CISO
What the role covers, how it changes with the company stage and the training that helps, then how interviews run and how to prepare for each step.
What a CISO actually does
The leader who owns the security strategy and the risk of the company, leads the security teams and speaks to the board, auditors and regulators.
A chief information security officer, or CISO, owns the security strategy of the company and its risk appetite. They report to the CEO, the CIO or the CTO.
The CISO leads the security teams, often SecOps, AppSec and governance, risk and compliance, runs the security program, prepares the response to incidents and builds security awareness across the company.
They speak to the board, auditors and regulators, and lead work on rules such as NIS2 and DORA in Europe, on third-party risk and on the security of AI.
- A risk review with the executive team
- A meeting with auditors or a regulator
- A review of the security program and budget
- An incident exercise or a real incident
- A third-party risk review of a key vendor
The same title, very different scopes
Most CISO searches are defined first by the sector and the size of the company, then by the focus areas every CISO shares.
How the role changes with the company stage
The title stays the same, and the job changes a lot with the size and the stage of the company. Here is what changes from one stage to the next.
- Builds the first security team and program
- Works hands‑on on key controls
- Prepares the company for audits
- Leads several security teams and a large budget
- Runs a full security program
- Reports risk to the executive team
- Works closely with regulators and auditors
- Leads compliance with NIS2, DORA or sector rules
- Owns a strict risk framework
- Answers to the board on cyber risk
- Works with audit and risk committees
- Shapes the security strategy of the group
The paths into the role, and what really counts
For this role, security certifications still weigh, and companies look first at programs you delivered and crises you handled.
- Engineering school or master's in cybersecurityThe most common path in France, and often expected by large companies.
- University degree in computer science or securityA common path in the US and in Europe.
- Security leadership firstMost CISOs were security architects, heads of SecOps or heads of GRC before.
- Risk or audit firstLeaders from IT risk and audit also move into the role.
Our view: for this role, certifications help, and a crisis you handled or a program you delivered counts even more.
A conversation with a senior tech recruiter
Your first interview is with one of our senior tech recruiters, who knows the role, its scope and the company stages in this guide. The conversation covers your own leadership through real examples, and we handle these searches with particular discretion. Before the call, we send you the six themes we will cover so you can prepare your examples.
- What you owned yourselfThe security programs, teams or crises you led, and your own part in the decisions.
- Your environment and its constraintsSector, rules, budget, threats or past incidents: what shaped your choices.
- The decisions you madeWhich risks first, which controls and which investments, the options you compared and the reasons for your choice.
- The impact of your workWhat changed thanks to your leadership, with numbers when you have them: risks reduced, audit results, incidents handled or maturity gained.
- How you work with other teamsYour work with the board, the CIO or CTO, auditors, regulators and your teams, and how you settle a disagreement.
- What you want nextThe kind of company, sector and scope you are looking for in your next role.
- Security programs delivered
- Board communication
- Crisis handling
- Relations with auditors and regulators
The same ground for every candidate. For a given role, every candidate answers the same final questions, built with the hiring manager around what the role really needs.
Ready for the next steps. After our call, we tell you how the company runs its interviews, who you will meet at each step and what each step is meant to assess.
What the company will assess, step by step
Each company runs its own process, and we walk you through its steps before you start. CISO processes often combine the steps below, and the depth expected at each step grows with the size of the role.
- Interviews with the CEO, the CIO or the CTOSeveral conversations on your vision, your leadership and how you would work together.
- A strategic case or a 90-day planA real problem of the company, or your plan for your first 90 days, to present and discuss.
- Meetings with the executive team and sometimes the audit committeeConversations with your future peers, and sometimes a board member or an investor.
- ReferencesCalls with people you worked with, often including informal references the company finds on its own.
- EnterpriseYou show how you run a full security program and report risk to the executive team.
- Regulated sectorYou show how you work with regulators and auditors under strict rules.
- Listed companyYou show how you report cyber risk to the board and its committees.
How to prepare as a CISO
Practical advice for each step of a CISO process, from the way you introduce yourself to the questions you ask at the end of each interview.
Start with the security programs you led, their size and the results. Mention your context in one sentence, then close with what you want next.
For each one, prepare the context, the stakes, your decision, the options you set aside, the result and what you would change today.
Prepare your budget, your teams, your main risks and your audit results, with how they changed during your time in the role.
Companies often ask for one, sometimes in writing. Keep it simple: what you would learn, what you would decide and what you would deliver first.
Leaders are often asked how AI changes their area. Prepare your view on the security of AI and on its new risks, with one control you put in place.
Choose references who saw you lead, such as a former manager, a peer and someone from your team, and brief them before the calls.
- Walk us through a crisis you handled.
- How do you report cyber risk to the board?
- How do you prepare a company for NIS2 or DORA?
- What would you do in your first 90 days here?
- Who does the CISO report to, and how often does the board hear about security?
- Which rules apply to the company?
- What is the security budget, and how is it decided?
- Which incidents shaped the program?
- How are the security teams organised?
- How does the company handle the security of AI?
Where CISOs come from, and where they go
The roles people most often hold before this one, and the ones they most often move to.
Most CISOs were security architects, heads of SecOps or heads of GRC before, and some move to chief risk officer or board advisor roles.