What I would like to see in a CISO: 20 years minimum, 30-35 years common Information Security exposure, if not direct experience those full years. "Time put in" counts a lot to me.
Information Security certainly does not preclude Information Technology, although Research, Public Service, Policy, or Intelligence stints do count in my book (when they correlate to Information Security).
People leadership, especially at the C-Level, requires disciplined, strategic foresight above and beyond standard sensemaking and "business sense". Foresight is hinged on the ability to forecast accurately, measured by something like the Brier score -- and what it does is give an unprecedented capability to make decisions (although one must also be able to influence decisions, which must leverage credibility/relationship-building activities) and react quickly to scenarios where tough choices are an everyday occurrence.
CISOs have been known for the incapability to hold their positions longer than two years on average. I blame one critical factor for those who fail to remain relevant past the 2-year mark: inability to identify nightmare scenarios during on-going IT transformation -- the "complacency factor".
A more traditional path is outlined by CSOOnline in this article -- http://www.csoonline.com/article/3019067/leadership-management/how-to-become-a-ciso.html