Cybersecurity leadership can vary greatly depending on the company, market, industry sector, regulatory weight, and how boards and executive leadership view cybersecurity risk. Most are familiar with the Chief Security Officer (CSO), Chief Information Security Officer (CISO), Business Information Security Officer (BISO), Technical Information Security Officer (TISO), and Information Security Officer (ISO) as leadership in this space. Some of those roles and functions translate into government roles and functions. The exception is that the government, whether DoD or Federal, has Information Assurance Managers (IAM), Information Assurance Officers (IAO), Information System Security Managers (ISSM), and Information System Security Officers (ISSO) with specific defined roles and functions.

Levels for these roles can range from an executive at a Vice President level to directors or senior managers. There is a lot of debate on this, and some companies still have CISOs and cybersecurity organizations reporting to CIOs, CTOs, CFOs, and General Counsel even though the role should accordingly report to the CEO as a peer to CIOs and CTOs. Likewise, the Chief Risk Officer (CRO) role is starting to get folded under cybersecurity, and recently, the Chief Cybersecurity Officer role has made its way into the mix. There are varying degrees of opinion within this space, with some consensus, but most debates here tend to get contentious quickly.

Fractional or virtual CISOs and BISOs can be found in the commercial space. These are usually consulting roles that may also have cybersecurity program delivery responsibilities.

Cybersecurity leadership types are divided into government, corporate, commercial, and product to acknowledge core differences. In this space, there are those running programs or those consulting on the delivery of those programs. There is not a lot of variation in that perspective.

One of the critical elements of standardization around competencies and tasks is developing consistent job descriptions and titles. Currently, the variation and variety of job descriptions and titles in the cybersecurity leadership space are immense and inconsistent or not standardized. In addition, there is a misunderstanding of necessary or needed skill sets or the differences between cybersecurity leadership roles and functions. Subsequently, this leads to confusion about what the role should be doing or encompass from a skill set perspective. There is still a lot of debate over how to position CSO, CISO, BISO, TISO, ISO, VP, Director, and Manager within an organization. Likewise, there is some debate on whether the titles reflect modern paradigms. Recently, the Chief Cybersecurity Officer title and role has come into the mix for additional confusion.

The skills, competencies, and tasks are presented in a manner executive leaders can pull from to develop consistent job descriptions. The premise presented here will help reduce job descriptions and title variations while producing more targeted and appropriate roles and functions within cybersecurity leadership. As a result, companies across industry sectors can standardize their job descriptions, position titles, and position levels.

Cybersecurity leadership has a limited perspective when it comes to certifications. When moving into these roles, prior certifications built up over time are beneficial, but experience is more important. Likewise, soft skills and the ability to influence, coach, mentor, budget, forecast, communicate, and drive strategy are the skills desired over hands-on keyboard technical skills. CISO program certificates from major universities and other executive training have more weight here than certifications.

Getting certifications is a personal choice. It is generally up to the individual to decide whether they want to put the time, effort, and money into achieving them. Some hiring managers want to see them, while others do not. Additionally, please note that the mileage may vary depending on the quality of learning outcomes associated with certifications.