Cyber-attacks continue to rise in number and scope. Black-hat hackers are constantly seeking ways to compromise networks and hold data for ransom. Hackers also seek to influence our system of elections and they even want your credit card number. For that reason, both governmental and private concerns are eager to hire tech-savvy security professionals who can address the issue. The field includes positions in law enforcement as well as industries ranging from healthcare to restaurants, and even automotive manufacturing. Wherever there is sensitive intellectual property or private data, there is a need for a cyber security professional. Wherever there is a cyber security professional there is often a chief information security officer (CISO) above them. Keep reading to learn more about how to become a CISO.
What is a Chief Information Security Officer?
A chief information security officer is a top-level executive who oversees an organization's security efforts. Their role is often administrative and managerial in that they direct the various members of a security team. In a very large organization, this job may involve travel to numerous locations to consult with IT and security professionals there. The CISO often collaborates with a chief information officer (CIO) regarding IT solutions that are both effective for the business and don't compromise the network or its databases.
Steps to Become a CISO:
The road to become a CISO is often a long one. These cyber security technology professionals put in many years of hard work before they are finally promoted to the C-suites. However, every journey begins with a first step.
The first step to becoming a CISO is to determine that you are cut out for a career in high technology. If you have a strong attraction to computers, electronics, and technology in general you should start investigating the field. CISOs are often very good at mathematics, logic, and enjoy solving puzzles. Since you'll need to start with an entry-level cyber security job, you must have a desire to track down bad guys.
Once you have decided that you have the innate talent and desire to pursue a cyber security career, you should start learning computer programming languages. You can also fill your free time with electronics projects, reading computing magazines, and even solving logic problems.
Your second step should involve education. Since you're aiming to become a top-level executive, you should probably pursue formal, academic training. While you can start a cyber security career with certificates and informal training that leads to sharp skills, executive level jobs often require a master’s degree.
Thus, your second step is to find and enroll in the best degree program available to you. Though your first milestone should be a bachelor’s degree, you can always start with a community college and an associate degree. However, make sure that your cyber security training is fully accredited with either ABET or CAE credentials. That way you can be assured of progressing into a top-notch bachelor’s degree program in cyber security, computer science, or information technology with a focus on information security.
Note that you can pursue an online degree program while you implement your self-taught technical skills in an entry-level position. What matters most is that your bachelor's degree is accredited.
If you are taking a more traditional route to your academic credentials, you should make sure that you integrate work experience into those years. This could include a part-time job in an IT department, a co-operative program through your university, or an internship with a local or national firm.
Most students will look for an internship. There are many well paid internships for cyber security students. These include work with federal law enforcement, top corporations, and even smaller consulting firms. In fact, there are fellowship opportunities that pay a significant portion of your tuition and expenses in return for work over summer break, and then a period of work once you graduate with a bachelor's degree.
You can also enhance your cyber security degree by engaging with campus organizations dedicated to computer science or cyber security. You can seek a leadership role within these organizations and spearhead initiatives to help your fellow students secure their data.
After graduation, you will want to dive into an entry-level job in information security or cyber security. Opportunities abound with state and federal law enforcement, not to mention the high demand for cyber security professionals in corporate America. You should continue learning and earning credentials if you wish to make it to CISO. Seek out information security certifications such as CompTIA Security+ which will prove that you have a strong, broad cyber security knowledge base.
From there, as you conduct your career, you will certainly want to enroll in a graduate program. If your sights are on the C-suites and a CISO (or chief information officer) position, you will want to complete an MBA. Here you have two broad options – a dual MBA or an MBA with a cyber security or computer science concentration. Your dual MBA should be with either of those two, or some technology degree with an information security focus.
What Does a CISO Do?
A CISO is in charge of making sure their company, agency, or organization is secure from any cyber-attack. They also oversee investigations into any possible cyber-attacks and any security incident. To secure their network, they hire the best managers they can find and help make decisions regarding new hardware, software, and security protocols.
On a day-to-day basis they might spend time reviewing reports from their managers and reviewing security policies and security protocols. CISOs may also review thorough audits of the network or evaluations of new hardware and software products they might implement. CISOs also are known to do a lot of traveling, especially those who oversee the security operations of massive corporations. They visit offices or other operation hubs throughout the corporation.
A CISO also spends a good deal of time researching a myriad of cyber security issues as well as regulatory compliance. They may gather information on the cyber security threats that are currently dominating the landscape and they are surely looking for smaller threats so that the network is prepared for the future. Additionally, CISOs may collaborate with federal and state cyber security law enforcement officials to share information regarding known threats, report any security breach, or attempted breaches, and to learn more about the black-hat hacker environment.
Chief Information Security Officer (CISO) Skills to Acquire
This is a fundamental skill for any cyber security professional. The ability to encrypt and de-encrypt data is vital, especially when sharing data across a network.
- Penetration Testing (Ethical Hacking):
You will need to have a strong understanding of how white-hat hackers work. This is the practice of hacking a network with the intention of exposing vulnerabilities so that the rest of the cyber security team can strengthen overall security.
Since you will sit at the top of the cyber security chain of command, you will need to motivate and inspire your team. Leadership skills may come natural for some, but you might also learn more about leadership skills when you work towards your MBA.
Since you will have an office on the top floor, you will need to communicate effectively with your fellow top executives. You will also need to establish a rapport with your managers and even the rank-and-file cyber security professionals. Your skills should include masterful business writing as well.
- Risk Management:
This is a skill you may have to take formal classes to fully grasp and implement. Risk management is often taught as part of the core MBA curriculum.
This is another crucial skill for a top-level executive. Your cyber security team will need to create a budget that covers every possible expense and then stay within those parameters. Your MBA degree should cover this aspect of business, or you could take a few accounting courses if needed.
Many will seek a CISO position by way of the traditional routes, including a graduate degree. However, there are alternative paths to success in cyber security, including the top-level status of chief information security officer (CISO).
For starters, it's possible to self-teach yourself a lot of cyber security practices and principles. You can find books on the subject that are thorough and up to date with the current technologies. You can also find online resources that teach cyber security. You might even consider creating your own curriculum that includes online courses and information security certifications. For instance, you might achieve the CompTIA Security+ certification and land an entry-level position with that credential. Other certifications cover areas such as ethical hacking (penetration testing,) cryptography, networking, and database management. Once you are certified in one specialty area you will likely find other certifications are easy to acquire.
While some firms may insist on an MBA for their top brass, you can always find a firm that will reward your technical knowledge and skills with a CISO position. As long as you continually hone your hard and soft skills, you can rise to the top. That is, if you are certified in one specialty, you should maintain that certification and seek to become certified in other areas, too.
Chief Information Security Officer (CISO) Career & Salary
Where Might You Work?
Chief information security officers typically work in corporate environments and not for government agencies. However, you might start your career working for the Department of Homeland Security (DHS), the Central Intelligence Agency (CIA), or the Federal Bureau of Investigation (FBI), among other governmental agencies. Once you become CISO you will be afforded the benefits of private enterprise.
Given the crucial role that cyber security plays in business, you are certain to find cyber security positions in most any industry. Any firm that relies on a database will need a full-time person to secure that asset. In particular, you might find your skills in high demand in the healthcare industry, which sees frequent ransomware attacks, but also in large food distributors, trucking companies, and more.
With the status of your CISO position will come requirements such as travel. Many top executives must frequently travel to visit their corporation's regional offices and other outposts. However, you might hold the title of CISO in a small tech start-up that needs a great deal of security for its intellectual property.
The career outlook for chief information security officers is quite rosy. This is because more and more assets are available on computer networks, which prompts black hat hackers to proliferate, each in hopes of cashing in. Thus, you and your fellow certified cyber security professionals must rise to defeat them and protect networks and databases.
The US Bureau of Labor Statistics (BLS) may not track CISOs specifically, but the agency does show that information security analysts with a bachelor's degree earn a median salary of $99,000. Meanwhile, computer and information systems managers earn a median salary of $146,000, also with an average education of a bachelor's degree. In the C-suites, chief executives earn an average salary of $193,000 and those who specialize in computer systems earn and average salary of $232,000.
Given that the field for information security analysts is slated to expand by 31% through 2029, it’s clear that the demand for CISOs will likewise expand. The sheer volume of jobs in the CISO employment sector is sure to be far lower, but the expansion rate should track with that of infosec analysts.
To land a job as a chief information security officer, you will need a rock-solid resume full of technical skills and technical knowledge. Since this is possibly the top level in the information security profession, it may be difficult to find job listings online. However, maintain contact with executive recruiters who specialize in computing and information security executive positions.
- Information Security Architect:
This is a senior-level position that requires a minimum education level of a bachelor's degree in computer science, cyber security, information technology, or another related field. They also need to see a minimum of 6 years' experience. Security certifications such as Information Systems Security Architecture Professional (ISSAP) are also preferred.
- Principal Security Architect:
This position requires top-notch technical skills on top of excellent communication and other soft skills.
- Chief Information Security Officer (CISO):
This job offering is looking for a creative leader who can communicate with their team while building networks with outside players. The minimum education they require is a bachelor's degree, but they prefer those with a master's degree and 10+ years of experience in IT, risk management, or information security (cyber security).
- Senior Security Engineer:
This position reports directly to the company's CISO, so this is a great opportunity for those seeking the brass ring as a C-level executive. You'll have to know how to manage security incidents and communicate technical details to the non-technical staff and executives.
Find Chief Information Security Officer (CISO) Jobs Near You
Advancing from Here
Once you reach the level of chief information security officer (CISO), there isn't much farther to go up the corporate ladder. However, if you have an MBA, you can always seek the chief executive officer (CEO) position. On the other hand, with this level of administrative skill and technical skills, you might consider opening your own information security consulting firm.
Another possibility is to expand your career by becoming an instructor. Even if you don't have a graduate degree, you might be able to teach for a university or community college. On the other hand, you might work to help students that are seeking a certificate in cyber security. Corporations may also pay you to facilitate training sessions for their cyber security executives.
Computer Career Paths