional skills needed to tackle the evolving cyber threats. You can browse QuickStart’s huge library of cyber security courses and choose the right ones for you as additional certifications might make your path to become a CISO easier. 

Another important point is the ethical question. CISO must be a model employee and act ethically in relation to the confidentiality of information. The person must be discreet about the facts, a good listener, trustworthy, reliable and faithful to his principles of honesty and integrity of conduct.

Possible Career Paths

Becoming a CISO is not an easy path, a person has to work hard and develop the required skills to progress in the career. You need to have advanced degrees in computer science/ engineering and business management along with extensive work experience and additional certifications. To achieve your goal of becoming a CISO one day, you generally have to go through the following six steps:

Step 1

You have to start from the start. This means the first step in becoming a CISO is to start as a programmer, analyst or a security software developer.

Step 2

The next step is to further your education and get advanced degrees. Your next goal should be to reach the position of a security analyst.

Step 3

Obtain additional certifications and luckily in the digital age, it is easier to get additional certifications. You can browse QuickStart’s library to find the relevant courses and move one step closer to your goal.

Step 4

Work hard to become a leader of a security team. The additional certifications and advanced degrees will surely be of great help in this regard.

Step 5

Get an MBA with a specific focus on IT security as CISO’s must have the knowledge and skills to understand the complex business environment.

Step 6

Again, work hard to get a promotion as a Chief Information Security Officer.

Hard Skills

A CISO must have excellent command over the management of complex IT infrastructure. CISOs are generally not involved in micro-managing things and provide leadership, guidance, vision, and strategy of the overall organization’s IT security than getting involved in daily tasks. A few of the necessary hard skills that a CISO must demonstrate include:

• Application and database security
• Information assets security management
• Crisis management and solution
• Data and information management
• Disaster recovery planning
• Identity management
• Mobile and remote device management
• Network security and firewall management
• Security infrastructure development
• Security policy development

Soft Skills

In terms of soft skills, a CISO must be an excellent leader with strong communication and negotiation skills. It is one of the most important roles in any organization and thus the person is expected to manage his team as well as coordinate with other teams of the organization. The CISO also have the ability to explain technical concepts to non-technical individuals including stakeholders, investors, employees, and others.

It’s a position of influence, which extends beyond the teams that work under CISO. The CISO must be able to lead, take important decisions, and train employees in a way that they follow all the defined security protocols to ensure the security of the information assets of the organization.

Certifications

CISOs are generally expected to have various certifications like CISP and CISM among others. There are various certifications available to individuals who wish to become a CISO one day. You have to have excellent command over all the IT security related concepts, should you wish to become a CISO. This can be done by obtaining various certifications including but not limited to:

• Certified Information Systems Auditor by ISACA
• Certified Information Security Manager by ISACA
• Security Leadership by GIAC
• Certified Chief Information Security Officer by EC-Council
• Certified Information System by QuickStart

Earning Potential of CISOs

The compensation structure of every organization is different, there’s no doubt about that. And this becomes even more real when we are discussing the compensation structure of the top executives. When you are being considered for the role of CISO, you have to engage in compensation negotiation which may include salary, bonuses, relocation allowance, health insurance, and stock option plans. Your salary as a CISO depends on how good a negotiator you are.

As per the recent Occupational Outlook Handbook of The U.S. Bureau of Labor Statistics, information systems and computer engineers generally earn a median salary of $135,800 per annum, whereas those in senior executive level positions of this profession earn around $208,000 or more on average. It should be noted that companies normally place CISOs in their head offices, which are generally located in cities where the cost of living is higher.

Sample Resume of a CISO

John Doe

[Put complete address here]

[Mobile number]

[Personal email address]

[LinkedIn Profile Link]

OBJECTIVE

To help companies protect their information assets.

Notable qualification & experience

Professional Experience

Chief Information Security Officer, XYZ Inc., Denver                                                                         2010-Present

■     Conducted an audit session with a team of 10 members and identified 154 deficiencies. All the deficiencies were fixed in a record time of 7 working days and earned an outstanding rating.

■     Supervised the development of a data security program and succeeded in securing over 300TB of data using internationally recognized FIPS 140-2 encryption.

■     Led a team of IT security to manage a security system and deployed patches and update to keep all the information assets completely secure.

■     Worked on a $8M project and devised a comprehensive strategy to vet and track important IT-related milestones and achieved the project’s objectives in time.

Information Security Manager/Auditor, ABC Corp, Dallas                                                           2007-2010

■     Designed training modules for new employees and conducted the session to create awareness among the staff about the security policy in place.

■     Devised a plan to monitor various administrator accounts and assigned privileges on the basis of job role

■     Helped revamp the entire IT security policy to ensure that it’s updated as per the modern standards.

■     Led a team of developers to develop various mobile and desktop applications, while ensuring that all are completely secure and safe to use.

■     Periodically conducted IT audits for the identification of deficiencies and fixed them with patches and updates.

■     Helped in the development of a program to secure the entire network of the organization.

■     Mentored the team to document all the software development phases in line with international standards.

■     Audited over 40 computer security programs developed or in use by the company, found various security vulnerabilities. Fixed 80% of them on the spot and helped ensure the protection of IT assets of various units.

Team Lead – Security Software Development, Image Corp, Tucson                                       2002-2007

■     Developed and implemented various security software for clients spread across the globe

■     Implemented a new security software development policy to ensure that standard procedure is being followed by every member of the team

■     Developed security tools and applications to be used internally by the company

■     Trained, mentored, and coached over 30 individuals from various teams to ensure strict adherence to top-notch security standards

EDUCATION

The University of Arizona, Tucson, Arizona

Master’s in MIS                                                                                                                           (April 2007)

The University of Arizona, Tucson, Arizona

MS in Computer Science                                                                                                     January 2005

PROFESSIONAL DEVELOPMENT

Free Exercise of Religion, Communications Security Management, Human Relations, Middle Management Development Course, Organizational Risk Management for Leaders, Supervisor Development Course

VOLUNTEER EXPERIENCE

Mention if any

LICENSES AND CERTIFICATIONS

Certified Information System Security Professional, ISC2                                                                     January 2011

Security+, CompTIA                                                                                                                                       October 2008                                 

AWARDS AND DISTINCTIONS

Mention if any

PROFESSIONAL MEMBERSHIPS

Mention if any

Common interview questions

Since CISO is a leadership position and a person will only be called in for an interview if that person meets all the requirements including proven track record, technical skills, education, certifications, and experience. The interview questions will be based on both - technical concepts, proven track record, analytical skills, and communication expertise.

Organizations, either hire an IT security consulting firm or request a departing CISO to conduct the interview for the said position. The questions may vary from company to company but will generally include:

• How would you ensure absolute protection of information assets of the organization?
• Supposedly, a security breach occurs and the information gets out, how would you respond to this crisis and what assurance you will provide to internal and stakeholders to ensure their full support?
• How often should we conduct a comprehensive IT audit?
• If you’re to write our IT security policy, what factors would you focus the most?

We sure hope that we’ve covered all there is to guide you to become a CISO in the future. This is a very exciting role and you’ll be facing new challenges every day, so be prepared and we wish you the best of luck.