How to Find the Right CISO

COMMENTARY

The artificial intelligence (AI) investment cycle we are currently in will drive new levels of cybersecurity risk in pretty much every organization, making the cybersecurity chief a CEO's most important current hire. Great chief information security officers (CISOs) — who blend technical, strategic, board-level communication, and leadership skills — are in high demand and short supply, and with technology constantly changing, the cybersecurity skill set is changing, too.  

Attracting the Best

How do CEOs, their executive teams, and their HR partners attract the best of the market? Here are a few ways.  

1. Level and structure the role appropriately: If security — of enterprise data, customer information, or data right in the product itself — is so critical to your organization that one mishap can have a major impact on your revenues, then give the role some teeth. Don't bury it under IT operations, where you will attract a technologist, not a leader. Either have the CISO report to the chief information officer (who, in turn, should be reporting to the CEO given the critically of technology to your business) or make the CISO a CIO peer. If your security risk is less life threatening, and your CIO has depth in security, you can consider moving them down a layer. Is the CISO responsible for enterprise security or product security or both? Will the CISO have a small matrixed organization or a larger dedicated team?  While the right CISO will help you answer some of the questions, the more thoughtful you’ve been about these questions ahead of time, the better.  

2. Educate your board: Public company boards do not yet fully understand their role in cyber governance. They often equate security to technology and tools rather than emphasizing the human behavior side of cyber incidents. While the board does not need to know the latest tools, they should understand what truly lies behind cyber incidents and how they should govern. By showing that you've primed the pump, and your CIO has been bringing the board up to speed on the risks and return of digital technologies, you are demonstrating a tech-savvy board. The market’s best CISO will see a savvy board as a requirement.  

3. Think about both defensive and offensive tactics: The best CISOs will balance the defensive and offensive postures of information security. They will see the cyber role as both facilitating the growth of the business and securing it from cyber-risk. Show these rare birds that your board, executive committee, and CIO understand that technology must be a strategic advantage, not an unfortunate cost. Do your discussions about IT focus on expense only, or are your IT investments clearly aligned to your business value streams? Does your CEO talk in company meetings about how important technology is to the growth of the company? The quality of the CISO you can attract depends on our view of the impact of technology on your business.  

4. Build and demonstrate a change management capability: People resist change, particularly if they do not perceive value in the change. Getting a large organization to follow security protocols takes a tremendous amount of adoption effort and change management. The better your organization is at driving the right behaviors in your employee base, the stronger your security program. During your candidate interviews, extoll the virtues of your change management team and your executive committee's understanding that good security is about culture, behaviors, education, and change. In fact, "change management" is quickly becoming the most important skill set of any technology leader, CISOs included.  

5. Involve the board in the interview process: Actions speak louder than words, and a few board interviews will demonstrate to your CISO finalist that you and the board take cybersecurity seriously. It will also allow the CISO to assess his or her dynamic with the board. The board-CISO relationship is only going to be become more important, so getting an early read on that relationship will help ensure that it will work.   

With every dime we spend on AI, we produce risk. With every new Internet of Things (IoT) product we sell, we open a cybersecurity door. With every day that passes, our cyber foes are getting smarter. CEOs and their teams have a powerful weapon to fight these forces: the ability to attract the right CISO. While most companies have a head of security, these professionals are not all created equal. Some are "tool jockeys" who love technology but not people; then there are the CISOs with great regulatory knowledge but lacking great influencing skills. When you identify the right blend of technical, communication, and leadership skills, by showing your candidates know that you are serious about cybersecurity, you can make the right hire.