The CISO Brief

In the fast-paced field of cybersecurity, new CISOs have a brief period to establish credibility, develop their strategy, and show business value. You are expected to be proficient in managing operations, architecture, vendors, compliance, risk, and staying updated with the latest technology.

To assist in your success, we've created a field guide based on 50 years of combined cyber experience and insights from more than 20 CISO executive transition labs across various industries.

Your success in the first 180 days hinges on effectively managing three key resources: time, talent, and relationships. In this issue, we're diving into talent.

1. Gather data about your current workforce. This enables you to thoughtfully and effectively identify and remediate gaps in capabilities, skills, and behaviors.
2. Define your vision. The vision is your organization's big-picture goal for cybersecurity. It shapes how your team is structured and what skills and behaviors are needed.
3. Create a talent proposition. Consider what you can offer your talent to make your organization stand out among other companies offering the same job.
4. Consider non-traditional talent models. Methods like Agile project management, crowdsourcing, and contingent workers can supplement limited cyber resources.
5. Showcase why your work matters. Today's top talent wants to engage in meaningful work—and organizations where the cybersecurity function is so critical.

While some CISOs may be fortunate enough to step into a well-functioning cyber organization with minimal changes required, it's more common for a CISO to inherit an organization that needs some form of improvement and restructuring to keep pace with the company's evolving needs.

It's the CISO's job to foster the right skills and clarify responsibilities for their team. Technical skills are important, but risk functions require team members with certain intangible capabilities, such as the ability to collaborate, communicate, and work effectively in a team environment.

It is crucial to hire the right staff and realign teams. Prepare yourself for the challenges ahead, such as cyber talent scarcity, rising compensation expectations, and the need for technical and leadership training. By equipping yourself with objective and factual knowledge, partnering with HR representatives, and tapping into your network to identify qualified talent, you can position yourself as a highly effective CISO.

Fostering high-quality talent at every stage

With so many open jobs to choose from, many cybersecurity professionals are seeking a company that will actively invest in their growth and career.

A solid way to differentiate your business is to think about the full life cycle of an employee's career—not just the hiring process. CISOs can make active changes in each of the six life cycle stages.

1. Grow
   Find innovative ways to expand the pool of cyber talent. Today, there is a focus on educating youth on the importance of a science, technology, engineering, and math (STEM) education and STEM-related career paths. While this focus is important, organizations also need to look outside of STEM programs for future talent. Different skills and backgrounds are needed across the personas of the cyber talent framework.
2. Recruit
   Build your organization's visibility and attractiveness. Build on your brand with a strong value proposition to broaden your talent pool by engaging nontraditional talent such as neurodiverse, mothers and veterans. Attract candidates by creating job postings that outline the required skills and training trade-offs. For example, "if you have these foundational capabilities, we will teach you these advanced skills."
3. Onboard
   Jump-start the process of becoming part of the organization. It's crucial to provide immediate engagement and development for new hires. Connect them with groups outside of cybersecurity to help them build relationships and an understanding of the business. Offer mentorship programs or training that sets a clear path for a future at your organization.
4. Develop
   Invest in employees to make cyber a career, not just a job. Help them build and refine their skills by providing opportunities to stay current. Encourage them to enroll in classes and conferences and to pursue certifications. Partner cyber talent with peers from adjacent roles in the talent framework to extend their skill sets and broaden learning.
5. Retain
   Make retention a priority. Organizations that invest in people who are aligned to their talent value proposition are typically better equipped to attract and retain the type of talent needed to remain competitive. However, it is important to recognize that it is impossible to retain everyone, so you need to be strategic. Identify high-performance talent based on their future potential, leadership skills, hard-to-replace capabilities, and value as role models—and then go the extra mile to keep them.
6. Offboard
   Maintain hard-won relationships. In a high-demand market, it is inevitable that some team members will choose to leave. However, it may not be forever; they may be future rehires down the road. You want former employees to speak favorably about your organization when they participate in knowledge-sharing communities. Help people find the right external opportunities if your organization is unable to meet their needs and learn valuable lessons for improvement whenever someone does.

Download our guide now