Executive leadership
CISO
CISO is the executive in charge of a company's information security: owns security strategy, risk management, regulatory requirements and the security team.
Also known as: Chief Information Security Officer, Chief Security Officer, VP Security, VP Information Security.
What does a CISO do?
A CISO (Chief Information Security Officer) is the executive responsible for protecting the company: security strategy, risk management, compliance with regulators and standards, incident response and the security team. A strong CISO talks to the board in terms of risk and to engineers in terms of architecture.
- assesses risks and builds a security programme around them;
- takes the company through certifications and audits: ISO 27001, SOC 2, PCI DSS, Bank of Russia requirements, DORA;
- leads incident response and owns communication afterwards;
- builds the security team: AppSec, cloud security, SOC, compliance;
- reports on risks to the CEO and the board and decides which of them the company accepts.
When does a company need a CISO?
A company needs a CISO when security becomes a condition for the business: without it the company cannot get a licence, pass an audit, sell to a large customer or raise investment. Typical situations: a fintech or payments company comes under a regulator, a B2B SaaS starts selling to enterprises and faces SOC 2 and ISO 27001 requirements, or after a serious incident the board demands a security owner at leadership level. The role will not work if the company still needs protection of infrastructure and development rather than business-level risk management: then it is better to hire a DevSecOps Engineer or an engineering-focused Head of Security.
CISO vs Head of Information Security: what's the difference?
A CISO differs from a Head of Information Security by owning strategy, risk and reporting to leadership and regulators, while a Head of Information Security runs operational security and the team. In small companies this is often one person; in large ones, two levels. A DevSecOps Engineer builds security into development but does not own the company's overall risk.
CISO vs related roles: comparison
| CISO | Head of Information Security | DevSecOps Engineer | |
|---|---|---|---|
| Responsible for | Security risk and strategy | Operational security | Security in development |
| Main result | Risks the business understands and accepts | Protected infrastructure | Secure releases |
| Works with | CEO, board, regulators | Security team, IT | Engineering, DevOps |
Why is it hard to hire a CISO?
Hiring a CISO is one of the hardest executive searches: the candidate market is very narrow, and requirements depend heavily on the industry and the regulator.
- Only a small part of the market fits a given company: CISOs at a bank, a SaaS platform and an industrial company deal with different regulators and threats.
- The role needs a rare combination: deep technical expertise and the ability to talk about risk with the board in business terms.
- A CV shows almost nothing about the most important thing, how the candidate handled real incidents: these are not discussed publicly.
- Strong security leaders rarely change jobs and almost never look openly.
What to decide before hiring a CISO?
- What drives the hire: a regulator, a certification, an incident or growth? The answer decides whether you need a compliance specialist, an incident leader or someone to build the function from scratch.
- Which standards and regulators matter: ISO 27001, SOC 2, PCI DSS, Bank of Russia requirements, DORA? Experience with one regulator transfers poorly to another.
- Who does the CISO report to, and can they stop a release or a deal? Without real authority the CISO becomes a figurehead and leaves quickly.
- What security team is already in place? Leading an existing team and building one from scratch are different jobs.
Where to find a CISO?
CISOs usually come from banking, fintech, payments and large SaaS platforms, where security has long been under the scrutiny of regulators and customers. They are sitting CISOs and heads of security, and heads of AppSec and cloud security ready for their first leadership-team role. A strong profile signal is a security programme or certification the candidate took from start to finish. A second signal is experience with the same regulator as yours. NEWHR searches for these candidates by the results of their work, not by applications to a job post.
How to assess a CISO in an interview?
A CISO is assessed through a walkthrough of an incident they led and a security programme they built: risks, budget, metrics, certifications. The CTO or CIO takes part on the company side, plus a separate session with the CEO to check whether the candidate can explain risk in business terms.
Strong signals:
- describes risks through their cost to the business, not only through vulnerabilities;
- talks honestly about an incident, including their own mistakes;
- asks about authority and who makes the call on risk.
Red flags:
- proposes closing all risks at once without setting priorities;
- talks only about compliance and documents, without understanding the architecture;
- cannot explain a technical risk to the CEO in plain words.
How long does it take to hire a CISO?
We present the first candidates for the CISO role within 5–7 days of the brief. The whole search usually takes one to six months.
Related roles
- DevSecOps Engineer — builds security into development, but does not own company risk.
- Information Security Analyst — analyses threats and incidents in the team the CISO leads.
- Network Security Developer — builds network security tools, not the company's security programme.
- CIO — owns how internal systems work; the CISO owns their protection.
- CLO — handles the legal side of regulation and incidents together with the CISO.