CISO
Board decks, budget defence, incident accountability, regulator calls. Most weeks are politics and translation, not engineering.
Stretch destination. 8–15 years of operational security and a real major-incident under your belt is the honest minimum. Don't optimise toward this in year 2.
Read the full role verdict and reasoning
Security leadership connects organisational risk, resources and executive decisions.
- Domain
- Cybersecurity
- Entry
- Not mapped
- Senior
- Not mapped
- You've already run security as a manager or head of, and the next obvious step is executive accountability
- You can hold a board conversation about risk without retreating into engineering vocabulary
- You're prepared to be personally accountable when an incident hits the press
- You actually enjoy the politics, budget defence and regulator-facing work
- You're still an individual contributor, the title is a fantasy from here
- You'd resent leaving the technical work behind, you will leave it behind
- The accountability and executive responsibilities do not match the work you want
What "doing well" looks like in the seat
- You've led at least one major incident end-to-end and lived to tell it
- You can defend a security budget against finance without flinching
- Engineering, legal and risk all bring you in early, not late
- You've already been asked to advise other security leaders informally
Accountability, reporting lines and authority vary substantially. Examine executive sponsorship, risk ownership and the support available for difficult decisions.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
Group CISO / CSO; advisory or board-level work after that. Title is mostly horizontal once you're in.
Who actually gets in
- +Security Manager
- +Security Architect
- +Head of GRC
- +ex-Big 4 partner
Common misconceptions
- −That it's a senior engineering job. It's an executive risk role with a security label.
- −That CISSP gets you there. CISSP may meet a stated requirement; executive decisions, incident integrity and resource accountability need their own evidence.
- −That every org needs one. Most orgs under ~500 staff buy fractional or merge it into the CTO.
Where this leads
- vCISO / fractional
- Board advisory
- Security consulting partner
- Risk leadership
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
- GRC (Audit, Risk, Compliance)
Governance and risk work that connects control evidence to accountable decisions.
- Security Architect
Plan your move from technical delivery into security architecture: progression stages, practical projects, certification choices and evidence of readiness.
- Cloud Security Engineer
Cloud security work joins threat reasoning with knowledge of how workloads are deployed and operated.
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.