CISO job description: What does a CISO do?

A chief information security officer deals with far more than firewalls and antivirus software

The past couple of years have been being particularly challenging for IT professionals and organisations alike, it doesn’t mean that 2022 will be any easier. As workers slowly return to the office, they are likely to keep working remotely on a more flexible basis for some part of the week than before the pandemic. This provides some extra security challenges that IT teams need to consider.

Many organisations are looking at reviewing their cyber security strategy as well as their response and monitoring capabilities, especially as there have been some high-profile cyber attacks recently, such as the SolarWinds hack. Businesses are choosing to do this to avoid making the same mistakes and losing their customers’ loyalty and trust, which is always detrimental but particularly so during the midst of a financial crisis.

The state of the world has changed drastically since the pandemic began, and this is especially true for the status of security too. Cyber security experts have been very busy during the last year or so: from the Solarwinds to Zoom attacks, it is necessary for organisations to possess competent security and leadership skills more than ever before. In these uncertain times, it is extremely important for companies to have an individual who can be trusted with maintaining the safety and security of the enterprise and its data.

This responsibility could be assigned to a chief information security officer (CISO), whose function we will study in this article. From requirements to reimbursement, we analyse the details of this executive role so you can learn about whether this could be the perfect role for you.

What is a CISO?

In order for that responsibility to be taken seriously, a strategy and someone to lead that vision from theory into reality is required. Enter the chief information security officer (CISO). First borne as a role that was exclusively the preserve of US companies, the job title has now made its way to British shores, too.

The CISO, who may also be referred to as a chief security architecture or information security manager, is an executive role that oversees the protection of company and customer data, as well as the protection of infrastructure and assets from malicious actors.

In an age of rampant data theft and aggressive but important legislation, such as GDPR, every IT facility in an organisation must be secure. That not only requires the implementation of security safeguards but also the training and educating of employees. With the majority of cyber security incidents being the result of employee error, it's important that a CISO is looking both internally and externally for potential threats.

As the threat landscape continues to evolve, the work of a CISO must also keep pace.

What responsibilities does a CISO have?

CISOs have a wide range of responsibilities that extend far beyond dealing with firewalls and antivirus software. They are responsible for hiring IT personnel, for providing necessary policy direction to protect the company from emerging threats., and for directly managing senior IT team leaders to ensure they are prioritising the right aspects of a strategy at any given time.

A CISO must also spearhead the company's IT security hardware strategy and make sure necessary activities are undertaken by the appropriate department, whether this is IT staff or other IT security personnel.

A female IT worker in front of multiple monitors displaying code


Innovation also plays a key role in any organisation's security posture. As such, the CISO will also be tasked with keeping corporate security policies, standards and procedures fresh and fit for purpose, and making sure staff across the board comply on a day-to-day basis without fail.

Related Resource

Nine traits you need to succeed as a cyber security leader

What characteristics and certifications make a successful cyber security leader?

Whitepaper front coverFree download

CISOs are expected to work with the entire organisation to ensure everyone is pulling in the same direction. After all, ensuring security is a continuous process rather than something that can be auctioned once and then left alone. It needs to evolve and change as the threat landscape does. Success here, then, will include conversing regularly with senior management and employees to make sure all IT security policies are deployed, revised, sustained and overseen effectively.

Emulating what might happen in the real world is one way of ensuring everyone is on the same page when it comes to the threat of breaches and data theft. By essentially phishing employees to see who clicks on what - in your own, controlled environment - you can be more sure of any awareness gaps and training needs. Showing employees the damage that could have been done, but thankfully wasn't, will also ensure security remains front of mind in future.

As part of this, existing IT infrastructure must be audited and assessed for any security risks and CISOs are responsible for using the data they have at hand to predict any risks and deal with them accordingly. They need to be continuously assessing vulnerabilities and finding fixes before an incident occurs.

A CISO also needs to develop policies around security incidents and create an Emergency Response Team to act as and when a security breach is looming or has happened. As well as this, they may be in charge of developing a disaster recovery plan to allow for business continuity post-cyber-attack.

Like many businesses and IT decision-makers, CISOs are constrained by budgets, so resources need to be prioritised and allocated efficiently and financial forecasts prepared to ensure appropriate cover for security assets. A CISO needs to show that investments can be used to protect an organisation's assets and safeguard its data and reputation if the worst should happen.

What skills are needed to be a CISO?

To be a competent CISO, several key skills are required, beyond common sense. These include:

  • Communication and presentation skills
  • Policy development and administration skills
  • Knowledge about government (e.g. relevant legislation both current and incoming)
  • Collaboration expertise
  • Financial, planning and strategic management skills
  • Supervisory and incident management skills
  • And, finally, knowledge of regulation and standards compliance.

However, the most valuable skill for a CISO is the ability to articulate IT security and technical issues in a non-threatening, clear and actionable manner to non-technical leadership.

A CISO’s salary can be increased by 4% thanks to this quality, according to PayScale. This also means, however, being up to the challenge of leading by example, which can be challenging at times. One in four global IT security leaders have used the same password for personal and work use, according to a recent report. In the report, 39% of respondents say they haven’t changed their work email passwords in the last month. It also found that 48% of CISOs log into social network platforms through their work computers, and 63% were willing to accept connection requests from unknown LinkedIn users – a behaviour MI5 is actively warning people not to do.

How much does a CISO get paid?

In general, someone applying for a CISO role is expected to be highly experienced, with many roles asking for at least 10-plus years in security and senior risk management roles. However, this also means the role commands a significant salary.

A CISO in the UK can expect to receive an average salary of around £92,000 a year, with a number of organisations offering additional benefits and bonuses, with the most popular being medical (70%), dental (25%), and vision (17%). A CISO’s average annual bonus is around £11,500 in the UK.

Related Resource

Nine traits you need to succeed as a cyber security leader

What characteristics and certifications make a successful cyber security leader?

Whitepaper front coverFree download

The salary, however, mostly depends on the level of expertise. For example, a newly-appointed CISO will probably earn no more than £73,000 per year. After five to nine years of experience, this is likely to go over the 80k mark. After a decade in this position, a CISO can earn an average total compensation of £97,000, while those with 20 years experience can earn a total average of £110,000.

Of course, this is still dependent on the company and its location. While the average CISO pay in the UK is £90,000, some companies at the highest level can afford to offer salaries of up to £147,000. Regardless of whom you work for, the pay is nothing less than impressive.

Nevertheless, it’s still an industry heavily dominated by men, with less than one in five (18.5%) CISOs identifying as female.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download


CDO job description: What does a CDO do?
Business strategy

CDO job description: What does a CDO do?

22 Oct 2021
Five best practices for resilient, reliable, remote IT services

Five best practices for resilient, reliable, remote IT services

5 Oct 2021
Maslow's Hierarchy of Needs and the workplace
Business strategy

Maslow's Hierarchy of Needs and the workplace

24 Sep 2021
CTO job description: What does a CTO do?
Business strategy

CTO job description: What does a CTO do?

26 Aug 2021

Most Popular

What should you really be asking about your remote access software?

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021