Developing a professional brand takes time and experience that can go hand in hand with executing your job well, but in order to truly build your presence as a successful security leader, there are extra steps you can take to excel along the way.
CISO Resources and Best Practices
From checklists and blogs to white papers and research reports, here is a curated list of CISO resources and tips to support your journey as you make your mark in the cybersecurity industry.
1. Create a Culture of Cybersecurity Across the Organization
In order to excel in security operations, every CISO needs to understand how to align people with technology and processes that meet the goals of the business. Of course, this could never be achieved with just one person — it takes a village of employees from all departments, executives, and stakeholders in order to practice healthy security habits.
Effective security leaders create cybersecurity awareness across the entire organization, not just within their own security team. They are able to educate and implement strategies that inspire stakeholders and C-suite executives, as well as influence average employees to appreciate and understand how security aligns with the organization’s needs.
There is often so much out of your control and cyberattacks are inevitable; however, you can make monumental strides by raising security awareness because human mistakes often lead to vulnerabilities. Employees can fall for phishing or link scams, bad password habits, and more. Especially in a world of remote work-life, it’s critical to have a plan for a distributed workforce. By building a culture of cybersecurity, you can foster better habits across the organization, and this can improve your credibility as a leader in the long run.
If your internal organization is on board and your strategies are working well, then external sources will likely look to your operation as a role model example.
Other Helpful CISO Resources
- Blog: Cybersecurity Checklist for Remote Workers
- Webcast: Cybersecurity Awareness: A Cross-Functional Roundtable
2. Develop a Strategy for the People Side of Your Operation
People are arguably the most monumental part of a security operation and the team you lead can directly impact your professional brand. As a security leader, it’s your job to hire and retain quality talent to get the work done effectively. You must create a documented hiring strategy that addresses the goals of your security operation. The SOC Hiring Handbook will help guide you to build an effective Security Operation Center (SOC) by:
- Addressing the challenges of building a security team
- Strategizing staffing based on models, budget, and organization goals
- Identifying talent gaps
- Recruiting and retaining qualified employees
Since the security industry tends to be understaffed in those who offer a highly qualified skillset, a common pain point for CISOs can be managing egos and personalities. Our CSO, James Carder, shares some hiring advice on this matter:
“As with anything in life, it’s about striking the right balance. Your team should have an even distribution between seasoned professionals and junior staff trying to learn as much as they can. A team comprised entirely of “rock stars” is like having a team of nothing but executives — none of the real work ever gets done. Ensure that you’re not blinded by a bright shiny object; thoroughly vet out applicants’ hunger and passion to grow even more.”
Lastly, celebrate the wins by recognizing employees during their successes, not just their failures. Cybersecurity can be a high-stress industry — especially when things go wrong and all eyes are on your team to fix the problem. It’s far too easy to focus on the mistakes, rather than the everyday accomplishments. Find ways to celebrate the positives in order to boost morale and relationships. Hiring and maintaining an effective and resourceful team will improve consistent operations and help build your network and brand as a leader.
Other Helpful CISO Resources
- Blog: 5 Ways to Alleviate Stress on Security Teams
- White Paper: The State of the Security Team
- White Paper: How to Build a SOC with Limited Resources
3. Build Business Acumen
Although many come from a very technical background, the modern CISO has evolved to require more executive and strategic responsibilities. An effective CISO must develop a strong understanding of the business and have great communication and interpersonal skills:
“The role of the CISO has evolved dramatically. Today, most of the CISOs have a multitude of backgrounds. For example, they understand finance, they understand budgets, they move within different business units pretty freely. You definitely have to know your business and all the things that affect it, both internally and externally.” – Dilip Singh, VP of Cyber Operations at Sedara
A 2019 report by PwC and Harvard Business Review Analytic Services revealed that a large majority of respondents believe that strong leadership (76%), collaboration (84%), and communication skills (82%) are very important for a successful CISO.
Each of these skills can also be a vital asset in order for CISOs to gain support and funding from internal and external stakeholders. Gain Board-Level Support for Your Security Program is a useful e-Book that supplies CISOs with tips to deliver a winning pitch to the board. This resource will help you learn how to:
- Better understand your audience and speak their language
- Align your program with the business needs
- Demonstrate return on investment (ROI)
- Establish yourself as an effective communicator
Learning how to successfully pitch to the board can help you gain the investments you need to scale your security operations and prove the value of your program. Depending on the situation, soft skills can be just as impactful as your technical knowledge leading to a results-oriented reputation and more credibility.
Other Helpful CISO Resources
- Blog: How CISOs Can Use a SIEM to Show Value of Their Program
- Blog: How to Sell Your Cybersecurity Strategy to the Board: An Interview with James Carder
- Book: CISO Leadership: Essential Principles for Success
4. Position Yourself as a Thought-Leader in the Space
If you want to be perceived with a level of authority in the industry, then engaging in thought leadership opportunities can greatly expand your reach outside of just your company. If you consistently invest your time and energy to present in conferences, host webinars, participate in executive panels, publish insightful content, and more, you will see positive results and increased engagement overtime. Media outlets will begin covering your stories, the quality of your network will grow, and people will start reaching out to you for subject matter expertise.
Keep in mind that the intent of your involvement and the quality of your participation matters. The public generally does not care to hear you restate any conventional wisdom or common industry knowledge. Rather, if you have a niche or a topic that you can truly own and add valuable input to, then what you have to say will make a much better impression. A part of building a professional brand requires understanding your skill set and experience in order to position your knowledge with unique or credible expertise. When speaking or writing on a subject, keep these tips in mind:
- Establish a personal point of view or unique position
- Stick to your knowledge, experience, and security philosophies
- Know the persona you are speaking to and your target audience
It’s well-known that your job as a CISO is extremely busy. Perhaps your work-life may not feel so balanced at times. If investing your energy in extra thought leadership opportunities seems like too much work, simply contribute to your portfolio once or twice a quarter. It’s ultimately up to you how much you want to invest or prioritize your time. The key is to be consistent with your approach, but also be patient because becoming a thought leader is not an overnight thing; however, it certainly can lead to some incredible growth and career opportunities.
CISO Resources
5. Find a Mentor
The average CISO tenure is known to be relatively short — Enterprise Strategy Group (ESG) and Information Systems Security Association (ISSA) released a research report that estimated the average tenure of a CISO is between 24 and 48 months. According to the report, survey respondents believed the high attrition is due to:
- CISOs leaving for higher compensation packages (38%)
- The corporate culture does not emphasize cybersecurity (36%)
- He or she is not an active participant with executive management or the board of directors (34%)
Needless to say, there are many CISO pain points which can lead to less job satisfaction and more turnover; however, there are also constructive ways to address some of these. Your career will ebb and flow with new challenges and obstacles that you will have to overcome, some of these you won’t have to face alone.
Even security pros can greatly benefit from mentors to lean on for advice, learn from, and to assist with professional growth. A mentor cannot be expected to ultimately reduce tenure, but having an advocate in your corner who inspires you can help in many ways, such as:
- Bouncing ideas off of
- Talk through questions or issues
- Learning success stories
- Sharing insightful mistakes
- Identifying strengths and weaknesses
- Giving industry specific insight
Having a mentor to guide you through job pain points or career advice can really help you to grow professionally and these relationships also forge great networking opportunities who will back your brand.
Other Useful CISO Resources:
- Blog: Security Pros Need a Mento: Here’s Why and How
- Book: CISO Desk Reference Guide: A Practical Guide for CISOs
Mastering Your Role as a CISO
The cybersecurity industry is constantly evolving and at a very fast pace, making it necessary to always challenge yourself as a leader and continuing your education. Mistakes are inevitable but taking opportunities to grow and working on an improving your leadership skills can help you build a professional brand that is credible, reliable, and trustworthy.
