12 Strategic Career Tips for Aspiring CISOs

Originally published by Abnormal Security.

Written by Mike Britton.

In the ever-evolving world of cybersecurity, the role of Chief Information Security Officer (CISO) has been firmly established as a critical position. And while the journey to becoming a CISO can be challenging, the destination is undoubtedly rewarding—and certainly never dull.

Whether you're taking your first steps on the road to a CISO role, navigating the mid-career landscape, or transitioning from a different field, we want to help you forge a successful path.

In this article, we outline how professionals at all career stages can prepare for and progress toward becoming a CISO.

Advice for Security Professionals Just Starting Out

Get Involved

It's important not to limit yourself to just one area of security, such as focusing solely on Security Operations Center (SOC) activities. Instead, get involved in all aspects of security.

Aim to gain exposure and experience in various domains, such as governance, risk, compliance (GRC); vulnerability management; incident management; and more. This broader understanding will provide you with a well-rounded skill set and a holistic perspective on cybersecurity.

“Don’t ever pass an issue onto someone else because you don’t know how to do it. Take it as a chance to learn more about that one thing to expand your knowledge.”
—Sr. Systems Administrator, Savage

Understand Privacy

Privacy and security are closely intertwined, which means having a solid foundation in privacy regulations and principles is crucial. With the advent of regulations like the General Data Protection Regulation (GDPR), privacy has become a significant concern for organizations worldwide.

Understanding privacy requirements, data protection principles, and the legal landscape surrounding privacy will empower you to address privacy concerns properly and ensure compliance with relevant regulations.

Study Risk Management

Cybersecurity is ultimately about managing risks. Developing a strong understanding of risk management principles is essential for making informed decisions and effectively prioritizing security efforts.

Learn how to assess and quantify risks, recognize the trade-offs between security measures and business objectives, and cultivate a nuanced perspective that acknowledges the shades of gray inherent in risk management.

Take Detours

Don't be afraid to take short detours outside of cybersecurity. For example, consider spending some time in internal audit.

Internal audit provides an opportunity to assess controls, identify risks, and ensure compliance—giving you a different perspective on security and enhancing your overall comprehension of organizational risk management.

Having knowledge of related fields can make you a more effective and versatile cybersecurity professional by enabling you to bring a more holistic approach to your work.

Guidance for Mid-Career Security Professionals

Find a Mentor

One of the great things about cybersecurity is the wealth of veteran CISOs who are available and willing to mentor and guide those who are looking to join their ranks.

Look for a mentor outside of your organization who can provide valuable insights, advice, and support. A mentor can offer guidance on career development, share their experiences, and help you navigate the challenges and opportunities in the cybersecurity industry.

Learn the Business

If you don’t appreciate how your organization fundamentally operates and generates revenue, you can’t be an effective risk manager.

Take the time to learn about the core business processes, the industry landscape, and the organization's goals and objectives. This understanding will enable you to align cybersecurity initiatives with business priorities, identify critical assets, and make informed decisions about risk management.

Build Relationships

Cybersecurity is a collaborative effort that requires strong relationships and open communication with stakeholders across the organization. Pinpoint areas of the business that you are less familiar with—such as sales, marketing, finance, or legal—and seek out individuals who are willing to teach you and answer your questions.

Building relationships with colleagues in various departments will not only expand your knowledge but also foster a culture of collaboration and support.

“I’ve found my greatest success in projects when I collaborate. In my opinion, the lessons learned from peers have greatly impacted my success.”
—Network Security Expert, Cru

Get Connected

Joining trust groups and participating in cybersecurity-focused Slack channels, email groups, and local communities can provide valuable networking opportunities. These platforms allow you to connect with like-minded professionals, share learnings, exchange best practices, and stay up to date on the latest industry trends.

Additionally, these networks can serve as a valuable resource when you are hiring, providing access to a pool of qualified candidates with diverse experiences and expertise.

Recommendations for Non-Security Professionals

Be Flexible

Cybersecurity is a rapidly growing industry with a high demand for talented individuals. Even if you’re currently in a high-level position in your industry, you should be open to starting in a more junior role to gain experience and establish a foundation.

While taking a step back initially may be necessary, your motivation and willingness to learn can help you progress quickly and bridge any knowledge gaps in a relatively short period of time.

Identify Your Strengths

Cybersecurity teams often require individuals with diverse backgrounds to fill gaps in expertise. If you're looking to transition into a cybersecurity role from another field, identify the areas where your existing skills and knowledge can complement the needs of the cybersecurity team.

For example, if you have strong communication or project management skills, you may be able to contribute to cybersecurity awareness programs or coordinate security initiatives.

“Be authentic. Whatever you are passionate about is going to shine through, and when you have to force yourself to be excited…it is a clear sign it is not for you.”
—Director of Risk & Compliance, Noname Security

Find Your Place

Cybersecurity is a multidisciplinary field that requires expertise from various domains. Professionals with backgrounds in finance, HR, legal, risk management, audit, and IT can all contribute to different aspects of cybersecurity and make a significant impact.

For instance, finance professionals can assist with budgeting and financial risk analysis, HR professionals can help develop security training programs, and legal professionals can provide guidance on compliance and privacy matters.

Start Now

If you're currently employed, begin by exploring opportunities within your own organization.

Get to know the CIO, CTO, and CISO. Express your interest in transitioning into cybersecurity and make sure they are aware of your aspirations. Building relationships with key security stakeholders in your organization can increase your chances of being considered for cybersecurity roles or being provided with relevant opportunities for growth and development.

Building a Successful Career as a CISO

By broadening your expertise and building strong relationships, you can strategically position yourself for a successful career as a CISO.

Following the steps above allows you to leverage your existing skills and experiences while affirming your commitment to learning and contributing to the growth of the field of cybersecurity. You’ll also demonstrate to others that you are a well-rounded professional capable of addressing the complex challenges of the industry.