I'm a security researcher and I want to know what career path you think I need to follow to become a Chief Information Security Officer.

What skills are necessary in this position ?
What field of information security is more important in this position ?

With the goal of reaching this position, what kind of stuff/path is better to look at in the next few years with this long term goal ?

P.S. First person experience is preferred.


The general principle is to go from the ground up. This seems obvious, but you would be surprised that there are some courses out there today that offer the path of basic IT security skills and then straight forward to the CISO studies.

I talk to plenty of CISSPs and CISOs and they all say one should start as a network administrator, then moving on to a few good years as an IT security integrator and having good knowledge of implementing security solutions, and only then should he go for CISO and look at the whole security world in a manager point of view.

This is not first person experience, but it's what I get from the people I talk to, who have this experience.


From the CISOs I talk to, the only definite point is that they all come from very different backgrounds, but have a wide range of experiences...not just in the security industry (sometimes not even in the security industry)

Aim for a wide range of business experience, as at this level talking about security doesn't tend to have as much impact or value to a company as being able to talk about business risk, governance frameworks and value.

I wouldn't class any single discipline as 'more valuable' unless you count strategy, governance and business risk as disciplines. You'll want to be able to understand at a broad level what your teams across all disciplines are doing to help your organisation reach its preferred risk level at an acceptable cost.

This article from ComputerWorld UK titled "How to become a CISO" might also be of interest.

Also have a read through all the questions tagged - as there is a lot of useful information in there already.


What I would like to see in a CISO: 20 years minimum, 30-35 years common Information Security exposure, if not direct experience those full years. "Time put in" counts a lot to me.

Information Security certainly does not preclude Information Technology, although Research, Public Service, Policy, or Intelligence stints do count in my book (when they correlate to Information Security).

People leadership, especially at the C-Level, requires disciplined, strategic foresight above and beyond standard sensemaking and "business sense". Foresight is hinged on the ability to forecast accurately, measured by something like the Brier score -- and what it does is give an unprecedented capability to make decisions (although one must also be able to influence decisions, which must leverage credibility/relationship-building activities) and react quickly to scenarios where tough choices are an everyday occurrence.

CISOs have been known for the incapability to hold their positions longer than two years on average. I blame one critical factor for those who fail to remain relevant past the 2-year mark: inability to identify nightmare scenarios during on-going IT transformation -- the "complacency factor".

A more traditional path is outlined by CSOOnline in this article -- http://www.csoonline.com/article/3019067/leadership-management/how-to-become-a-ciso.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.