The role now
The CISO owns the organisation’s information security: the risk picture, the security programme, the response when something goes wrong, and the reporting to executives and the board.
In Australia the role is shaped by regulation as much as by threats. Depending on the organisation, that can include APRA’s CPS 234, the Security of Critical Infrastructure Act, the Privacy Act’s notifiable data breaches scheme, and the Essential Eight in government.
Hiring a Chief Information Security Officer: settle these first
Where will the CISO report?
Reporting to the CIO, the CRO, the COO or the CEO each says something different about independence. Candidates will ask, and the strongest ones will ask how often they see the board.
What does the role own?
Strategy and governance only, or the security operations team and tooling as well. Be clear about budget and headcount.
Which obligations apply?
Name the regulation and frameworks the organisation answers to. Experience with the right regulator shortens the time it takes a new CISO to be useful.
Stepping up to Chief Information Security Officer
Security managers and architects who step up to CISO usually need two things they have had little of: board reporting, and owning risk decisions rather than advising on them.
Ask to present to the risk or audit committee, run an incident exercise with executives in the room, and learn how your organisation’s risk appetite is set.
The techexec network is built for this step. Members get a monthly briefing, small roundtables and a confidential career conversation with Aaron. Join the network.
What we ask candidates about
- An incident you managed: what happened, what you told the board, and what changed.
- Which regulators and frameworks you have answered to.
- How you report risk to people who are not technical.
- The size of the team and budget you have run.
Questions
Why do CISOs leave soon after they start?
The common reasons are a reporting line that leaves them without independence or authority, and a mismatch between the mandate and the budget. Settling both before the search lowers the risk.
Do you recruit for regulated industries?
Yes. We ask candidates about the specific regulators and frameworks they have worked with, because experience in one regulated sector does not always carry straight across to another.