What career path do I need to follow to become a CISO?

Question

I'm a security researcher and I want to know what career path you think I need to follow to become a Chief Information Security Officer.

What skills are necessary in this position ?
What field of information security is more important in this position ?

With the goal of reaching this position, what kind of stuff/path is better to look at in the next few years with this long term goal ?

P.S. First person experience is preferred.

Answer 1

The general principle is to go from the ground up. This seems obvious, but you would be surprised that there are some courses out there today that offer the path of basic IT security skills and then straight forward to the CISO studies.

I talk to plenty of CISSPs and CISOs and they all say one should start as a network administrator, then moving on to a few good years as an IT security integrator and having good knowledge of implementing security solutions, and only then should he go for CISO and look at the whole security world in a manager point of view.

This is not first person experience, but it's what I get from the people I talk to, who have this experience.

Answer 2

From the CISOs I talk to, the only definite point is that they all come from very different backgrounds, but have a wide range of experiences...not just in the security industry (sometimes not even in the security industry)

Aim for a wide range of business experience, as at this level talking about security doesn't tend to have as much impact or value to a company as being able to talk about business risk, governance frameworks and value.

I wouldn't class any single discipline as 'more valuable' unless you count strategy, governance and business risk as disciplines. You'll want to be able to understand at a broad level what your teams across all disciplines are doing to help your organisation reach its preferred risk level at an acceptable cost.

This article from ComputerWorld UK titled "How to become a CISO" might also be of interest.

Also have a read through all the questions tagged professional-education - as there is a lot of useful information in there already.