How to Become a Successful CISO

David Froud recently updated a blog post of his from last year about how to get into the cybersecurity field and become a chief information security officer (CISO). In last year’s post, the security expert wrote about the importance of understanding your motivations for going into the security field. If you scored Extroversion, Sensing, Thinking, Judgment (ESTJ) on the Myers-Briggs personality test, he wrote, chances are you have the right kind of temperament and motivations to succeed as a CISO.

“Without question, a career in cybersecurity can be very rewarding, both in personal achievement and financial terms,” Froud explained. “It can also chew you up and spit you out if you’re not careful.”

The CISO’s Dilemma

Part of the problem with finding the right CISO job is that the role is almost too popular these days. There are hundreds of places from which potential IT candidates can obtain dozens of security credentials. Furthermore, enterprise protection technologies are exploding, and the days of a traditional antivirus tools are quickly coming to an end since new malware schemes are designed to circumvent them with sneakier methods.

This presents a typical CISO candidate with a dilemma: Should you focus on beefing up credentials or aim to create a more hands-on experience? Should you prioritize understanding the technology or becoming better at the underlying business processes?

No Substitute for Experience

In his recent post, Froud explained that experience is the best teacher. “It’s the people and processes that give technology context, not the other way around,” he wrote. “You will be lost in a never-ending cycle of throwing technology after technology at something that could likely be fixed by adjusting the very business processes you’re trying to protect.”

It’s all about using real-world implementations of technology that can solidify a network to repel data breaches. Look at the many high-profile public breaches of the past year: In many circumstances, the companies involved had purchased various solutions to prevent data leaks. However, the solutions were incompletely implemented, misconfigured or only implemented in one corner of the network.

Listen to the podcast: One Hack Away from Disaster

The Devil Is in the Details

Security is really a means to an end, and that end is for the business to succeed.

“A successful CISO needs to be both strategic — long-term plan, collaborate with teams, communicate to executive management and the board — and tactical. The devil is in the details,” said Imperva CISO Shahar Ben-Hador in a blog post. “As a CISO, I have to assess what’s going to be a fundamental technology over a longer period of time and what’s fundamental for our business.”

Both articles feature lots of other solid career advice for CISOs, such as not to immediately take the most lucrative offer, find the right person to mentor you and review your progress every six months. As Froud wrote, the final aspect of a CISO’s job borders on politics, so that had better be what you want. True enough!

Share this Article:
David Strom

Security Evangelist

David is an award-winning writer, speaker, editor, video blogger, and online communications professional who also advises numerous startup and well-established technology ventures. He began his career as an in-house IT analyst and has founded numerous technology print and online publications, such as editor-in-chief of Network Computing magazine and as part of the launch team of PC Week's Connectivity section. David has written two books and spoken around the world at various conferences and been on national radio and television talking about network technologies. He continues to build websites and publish articles on a wide variety of technology topics geared towards networking, security, channel, PC enthusiasts, OEMs, and consumers. In addition to these activities, he consults to vendors and evaluates emerging technologies, products, strategies, and trends to help position and improve their technology products.