How to become a CISO: the climb from security manager to the top seat, measured on 194 open leadership postings

What a chief information security officer answers for, the rungs that lead to the seat, and what 194 open security leadership postings required and offered on 12 November 2026.

A chief information security officer (CISO) is the executive who answers for how much cyber risk an organization carries: the CISO sets the security strategy, owns the budget and the people who carry it out, decides what executives, the board and regulators are told, and runs the response when an attack lands. Nobody is hired into that seat from outside the field. The honest route runs through roughly ten to fifteen years of security work, a first management job somewhere in the middle, a director or head-of-security post that runs a whole function, and very often a first CISO title at a company smaller or more regulated than the one you eventually want. In the postings this board read, the jump that mattered most at the top was not technical: the board of directors appeared in 4% of manager postings and in 64% of CISO-titled ones, and 11 of the 14 CISO-titled roles asked for, or preferred, someone who had already held a CISO, deputy CISO, head-of-security or similar executive seat. This guide lays out what each rung asks, in counts, and how people get past that circular requirement.

How the figures were gathered. Every hour, CyberJobs.cc collects open security roles straight from 298 employers' own applicant tracking systems. From the board's snapshot at the start of 12 November 2026 (2,150 roles) we took all 237 roles filed under security leadership plus 67 from other specialties whose titles name a manager, director, head, vice president, chief or deputy, and read all 304 in full. 110 were set aside because they do not lead security work: 51 program and project manager seats (a parallel track, see section 3), 23 physical, site and industrial security jobs such as data centre security managers, 20 roles that sell, design or manage products, support customers or give legal advice, and 16 individual contributors whose titles carry a grade rather than a team (bank "vice presidents" who write code, managing consultants). The remaining 194 postings at 108 employers were sorted into rungs by title and counted for experience, reporting line, board and executive duties, regulations, certifications, degrees, clearance, workplace and pay, with years and reporting lines taken from the sentences that state them. Pay uses only yearly US dollar ranges in US postings (106 of the 194); 61 postings are outside the United States. Every figure carries its count, and the figures the board can recount (open leadership roles, remote ones, typical pay) update when you load the page.

Contents

1. What the CISO answers for now
2. The leadership ladder in 194 postings
3. Rung by rung, from first manager to CISO
4. The technical road and the risk road
5. What separates a director from a CISO
6. Who the CISO reports to
7. Certifications and degrees in leadership postings
8. Field CISO, deputy CISO, virtual CISO and head of security
9. CISO salary by rung and employer
10. Personal liability and the other risks of the job
11. A realistic ten-year route to the CISO seat
12. Questions about becoming a CISO

1. What the CISO answers for now

Every organization runs risk on its systems whether or not anyone decides to. The CISO exists to turn that risk into a decision: measured, owned by a named person, funded at a level the business chose on purpose, and defensible to whoever asks later. The job is therefore defined less by technology than by who asks. The chief executive and the board ask how exposed the company is and what it costs to be less exposed. Regulators ask for proof that controls exist and for incident reports on a clock. Customers ask through security questionnaires and audits before they sign. Buyers and investors ask during due diligence. Attackers ask too, without permission, and their questions decide whether all the other answers were true.

The postings show those audiences directly. BJAK, hiring a CISO for its regulated investment platform in Malaysia, describes the hire as "the person the board names as responsible for technology risk under the Securities Commission's Guidelines on Technology Risk Management." The same posting admits "Nothing exists yet": the framework, controls, monitoring and evidence all have to be built and pass an independent assessment before the platform can be registered, and incident ownership runs to the report to the regulator on the day an incident occurs. Keenfinity, a group carved out of Bosch and owned by an investment firm, puts the commercial version even more plainly. Its posting says security "directly affects the valuation and saleability of four Business Units," gives the CISO sign-off authority at every divestiture phase gate, and wants someone who can sit across the table from a buyer's security team and defend the program.

At a product company the scope is wider and more technical. Glean's CISO posting covers "product and platform security, corporate security, detection and response, risk, and compliance," and it extends that remit to AI: the security of "models, agents, and the tools and data they can access." Its list of especially valuable experience ends with preparing a company "for public-company or IPO-level governance and disclosure expectations." Obsidian Security asks its CISO to run the internal program and also to "Serve as the executive-level security contact for prospects and customers during sales cycles, audits, and security reviews," own the security budget, and assess the security of acquisition targets.

Why the rules now name the role

Three sets of rules have pulled the CISO closer to the boardroom since 2023.

United States public companies. The SEC rules adopted on 26 July 2023 require a company to disclose a cybersecurity incident it judges material on Form 8-K, normally no later than four business days after deciding it is material, and to describe each year in its annual report how it assesses and manages cyber risk, how the board oversees it, and "management's role and expertise" in managing it - SEC, July 2023. Two consequences follow for anyone aiming at the seat. The materiality call now has a deadline attached, and the security leader's qualifications are described in a public filing.

New York financial firms. The second amendment to New York's cybersecurity regulation, effective 1 November 2023, requires the CISO to report in writing at least annually to the senior governing body, and requires the yearly certification of compliance to be signed by the company's highest-ranking executive and its CISO - NYDFS, Part 500 second amendment text. A signature on a regulatory filing is a different kind of accountability from a slide in a quarterly review.

The European Union. The NIS2 directive requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and be liable for infringements, and requires their members to follow training - EUR-Lex, Directive (EU) 2022/2555, Article 20. For banks, insurers and other financial entities, DORA has applied since 17 January 2025 and says the management body bears "the ultimate responsibility for managing the financial entity's ICT risk" - EUR-Lex, Regulation (EU) 2022/2554, Articles 5 and 64. Those rules make directors answerable, and directors in turn want a named security executive who can brief them in plain language.

In the 194 postings the most-named standard is not a law but a certification: ISO 27001 appeared in 48, NIST frameworks in 47, SOC 2 in 36, FedRAMP in 24, GDPR in 23 and PCI DSS in 19, with DORA in 11 and NIS2 in 6. SEC disclosure or public-company governance came up in just three ( Acronis, Glean and Figma). 70 postings (36%) named at least one framework or regulation.

Incidents and AI

Incident leadership runs through the whole ladder: 12 of the 14 CISO-titled postings name detection, security operations or incident response among the things the hire owns, and at vice president level Saviynt's head of its security operations center is told to "Serve as Incident Commander" in person. AI has arrived on the same list. 49 of the 194 postings (25%) mention securing AI systems or governing their use, including 5 of the 14 CISO-titled roles. Obsidian's CISO is asked to set enterprise AI governance (acceptable use, data loss prevention for AI inputs, risk reviews of third-party AI services) and to build detection for AI-powered attacks; Gong is hiring a head of AI security whose remit runs from prompt injection to keeping customer data out of training sets. The AI security jobs page tracks that branch across every rung.

2. The leadership ladder in 194 postings

The first thing the sample shows is the shape of the climb. The chart counts the 194 postings by the rung their title names.

A company has one CISO and many managers, so the funnel is steep by construction. Among 2,150 open security roles, eight carried the CISO title for a company's own program, against 122 manager and senior manager postings. That ratio, about fifteen management seats per CISO seat, is the arithmetic behind the advice to plan for a long wait at director level and for a move to another employer when the CISO seat finally comes. The IANS and Artico Search compensation study found that 15% of the 566 CISOs it surveyed changed employers in 2025, up from 11% a year earlier - IANS, November 2025.

The table summarizes what each rung asks. "Years asked" is the largest figure a posting states for total experience; "years leading people" is the figure it states for management or leadership experience. Both are medians over the postings that state a figure.

Two features of the table deserve a pause. The years climb until the CISO row, where the median falls back to ten: the CISO title spans a 4,000-person industrial group, a crypto exchange's Hong Kong licensee and a payments start-up, while the senior directors run cyber defense or product security at DoorDash or Roblox. Scope, not title, sets the bar. And the board column barely moves for four rungs, then jumps; section 5 explains why that is the real gate.

Three kinds of leadership job hide under the same titles

Reading the postings in full shows that "security manager" or "security director" can mean three different jobs, and only one of them leads toward the CISO seat in a straight line. By our reading, 131 of the 194 postings run security for the employer itself: its security operations, engineering, identity, product security or compliance. 36 lead engineers who build security products, or the security features of a product, mostly at vendors such as Palo Alto Networks, CrowdStrike and Okta. 27 serve clients: incident response and managed detection teams at providers, consulting practices, and the field CISO roles covered in section 8.

The product track is a real ladder, but it climbs toward a vice president of engineering rather than a CISO: a CrowdStrike manager whose team builds data ingestion for a SIEM product is judged on shipping software, while Addepar's senior security operations manager is judged on whether the company's own defenses hold. Product leaders do become CISOs, especially at security vendors, but it is a deliberate change of track. Reading any leadership posting, ask first whose risk the team reduces: the employer's, its customers' or the product's.

The employers in the sample were mostly security vendors (63 postings), software and internet companies (44), cloud and data infrastructure firms (33), finance, payments and crypto companies (21), defense and aerospace firms (14), security consultancies and managed service providers (11) and AI labs (8). The industry page shows how pay and openings differ across those groups for every security role, not only leaders. At this moment the board's leadership specialty holds 236 open roles, 75 of them remote; that count is broader than the 194 above because it also includes program managers and physical security leads.

3. Rung by rung, from first manager to CISO

The next table shows how often the posting text mentions each part of the job, by rung. The groups are those in section 2; percentages are shares of each group's postings.

The rows do not climb smoothly, because a director at a 300-person company and a senior manager at a 10,000-person one often hold the same scope. What moves consistently is the balance between building and explaining: code falls from about four postings in ten to one in fourteen, while the board, executives, certifications and customers rise. Hiring dips only in the CISO group, where field CISOs advise without teams.

First-line manager: 83 postings

A first management posting typically asked for seven years of experience, three of them leading people, which means most first-time managers were already leading informally: as a tech lead, an incident lead or the person who trained new analysts. Several postings set the bar lower on the people side. Nebius asked its deputy SOC manager for "at least 2 years managing people," Roblox asked engineering managers in application and enterprise security for two years of managing engineers, and Sophos asked its incident response and threat operations managers for two years leading people, teams or operational functions. Discord's platform security engineering manager posting put a size on it: at least three years as a people manager, over a team of three or more security software engineers, paid $248,000 to $310,000.

The first rung is still technical. Half the manager postings (52%) said "hands-on" and 37% named a language or code, and the job is usually one function: a SOC, an incident response team, a red team, an identity team, a GRC program. Only three of the 83 mentioned the board. One of them shows what the first contact looks like: Acronis's cyber defense unit manager reports incidents and risk trends to senior leadership "and when needed the Board and Audit Committee."

Not every manager title manages people. GitLab's principal security GRC manager joins a small team of four direct reports under a director, an individual contributor seat with a manager's title. Read the responsibilities before treating a title as a step onto the people track.

Senior manager: 39 postings

The senior manager rung asked for eight years with four leading people, and it is where the first "manager of managers" language appears. CoreWeave's senior manager of cyber threat intelligence asked for ten years in intelligence, research, hunting or detection, including three directly managing technical security or intelligence teams. Harness asked its senior security operations manager for ten years with three managing technical security teams. Pure Storage wanted four years of direct management while leading security operations, detection engineering and response. WHOOP asked its GRC senior manager for ten years in GRC or security, five of them managing GRC, information security or cybersecurity professionals.

Executive communication climbs here (64%), and four of the 39 mention the board. Affirm's two senior incident response managers are expected to turn technical detail and business impact into "clear executive updates and board-level reporting." Ebury's senior security engineering manager carries board-level risk reporting for vulnerability remediation. That is the first sign of the skill that later separates the top rung: writing for people who will never read a log.

Director: 41 postings

Directors were asked for ten years with five leading people, and the posting language shifts from teams to functions. Abnormal Security wanted ten years in security or software engineering, including four or more managing security teams, "ideally including managers of managers or equivalent scope," and expected its director of security engineering to translate technical risk "into business terms for the executive team and board." Crusoe asked for five years "leading second-line management structures or multi-team security organizations at hyper-scale cloud providers." Motive wanted five years managing both people managers and senior individual contributors. MongoDB's director of global security operations had perhaps the clearest mandate of the sample: "your first mandate is to stand up a 20-person team from scratch."

Budgets appear most often at this rung (27%). Sysdig's director of security engineering is told to "Set the roadmap, standards, and budget for the function." Instructure measures its director partly on "Security Engineering spend managed to budget." Where a director posting names a boss, it is usually the CISO: 12 of the 20 director-and-above postings that state a reporting line answer to a CISO, a chief security officer or a chief trust and security officer. That makes the director the CISO's most likely successor in-house and the CISO's most direct view of what the job is like.

Senior director, head of and VP: 17 postings

No group in the sample wanted longer careers: 13.5 years at the median, 7.5 of them leading people, largely because these postings come from big companies. DoorDash's senior director for global cyber defense, who reports to the company's global chief security officer, wanted fifteen years of cyber defense experience and ten of people management, at $349,600 to $437,000. Roblox's senior director for privacy, product and platform security, who reports to the CISO, asked for fifteen years with eight leading engineering or security organizations, at $457,970 to $525,510: a range above every CISO posting on the board.

"Head of" is the least reliable title in the field. Zipline's head of information security owns "company-wide information security and privacy strategy" across product, infrastructure, corporate technology and even aircraft, leads "a lean, technical organization," and is told the role can grow "taking on broader scope and organizational leadership as the company's needs evolve," at $250,000 to $400,000. That is a first CISO job in everything but the word. Applied Intuition's head of identity and access management, by contrast, states plainly: "This is a senior individual contributor role." Nebius's head of proactive security, reporting to the CISO, runs red team, penetration testing, threat hunting and threat intelligence teams, a director-scale job.

The three vice presidents show the same spread. Saviynt's VP for its security operations center and cyber defense asks for fifteen years leading security teams and owns 24/7 operations, hunting and response, with risk-based insights for "executive leadership and the board." Its VP of application security, also fifteen years, is expected to "Lead and conduct highly advanced, in-depth white-box penetration testing" personally. Zania's VP of GRC leads a customer-facing compliance organization, a client-services job with a VP title.

The program track beside the ladder

The 51 program and project manager postings left out of the count are a real side door for people who run cross-team work without owning the engineers, and they pay at leadership levels (one security TPM posting at OpenAI stated $165,400 to $285,000). Program managers practise what specialists often skip: dependencies across teams, executive status reporting, and turning a risk into a funded plan.

4. The technical road and the risk road

There are two common origins for a CISO, and the postings show which employers favour which. Reasoned from the job itself: a CISO must judge technical risk accurately and explain business risk persuasively. People who come up through engineering, operations or offensive work arrive strong on the first and learn the second. People who come up through audit, compliance and risk arrive strong on the second and learn the first. Both roads reach the top. Where each one is shorter depends on what the employer most needs to prove, and to whom.

Where the technical road is shorter. Product companies, cloud providers, AI labs and defense technology firms whose main exposure is their own code and infrastructure write their CISO postings around technical depth. Glean says its CISO "should be able to go deep on architecture and incidents, build a durable program, and communicate clearly about risk and trade-offs," and wants "the judgment to distinguish control completion from actual risk reduction." Anduril, hiring a CISO to report to its chief information officer, prefers a "Hands-on technical background in software engineering, systems engineering, or infrastructure, not exclusively a governance/policy career path." The deputy and director postings at these companies read the same way: Canonical's head of security operations says that "While this is a management position, we expect managers to be expert practitioners."

Where the risk road is shorter. Regulated financial firms, crypto exchanges seeking licences, companies that sell to governments, and companies whose value depends on certifications write their CISO postings around governance. Rain, a stablecoin payments company, frames its CISO role around "security governance, risk, and compliance strategy, with a particular focus on ISO certification and regulatory readiness," and lists cloud security familiarity as a nice-to-have, "even if not hands-on day-to-day." BJAK, Bybit and Kraken all require deep, working knowledge of a named regulator's rules: Malaysia's Securities Commission, Hong Kong's Securities and Futures Commission, and VARA, the virtual assets regulator whose guidelines Kraken's entities in the United Arab Emirates follow. For those employers, a person who has walked a licence application past a regulator is worth more than one who has written detection rules.

The best candidates have walked both. Arctic Wolf's vice president and deputy CISO posting asks for "particular strength in governance, risk management, and compliance (GRC)" and "a proven record of directly managing technical security teams," with ten years of experience "spanning both technical security engineering functions and GRC." The deputy runs security engineering, security operations and GRC as one program. That is the profile the top of the market converges on, whichever road a person started on.

What each road needs to add. If you come from engineering or operations, the gaps the postings expose are frameworks (at least one of ISO 27001, NIST and SOC 2 appears in 65 of the 194 leadership postings), audits, risk registers, third-party risk, and the habit of writing a decision memo instead of a ticket. A first-principles shortcut: volunteer to own one external audit end to end, and present its findings to an executive yourself. If you come from GRC or audit, the gap is technical credibility: enough architecture, cloud and incident experience to "engage credibly with senior engineers on architecture and remediation choices," as Glean puts it. The shortcut there is a rotation through incident response or security engineering, or a GRC engineering role that automates evidence collection. The GRC analyst guide and the SOC analyst guide cover the two most common starting seats, and the career paths map shows how all ten specialties feed the leadership rung.

How technical a CISO stays. Less than many engineers fear, more than many managers assume. "Hands-on" appears in 43% of the CISO-titled postings, against 66% at director level, and code in one of fourteen. BJAK wants a "Hands-on operating style. Able to review the controls, run the simulation and close the gaps personally," because it is building from nothing. At larger companies the CISO judges technical work rather than doing it. IANS's analyst described the split in its 2026 study: "The more executive CISO tends to be delegating the day-to-day" - TechTarget on the IANS State of the CISO 2026 report, January 2026.

5. What separates a director from a CISO

If years and technical depth do not separate the top rung, what does? Reading the 14 CISO-titled postings against the 41 director postings, five differences stand out.

1. The board and the regulator. Nine of the 14 CISO-titled postings name the board, against 4 of 41 director postings. The difference is not a matter of presenting slides more often. A director reports upward to someone who then decides what the board hears; a CISO is often the person the board or a regulator holds responsible by name. Kraken's deputy regional information security officer is told: "This is not a support function. You will be the named security officer for your entities, accountable to their boards and their regulators." The practical skill is translation under scrutiny: Keenfinity wants someone who can "translate complex security risk into language that resonates with a CFO and PE investor."

2. The seat itself. Eleven of the 14 CISO-titled postings ask for or prefer prior experience as a CISO, deputy CISO, head of security or comparable security executive. Keenfinity asks for three years "at CISO or Head of Security level," Mimecast for three "as a CISO, VP of Security, or equivalent inside an enterprise," Bybit for three to five "in a senior leadership or Head of InfoSec capacity within the financial services sector," and Obsidian for five in a senior leadership role it defines as "CISO, VP/Deputy CISO, Sr. Director of Security, or equivalent." Only BJAK, Rain and Kraken skipped the requirement. This is the circularity at the heart of the career: the clearest way to become a CISO is to have been one. Section 8 covers the four seats people use to break the loop.

3. A commercial role. Eight of the 14 CISO-titled postings describe customer-facing work, against 32% of directors. Obsidian's CISO joins sales cycles; Trace3's posting combines the CISO job with leading the company's security business, "accountable for Security domain revenue, gross profit, year-over-year growth," with the CISO acting as "the first adopter and validator" of what the company sells. Security has become part of what B2B customers buy, so the person who signs the security questionnaire also helps close the deal.

4. Transactions. CISOs are written into the life events of a company: Keenfinity's divestitures, Obsidian's acquisitions, Glean's possible move to public-company governance, and the licence applications of BJAK and Bybit. Directors rarely see these. A director who wants the top seat should ask to join one due diligence process, in either direction, before applying.

5. Independence. Bybit's CISO is told to "Report directly to the CTO while operating with the independence necessary to challenge technical architectures from a security and risk perspective." The same idea appears in law: DORA requires financial entities other than microenterprises to give ICT risk oversight to a control function with "an appropriate level of independence" - EUR-Lex, Regulation (EU) 2022/2554, Article 6. A director can disagree with engineering in private; a CISO has to be able to disagree on the record and survive it.

What does not separate the rungs is pay at large employers: Roblox's senior director range sits above every CISO range on the board, and DoorDash's overlaps Glean's. Moving from director to CISO often means a smaller company and a broader remit at similar pay. The interview question guide covers how leadership interviews test these five things, and the resume guide how to show them on one page.

6. Who the CISO reports to

Where the CISO sits decides how much of the job is possible. A CISO who reports to the head of IT is grading the department that owns most of the systems at risk; a CISO who reports to the chief executive has direct access to the person who sets budgets, but may lack the IT leader's daily support. Neither is wrong, and the postings show the range.

None of the eight CISO postings on the board named the CEO as the boss. Two reported to the chief technology officer (Glean and Bybit), one to the chief information officer (Anduril), one to a chief legal and trust officer (Obsidian), and one to an IT director (Keenfinity, whose CISO reports to the "Director IT STG"). Three did not state a line; BJAK's describes the CISO as board-appointed for technology risk. Of the six deputy, field and advisory CISO postings, Arctic Wolf's deputy and Harvey's advisory CISO report to the company's CISO, and Mimecast's field CISO to its global field CISO.

Large surveys find a wider spread, and they disagree with each other. IANS's State of the CISO 2026 study of more than 600 security leaders found that 64% report to an IT leader, usually the CIO or CTO, and 36% to a business leader such as the CEO, chief operating officer, general counsel or chief risk officer; CISOs with executive rank were twice as likely as VP-level CISOs to report to business leaders - TechTarget, January 2026. Heidrick & Struggles' 2025 survey of 371 CISOs found 42% reporting directly to the CEO, with the share under a CIO or CTO down to 30% - Heidrick & Struggles, February 2026. The two samples are built differently, so read the gap as a range, not a contradiction: somewhere between a third and two fifths of CISOs answer to the business rather than to IT.

Three questions about the line matter more than its label, and all three belong in the final interview: who sets the security budget, and can you argue for it with the person who approves it; how often you brief the board or its audit or risk committee, and whether your boss edits what you say; and whether a written route exists to escalate a material risk around your boss.

7. Certifications and degrees in leadership postings

Certifications matter less in leadership hiring than the advice online suggests, and more at the very top than in the middle. Of the 194 postings, 135 (70%) named no security certification at all. Among those that did, CISSP led with 51 postings, followed by CISM with 41.

The share naming any certification sits between 24% and 35% for every rung below the top, then jumps to 9 of the 14 CISO-titled postings. Even there, only three made one mandatory: BJAK, Bybit and Mimecast. BJAK's reasoning is worth reading in full, because it explains why regulated employers care. The Securities Commission accepts CISSP, CISM or CISA from the outside party that assesses technology risk controls, so the posting argues that "the officer who owns those controls should not sit below the standard set for the officer who audits them." The others treat certifications as a preference: Arctic Wolf and Trace3 list CISSP or CISM as preferred, Keenfinity as advantageous, Rain as nice to have, and Check Point says the relevant certifications, CCISO among them, "are beneficial but not mandatory."

Why CISSP and CISM, and in what order. The two certifications test different things and gate on different experience. CISSP needs five years of paid, full-time work spanning a minimum of two of the eight CISSP domains; a related degree can stand in for one year, and someone who passes the exam early becomes an Associate of ISC2 with a six-year window to gather the experience - ISC2, CISSP experience requirements. CISM needs five years spent managing information security in three or more of its four practice areas, all inside the decade before the application - ISACA, CISM. CISSP proves breadth across security; CISM proves you have run security as a management discipline. For someone on the technical road, CISSP usually comes first and CISM around the move into management; on the risk road, CISA or CRISC often comes first and CISM follows. The CISSP vs CISM comparison sets their demand on the board side by side, and the pages for CISSP, CISM, CISA and CRISC show which open roles name each one today.

The executive certification is rare in postings. EC-Council's CCISO is built for the role, and its eligibility rules ask applicants who apply directly for five years of experience in each of its five domains - EC-Council, eligibility and application. In this sample it appeared once, as an optional extra. Employers hiring a CISO overwhelmingly judge the seats a person has held, not an executive credential.

Degrees. 80 of the 194 postings (41%) mention a degree, and 34 of them (18% of the sample) accept equivalent experience instead. Fifteen mention a master's degree, almost always as a preference, and one, Arctic Wolf's deputy CISO, names an MBA, as an alternative to a master's in a related field. The strictest education requirements came from regulated employers: BJAK requires a degree in a computing or security discipline and the ability to meet the regulator's "fit and proper" criteria, and Bybit requires a bachelor's and prefers a master's. Obsidian prefers a master's and adds that "Executive leadership education is a plus." The US Bureau of Labor Statistics describes the broader management occupation the same way: a bachelor's degree, usually in computer science or IT, with some employers preferring a graduate degree, and typically five years or more in a related occupation - BLS, computer and information systems managers.

Clearance. 14 of the 194 postings (7%) asked for or preferred a US government security clearance, mostly at defense employers such as Anduril, Two Six Technologies and Second Front. Anduril's CISO must hold or be able to obtain a Top Secret SCI clearance, and its posting accepts "extensive experience in a senior cyber leadership role within the military or intelligence community" as an alternative to a CISO track record. For veterans, that is one of the more direct routes to the top in the sample; the cleared roles page lists today's cleared openings.

8. Field CISO, deputy CISO, virtual CISO and head of security

These four seats are variants of the job, and each one also serves as a way through the circular requirement in section 5.

Field CISO

A field CISO is a security executive employed by a vendor to advise its customers' security leaders, carry the company's view of the market, and help close large deals. Four postings carried the title or its cousin, advisory CISO. Illumio's is "intentionally sourced from the CISO community" and describes the job as "half executive advisor and evangelist, half hands-on architect": the hire builds demo environments and proof-of-concept frameworks as well as briefing analysts and customers, at $208,000 to $250,000. Mimecast's APAC field CISO, a "Director-level individual contributor," is told "This is not a pre-sales or support role" and is also asked to log advisory-linked opportunities in the CRM. Check Point wants public speaking and media experience for its Americas role; Harvey's advisory CISO, remote and reporting to Harvey's CISO, states $272,000 to $374,000.

All four ask for or prefer prior CISO-level experience and three mention boards, because a field CISO's credibility comes from having sat in the customer's chair. The job is therefore more often an exit from a CISO career than an entrance: good for someone who prefers the strategic conversation and the stage to budget fights and on-call nights, risky for someone who wants to run a program again, since time away from operations shows.

Deputy CISO

The deputy CISO is the most direct apprenticeship for the top seat, and the postings show why. Arctic Wolf's vice president and deputy CISO "is the direct people manager for Security Engineering, Security Operations (SecOps), and Governance, Risk, and Compliance (GRC)," with "full accountability for the strategy, staffing, performance, and budget of each function," and "provides leadership continuity for the security program in the CISO's absence," including representation at executive and board level. It asks for eight years of leadership directly managing those teams and ten of security experience. A deputy who has already presented to the board while the CISO was away has answered the most important question a CISO search will ask.

Kraken's deputy regional information security officer shows a second pattern found in large regulated groups: a security officer named for one entity or region, "accountable to their boards and their regulators," who presents to entity boards "with material review and coaching from the Global RISO Lead beforehand." That is board experience with a safety net, and it asks for seven years in security governance, ICT risk or regulatory compliance. Groups with many licensed subsidiaries, in banking, payments and crypto, create several such seats for every group CISO.

Virtual or fractional CISO

No posting among the 2,150 carried a virtual CISO title, which is itself informative: the virtual CISO is mostly sold, not hired. Companies too small to employ a full-time security executive buy the accountability from a consultancy or an independent adviser for a few days a month. Regulators allow it explicitly in some places. New York's rule says "The CISO may be employed by the covered entity, one of its affiliates or a third-party service provider," provided the company keeps responsibility for compliance and names a senior person to oversee the provider - NYDFS, Part 500 second amendment text.

The board shows where that work sits instead. Bitdefender's cybersecurity advisory consultant posting, a remote role in Romania, lists "Acting as a Virtual CISO/ISM for our customers to provide strategy guidance/support" among its typical projects, beside strategy reviews, gap analyses against ISO 27001 and NIST, and board-level awareness training. Fractional work suits a former CISO who wants several clients at once, and gives a senior advisory consultant a first taste of CISO accountability, though advising on a client's decisions is not owning them, and full-time CISO searches notice the difference.

Head of security at a smaller company

The most common first CISO job does not carry the title. A start-up's first security leader is usually called head of security or head of information security, owns everything from cloud configuration to customer questionnaires, and becomes the CISO when the company grows or prepares to go public. Zipline's posting describes that arc. IANS's 2026 study found that 52% of companies with under $100 million in annual revenue give their security leader an executive or SVP-level CISO title, so the word arrives earlier than it used to - TechTarget, January 2026. Whatever the title, three years running a whole program at a 200-person company is exactly the "CISO or Head of Security level" experience that Keenfinity and Bybit ask for.

9. CISO salary by rung and employer

Stated pay climbs with each rung. The largest step comes between director and the senior director group, and there is almost none between that group and the CISO title. The chart uses the yearly ranges stated by US postings in the sample; the middle is the median of range midpoints.

The seven CISO-titled postings with a US range were Glean at $424,300 to $489,400, Harvey's advisory CISO at $272,000 to $374,000, Anduril at $252,000 to $382,000, Obsidian Security at $280,000 to $340,000, Trace3 at $250,000 to $350,000, Rain at $250,000 to $325,000 and Illumio's field CISO at $208,000 to $250,000. The other seven gave no US dollar range: five are outside the United States (Mimecast's Australian posting states $220,000 without naming a currency), and Arctic Wolf's deputy CISO and Check Point's global field CISO state no figure at all. Seven ranges cannot describe a market alone, hence the survey figures below.

The board's live figures for its whole leadership specialty update every hour. Its typical span runs from $194k/yr to $397k/yr, and its middle sits at $229k/yr, measured over every leadership role stating a range, including program managers and physical security leads.

The employer moves pay more than the title. The eight leadership postings from AI labs in the sample, all manager-level roles at Anthropic and OpenAI, had a middle of $415,000, and the single highest range in the sample belonged to a manager: Anthropic's engineering manager for hardware platform security, at $485,000 to $625,000, above every CISO range on the board. A manager at a frontier lab can out-earn a CISO at a payments start-up by a wide margin. The salary page for managers, directors and CISOs splits today's figures by employer kind and by employer, and the highest paying jobs ranking places the CISO title among every security job the board tracks.

Posted ranges are base pay, and equity is the hidden half at the top. Anduril's range is stated as "inclusive of base salary only," with "Highly competitive equity grants" in most offers; Glean's is a standard base range with possible variable pay and equity; Rain gives every employee an equity option plan; Trace3 mentions bonuses or commissions on top. Across the sample, 44% of postings mentioned equity and 44% a bonus or incentive. The IANS and Artico Search study of 566 CISOs in the US and Canada put the median US CISO's total compensation (base, target bonus and equity) at $392,000 and the average at $583,000, with the top 1% above $3.2 million; 70% of CISOs received equity, and for top earners it could make up half of the total - IANS, November 2025. The gap between a posted base and a survey's total is largest exactly where the role is most senior, so negotiate the equity, the bonus target and the refresh schedule as carefully as the base.

The economy-wide benchmark is lower. The US government groups security executives with computer and information systems managers, whose median pay was $175,140 in May 2025, with employment projected to grow 16% from 2025 to 2035 and about 53,500 openings a year - BLS, computer and information systems managers. It covers IT managers in hospitals, schools and local government too; the technology employers on this board sit well above it.

Remote work narrows at the top. 35% of the 194 postings were listed as remote, but only 3 of the 14 CISO-titled ones, and the text of one of those three, Arctic Wolf's deputy CISO, says it wants the hire in one of two offices for now. A CISO is expected in the room when the board meets and when an incident breaks. The remote leadership roles page lists the leadership openings that are remote today.

10. Personal liability and the other risks of the job

The CISO's personal exposure grew between 2022 and 2025, and two US cases mark its limits.

SolarWinds: statements made in public. On 30 October 2023 the SEC sued SolarWinds and its CISO, Timothy Brown, alleging misleading statements about the company's cybersecurity practices before the attack that compromised its software. In July 2024 the court dismissed most of the claims but let those tied to the security statement on the company's website go forward, against both defendants. On 20 November 2025 the SEC announced that the remaining claims had been dismissed with prejudice - Ashurst Perkins Coie, December 2025. The case ended without a finding against the CISO, but its lesson stays: the public descriptions of a security program (a trust page, a security statement, an answer in a customer questionnaire) can be attributed to the person responsible for the program. Keep them accurate, and keep a written record when you raise a gap that is not fixed.

Uber: concealment, not the breach. Joe Sullivan, Uber's former chief security officer, was convicted in 2022 of obstruction of justice and misprision of a felony over the handling of a 2016 breach that exposed data of 57 million users; he approved a $100,000 payment to the attackers through the bug bounty program along with a nondisclosure agreement, while the FTC was investigating Uber - Baker Botts, March 2025. He was sentenced in 2023 to three years of probation and a $50,000 fine, and the Ninth Circuit upheld the conviction on 13 March 2025 - The Record, March 2025. The crime was the cover-up. A CISO's legal protection is the opposite habit: tell legal, tell the people the law says must be told, and write down when you did.

European rules aim at management. NIS2 lets national authorities, as a last resort against an essential entity that does not remedy deficiencies, ask a court to temporarily prohibit a person with managerial responsibilities "at chief executive officer or legal representative level" from exercising managerial functions; it sets administrative fines for essential entities of at least €10 million or 2% of worldwide annual turnover as the maximum national laws must allow, and requires an early warning of a significant incident within 24 hours and a notification within 72 - EUR-Lex, Directive (EU) 2022/2555, Articles 23, 32 and 34. They target the chief executive more than the CISO, but they make the CISO's advice a matter of the executive's personal interest.

Signatures and clocks. In New York-regulated firms the CISO co-signs the yearly compliance certification with the top executive, and a cybersecurity incident must reach the regulator within 72 hours of determining it occurred - NYDFS, Part 500 second amendment text. Each deadline forces a judgment under uncertainty, which is why the job asks for calm as much as knowledge.

Protecting yourself is part of the offer. IANS found that directors and officers insurance coverage for CISOs rose from 40% to more than half of respondents in 2025, and that about one in five receive protections such as access to legal counsel or a severance agreement - IANS, November 2025. Before signing, ask whether the company's D&O policy names you as an insured officer, whether the company will indemnify you in writing, which regulatory filings you will sign, and what severance applies if you leave after an incident.

The workload is the everyday risk. In IANS's 2026 study, 52% of CISOs said their responsibilities could not be managed with current resources, and 69% were open to changing jobs within the next year - TechTarget, January 2026. The postings show the pressures behind those numbers: a private equity exit timetable at Keenfinity, a pre-licence independent assessment at Bybit, a program that must be built from nothing at BJAK, and incident duty everywhere. The CISOs who last choose employers whose risk appetite and budget they can live with, and say so before accepting.

11. A realistic ten-year route to the CISO seat

The postings put the CISO seat at ten to fifteen years of experience, seven or eight of them leading people. This route fits those numbers and names the evidence each stage should leave behind. It starts from a first security job; the step before that is mapped in the guide to getting into cybersecurity.

Years 0 to 3: a specialist seat with real stakes. Work in security operations, engineering, application security, identity or GRC, ideally somewhere that sees real incidents and real audits. The evidence to collect: investigations you closed, controls you built, an audit finding you fixed. Engineering and operations start the technical road, GRC and audit the risk road; both arrive.

Years 3 to 5: own a program, not just tasks. Become the person accountable for something with an outcome: the vulnerability management program, a SOC 2 audit, the identity rollout, the incident response plan. Lead incidents yourself. This is when CISSP becomes possible (five years of experience, or the associate route earlier). Start writing short decision memos for managers outside security; it is the most transferable skill on the whole ladder.

Years 5 to 7: the first management job. The manager postings asked for seven years with three leading people, so the first title usually follows a period of informal leadership: tech lead, shift lead, the person who onboards new hires. Many first managers are promoted internally, since outside employers want proof of management. Lead a team whose work you know deeply: first-year credibility comes from judgment.

Years 7 to 10: a second team and a budget. Move to senior manager or director by taking on a second function next to your first (operations plus engineering, GRC plus third-party risk), managing managers, and owning a budget line. Present to executives regularly. Add the other road: if you came up technically, own an external audit and learn the frameworks; if you came up through GRC, spend time in incident response or engineering. CISM fits here, since its experience requirement is management experience.

Years 10 to 12: a seat with board exposure. This is the stage where most careers break the circular requirement, through one of four seats: deputy CISO at a large company, head of security at a smaller one, a named security officer for a regulated subsidiary, or director at a company preparing for an IPO or a licence. Each gives you, in a recognizable form, the experience the CISO postings ask for: having answered to a board or a regulator. Ask to join an acquisition or divestiture due diligence process if one happens.

Years 12 to 15: the first CISO title. The first CISO job is usually at a company smaller, younger or more regulated than your current employer, and the remit grows faster than the pay. After one or two CISO seats the doors open widely: a larger company's CISO role, a field CISO post, fractional work across several clients, or a board seat of your own.

What speeds the route up. The postings suggest four accelerators: a regulated industry, where named security officer seats are more numerous; a fast-growing company, where scope arrives before seniority; a deliberate employer change at each plateau, since a frozen promotion path at one company says nothing about the market; and walking both roads, since the deputy and CISO postings at the top of the market ask for technical depth and governance together. The job title pages for security managers, security directors and CISOs show which employers are hiring at each of these stages today.

12. Questions about becoming a CISO

How many years of experience does the CISO seat take?

Usually ten to fifteen from a first security job. The CISO-titled postings of 12 November 2026 wanted ten years at the median, eight of them spent leading people, and 11 of 14 asked for or preferred prior experience as a CISO, deputy CISO or head of security. Senior director, head-of and VP postings at large employers wanted 13.5.

Which qualifications do CISO postings actually ask for?

Mostly seats already held. Of the 14 CISO-titled postings, 11 asked for or preferred prior senior security leadership, 9 named the board, 9 named a certification (mandatory in only 3) and 7 mentioned a degree. CISSP and CISM led the certifications, and a US clearance appeared only at a defense employer.

How much does a CISO make?

The CISO-titled postings with a US salary range stated base pay from $208,000 (a field CISO) to $489,400, with a middle of $310,000 across seven ranges on 12 November 2026. Total pay is higher: IANS put the median US CISO's total compensation, including bonus and equity, at $392,000 in 2025. Across the board's whole leadership specialty, typical stated pay currently runs from $194k/yr to $397k/yr.

Is CISM or CISSP better for a CISO?

They prove different things, and many senior leaders hold both: CISSP shows breadth across eight domains, CISM shows five years spent managing security. Of the 194 leadership postings, 51 named CISSP and 41 named CISM, while 70% named no certification at all.

Can you become a CISO without a technical background?

Yes, through governance, risk, audit or compliance, and that road is shortest at regulated employers such as banks, payments companies, crypto exchanges and firms seeking licences. Product and defense technology companies prefer a technical record: Anduril asked for a background that is "not exclusively a governance/policy career path." Either way, you need enough technical depth to challenge engineers credibly.

What is a field CISO?

A security executive employed by a vendor to advise customers' security leaders, speak for the company in the market and support large deals, usually without running an internal program. Four postings on the board carried the field or advisory CISO title on 12 November 2026, at Illumio, Mimecast, Check Point and Harvey, and all four asked for or preferred prior CISO-level experience.

What does a deputy CISO do?

A deputy CISO usually runs the security functions day to day and stands in for the CISO. Arctic Wolf's deputy CISO directly manages security engineering, security operations and GRC, owns their budgets, and represents the program at executive and board level in the CISO's absence. It is the most direct preparation for the top seat.

What is a virtual or fractional CISO?

A part-time security executive supplied by a consultancy or an independent adviser to a company that cannot justify a full-time one. New York's financial regulator explicitly allows a CISO employed by a third-party service provider, provided the company keeps responsibility. None of the 2,150 open roles carried the title; the work sits inside advisory jobs.

Who does a CISO report to?

It varies. Among the board's eight CISO postings, two reported to a CTO, one to a CIO, one to a chief legal and trust officer and one to an IT director, and none to the CEO. Surveys find that between about a third and two fifths of CISOs report to a business leader such as the CEO, and the rest to IT.

Can a CISO be held personally liable for a breach?

A CISO can face personal legal exposure for what they say and conceal, more than for the breach itself. The SEC sued SolarWinds' CISO in 2023 over public security statements, before dismissing the case in November 2025, and Uber's former security chief was convicted of obstruction over hiding a breach. Ask for directors and officers insurance and written indemnification before accepting the role.