Career Roadmap: Chief Information Security Officer

Cybersecurity is a lucrative field for anyone with IT knowledge and skill. Increasingly, businesses of every size and scope are being targeted by cybercriminals eager to access their information and accounts, and organizations are offering generous salaries to security professionals capable of designing and implementing programs to keep their networks and data.

Yet, those ambitious professionals interested in climbing the ranks of the security career might set their sights on the role of chief information security officer, or CISO. A relatively new title in the C-suite, this executive is responsible for developing the strategies and programs for security workers to uphold. The median salary for a CISO is about $131,000, and CISOs typically enjoy additional perks associated with being amongst the highest ranks of business leaders.

So, how does one become a CISO? Fortunately, the path into the C-suite through information security is quite straightforward:

Earn a Bachelor’s Degree

Some of the biggest names in tech — Bill Gates, Steve Jobs — gained knowledge, skill and overwhelming success without a bachelor’s degree, but that era is long past. Today, every entry level position in tech requires a college degree, ideally in a field related to tech like computer science, information technology or cybersecurity. In addition to being a mandatory qualification for job application consideration, a degree program will provide CISOs-to-be with foundational knowledge and skills about digital systems. Additionally, bachelor’s programs can begin a future CISO’s networking journey, introducing them to peers, professors and other professionals who might be of assistance in their upcoming career.

Gain IT and Security Experience

No CISO moves straight from academia into the C-suite. Entry-level work is a necessary step in almost every career ladder, and neither information technology nor cybersecurity is an exception. Fortunately, there is plenty of value in spending time in lower-level employment positions. Executives need to understand what challenges are faced by their workforce; without the perspective provided by performing entry-level work, a business leader might not be capable of creating practical and effective strategies, processes and programs. Prospective CISOs should take full advantage of their early careers to identify issues that low-level employees face and brainstorm solutions that executives might enact.

Optional: Gain a Master’s Degree

A master’s degree in a field related to cybersecurity will provide CISOs-to-be with a more advanced understanding of the theories and concepts that guide this field. Often, managers and high-level executives have master’s degrees — though master’s degrees are generally not strictly required to advance up the cybersecurity career track. Those workers who have the time and resources to participate in a master’s degree program while maintaining employment might take advantage of the opportunity to enhance their education credentials. Yet, if pursuing a master’s degree will put a worker in serious debt and compromise the stability of their career, it might be more lucrative to focus on improving one’s knowledge and skill through the workplace or through free CISO security resources online.

Obtain Security Certifications

Because cybersecurity is a relatively new field, it is constantly shifting. Thus, to prove that a professional is up to date in their understanding and ability, they must pursue a number of certifications. Some certifications that are essential for CISOs include:

• Certified Ethical Hacker (CEH)
• GIAC Security Leadership (GSLC)
• Certified Authorization Professional (CAP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Offensive Security Certified Professional (OSCP)
• Certified Chief Information Security Officer (CCISO)
• Certified in the Governance of Enterprise IT (CGEIT)
• Certified Information Systems Security Professional (CISSP)

Join Professional Security Organizations

Climbing a career ladder into the executive sphere can be difficult, and it will likely take workers decades to achieve. Still, reaching the upper levels of IT and security management can be easier with proper networking. Developing strong relationships with peers across the cybersecurity industry can give workers access to information about available positions that will improve their careers. There are dozens of associations and organizations that help bring security professionals together, but some of the best for CISO hopefuls to join include:

• CISO Executive Network
• Association of Information Security Professionals (AISP)
• International Association of Privacy Professionals (IAPP)
• International Association of Security Awareness Professionals (IASAP)
• Information Systems Security Association (ISSA)

By continuing to learn and grow throughout one’s career — by meeting the right people and applying for promotions and new positions at the right time — it is possible for a talented, eager and dedicated security worker to become a successful CISO.