I posted the text below on LinkedIn on Friday. It seems I hit a nerve :) Are you really recruiting a CISO?…
Jarkko R. — CISO
I posted the text below on LinkedIn on Friday. It seems I hit a nerve :)
Are you really recruiting a CISO?
Being a CISO who delivers real business impact takes years of experience — just as it does for a successful CEO, CFO, or CIO.
Yet job ads increasingly read: "We're looking for a junior CISO." "An information security professional with 3–5 years of experience to be our new CISO." "A specialist in one security domain to lead all of security."
There's a "C" in the title for a reason. No one hires a junior CEO. No one appoints an IT specialist as CIO to drive digital transformation. And no CFO earns the salary of a newly graduated accountant.
The CISO role is one of the most complex jobs in any company. You need to understand how everything fits together: business, technology, culture, values, leadership, operating model, every unit and team, boards, third parties, regulators, and external auditors. And a few other functions face active, malicious adversaries every single day — the role demands exceptional stress resilience on top of everything else.
Here's what many hiring decisions miss: the junior hire is rarely the cheaper one. A less experienced CISO needs more headcount, more external consultants, and more time to recover from avoidable missteps. The senior CISO's salary is higher, but the total cost of ownership is lower — and the board gets real assurance instead of false comfort.
So ask yourself:
Are you actually recruiting a CISO — or a specialist with an inflated title?
If you choose the junior candidate, are you setting them up for success or for failure? And are you ready to invest the money and time to support them properly?
If you're a headhunter, can you give your client the right guidance on what this role truly requires?
Think about it.
3 reactions · 0 comments