The 5-Step Action Plan to Becoming CISO

Listen to post: Getting your Trinity Audio player ready...

The Path to Becoming CISO Isn’t Always Linear

There isn’t one definitive path to becoming a CISO.

Don’t be discouraged if your career path isn’t listed above or isn’t “typical.” If your end goal is to become a CISO, then you’ve come to the right place. Keep reading for a comprehensive action plan which will guide you from your current role in IT, IS or Cybersecurity and on the path to becoming a world-class CISO.

Step 1:

Becoming a CISO is About Changing Your Focus

The Difference Between IS, IT or Cybersecurity Roles and a CISO Role: Tactical vs. Strategic

Making The Shift from Security Engineer to Future CISO

The most common mistake that security engineers make when looking to become CISO is focus. To be successful as a security engineer the focus is on problem hunting. As a top-tier security professional, you must be the best at identifying and fixing vulnerabilities others can’t see.

How to Think and Act Like a Future CISO

While security engineers identify problems, CISOs translate the problems that security engineers find into solutions for C-suite, the CEO and the board. To be successful in the CISO role, you must be able to transition from problem-solver to a solution-oriented mindset.

A common mistake when transitioning to CISO is by leading with what’s most familiar – and selling your technical competency. While understanding the tech is crucial when interfacing with the security team, it’s not the skillset you must leverage when speaking with C-suite and boards. C-suite and boards care about solutions – not problems. They must feel confident that you understand the business with complete clarity, can identify cyber solutions, and translate them in terms of business risks, profit and loss. To be successful in securing your new role, focus on leveraging cyber as a business enabler to help the business reach its targeted growth projections.

The Skillset Necessary to Become a CISO

• Translate technical requirements into business requirements
• Brief executives, VPS, C-level, investors and the board
• Understand the business you’re in on a granular level
  (The company, its goals, competitors, yearly revenue generated, revenue projections, threats competitors are facing, etc.)
• Excellent communication: Send effective emails and give impactful presentations
• Balance the risk between functionality and security by running risk assessments
• Focus on increasing revenue and profitability in the organization
• Focus on a solution-oriented mindset, not an identification mindset

Cato SSE 360: Finally, SSE with Total Visibility and Control | Whitepaper

Step 2:

Getting Clear on the CISO Role: So, What Does a CISO Actually Do?

Learn The CISO’s Role and Responsibilities (R&R)

The CISO is essentially a translator between the security engineering team and C-suite.

Step 3:

Set Yourself Up for Success in the Role: Measure What Matters

What you measure in your role will ultimately determine your career success. Too often CISOs set themselves up for failure by playing a zero-sum security game.

• This means any security incident = CISO gets fired = No one wins

But successful CISOs know that cybersecurity is a delicate balancing act between ensuring security and functionality.

• 100% security means 0 functionality, and vice versa

Strategic CISOs understand this and set themselves up for success by working with the CEO and board to minimize exposure and establish realistic KPIs of success.

Establishing Your Metrics of Success in the CISO Role

What makes CIOs so successful in their role?

• A single metric of success: 5 9s.

This allows CIOs to focus on the R&R necessary to achieve this goal.

Suggested CISO KPI & KPI Setting Process

1. Run an analysis to see how many attempted attacks take place weekly at the organization, to establish a benchmark.
2. Provide an executive report with weekly attack attempt metrics (i.e., 300.)
3. Create a proposed benchmark of success: i.e., preventing 98% of attacks.
4. Get management signoff on your proposed KPIs.
5. Provide weekly reports to executives with defined attack metrics: attempted weekly attacks + prevented.
   (Ensuring security incidents are promptly reported to C-suite and board.)
6. Adjust KPIs as necessary and receive management signoff.

Step 4

Mind the Gap: Bridge Your Current Technical and Business Gaps

Recommended Technical Education

• GIAC / GSEC Security Essentials
• CISSP (Certified Information Systems Security Professionals)

OR CISM (Certified Information Security Manager) Certification
OR CISA (Certified Information System Auditor) Certification

• SASE (Secure Access Service Edge) Certification
• SSE (Security Service Edge) Certification

Recommended Technical Experience

At least 3-5 years in IS, Cybersecurity, Networking or IT with a strong security focus

Recommended Business Education

• An MBA or equivalent business degree, or relevant business experience
• CPA or accounting courses

Recommended Business Experience

• Approximately 3-5 years of business experience

Business Operations, Business Management, SOC Manager, or roles that demonstrate your business, management and leadership acumen

Recommended Understanding Of:

• Industry security standards including NIST, ISO, SANS, COBIT, CERT, HIPAA.
• Current data privacy regulations, e.g., GDPR, CCPA and any regional standards.

Step 5:

How to Get a CISO Job with Limited or No Previous Experience

It’s the age-old dilemma – how do I get a job without relevant experience? And how to I get relevant experience without a job?

Take On a Virtual CISO Role at a Friend or Family Member’s Small Business

• Offer 3 hours of virtual CISO service a week.
• In exchange, ask for 3 recommendations a month and to service as a positive reference.

Can you receive mentorship from an existing CISO?

• Do friends, family or former colleagues know any CISOs you can connect with? Start there.
• Reach out on LinkedIn to CISOs and invite them to coffee or dinner.
  Ask them if you can meet up and receive mentorship over dinner once a month (they pick the location, and you pay.)

Remember: It’s a numbers game. Don’t get discouraged after a few “no’s” or a lack of responses.

Getting Your First CISO Job: Your Action Plan for Career Success

Applying For Jobs

Your resume has one and only one goal – to get you the interview.
Week 1:

• Send out 20 resumes for CISO jobs with your existing resume
• How many respond and request interviews (within 2 weeks)?
• If you get under a 50-70% success rate, you need to revise your resume.

Your goal is to repeat this process until you get a minimum of 10 positive responses for every batch of 20 resumes you send out (giving recruiters 1.5 – 2 weeks to respond.) Be ready to adapt and adjust your resume as many times as necessary (using the defined process above,) until you hit your benchmarks of success.

Revising your Resume for Success

If you’re not hitting a 50-70% interview rate on your resume, it’s time to revise your resume.

But what do you change?

The Most Common Mistakes Found on CISO Resumes (Don’t Fall into a Trap)
Your resume should not only highlight your technical abilities but your business acumen.

Review the strategic skills highlighted earlier and emphasize those (in addition to any other relevant educational, professional, or career achievements.)

• Have you briefed executives and boards?
• Have you given effective presentations?
• Have you created risk management programs and aligned the entire organization?
• Do you lead an online forum on Cybersecurity best practices?

Think of ways to highlight your business and leadership savvy, not just your de facto technical abilities.

The Interview Rounds

• The CISO interview process is generally between 5-7 interview rounds.

Remember:
The goal of your first interview is only to receive a second interview. The goal of your second interview is to receive a third interview, and so on. Be prepared for interviews with legal, finance, the CEO, CIO, HR, and more.

You’ve Got This: The Road to Landing Your First CISO Role

Abraham Lincoln once said, “the best way to predict the future is to create it.” And we hope this guide gives you a running start towards your new and exciting future as a CISO. We believe in you and your future success. Good luck! And feel free to forward this guide to a friend or colleague who’s hunting for a new CISO role, if you feel it’s been helpful.

Life After Landing the Coveted CISO Role

Congrats! You’ve Been Hired as a CISO

You did it. You’ve landed your first CISO role. We couldn’t be prouder of the hard work and dedication that it took to get you to this point. Before you begin in your new role, here are a few best practices to guide you on your way to career success.

Ensuring Your Success in the CISO Role: Things to Keep in Mind

After speaking with 1000s of CISOs since 2016, it’s important to keep the following in mind:

Your Network Security Architecture Will Determine Your Focus and Impact

No matter the organization or the scope, your CISO role is dependent on meeting if not exceeding your promised KPIs. So, you’ll need to decide, do you want a reactive or a proactive security team? Do you want your team to spend their time hunting and patching security vulnerabilities and mitigating disparate security policies? Or devoted to achieving your larger, revenue-generating missions through cybersecurity? Accordingly, you’ll need to ensure that your network security architecture minimizes your enterprise’s attack surface, so you and your team can devote your attention accordingly.

To achieve this, your team must have full visibility and control of all WAN, cloud, and internet traffic so they can work on fulfilling your business objectives through cybersecurity. Otherwise, your function will revert to tactical, instead of focusing on serving as a business enabler through cybersecurity.

Cato SSE 360 = SSE + Total Visibility and Control

Disjointed security point solutions overload resource constrained security teams, impacting security posture, and increasing overall risk due to configuration errors. Traditional SSE (Security Service Edge) convergence mitigates these challenges but offers limited visibility and control that only extends to the Internet, public cloud applications, and select internal applications. Thus, leaving WAN traffic uninspected and unoptimized. And an SSE platform that isn’t part of single-vendor SASE can’t extend convergence to SD-WAN to complete the SASE transformation journey.

Cato Networks’ SSE 360 service will allow you to solve this. SSE 360 optimizes and secures all traffic, to all WAN, cloud, and internet application resources, and across all ports and protocols. For more information about Cato’s entire suite of converged, network security, please be sure to read our SSE 360 Whitepaper. Complete with configurable security policies that meet the needs of any enterprise IS team, see why Cato SSE 360 is different from traditional SSE vendors.