CISO job description: an annotated template that works

A CISO job description is rarely read as an ordinary job ad. Experienced candidates look for the answer to one question: will this role have the means to actually change anything? This guide gives you an annotated template, block by block, so your CISO job description describes a real mandate and makes the right people want to reply.

What a CISO looks for in a job description

A sitting CISO gets approached regularly and knows how to read between the lines. Before the responsibilities, they look for a few specific signals.

• The mandate: is the job to build security from scratch, to structure what exists, or to run an organisation that is already well equipped?
• The reporting line: who do they report to, and do they have direct access to the CEO?
• The resources: budget, team, vendors, the ability to hire.
• Why the role is open: a new position, a predecessor leaving, a regulatory requirement, a recent incident.
• Accountability: which decisions are theirs, and how the company protects them when they raise the alarm.

If you have not settled these points internally yet, start with our guide to hiring a CISO, which covers the possible profiles and reporting options. The job description simply translates that scoping work. And if you are still unsure how much CISO time you need, our comparison of fractional versus full-time CISOs will help you decide before you write.

Choose the type of mandate before you write

The most common mistake is the ad that asks for everything at once: strategy, compliance, architecture, running the SOC, awareness, crisis management and answering customer questionnaires. An experienced CISO reads that as either a misunderstood role or an impossible workload. Identify the main mandate and own it.

The annotated template

Here is a structure to adapt. Each block comes with a comment on what it should contain and which traps to avoid.

1. The title

• Example: "CISO, new position, reporting to the CEO, Lyon, hybrid".
• Comment: the title can carry two pieces of information that matter most to a CISO: whether the role is new, and the reporting line. Avoid "Cybersecurity Manager" when you really mean a CISO, and vice versa: candidates are not aiming at the same level of responsibility.

2. The context

• Your business in two sentences, your size in qualitative terms and your structure (single site, several countries, subsidiaries).
• Current security maturity: no dedicated function, a security lead inside IT, an established team.
• Why the role is open.
• The regulatory framework that applies to you, in one sentence (NIS2, DORA, sector or contractual requirements).
• Comment: be candid about maturity. A builder is drawn to a modest starting point, a leader to a structured organisation. A hidden backlog surfaces within weeks, and an early departure costs far more than an honest ad.

3. Reporting line and governance

• Who the CISO reports to: CEO, CIO, chief risk officer.
• Their access to the executive committee and, where relevant, the audit committee.
• The committees they chair or sit on.
• Comment: this is often the first block an experienced candidate reads. Reporting to the CIO is common; if that is your choice, explain how the CISO can escalate a risk created by IT itself.

4. Responsibilities

For a structuring mandate, for example:

• Build the risk map and keep it current with business teams.
• Design a multi-year security roadmap, prioritised and budgeted, and get it approved.
• Define the security policy and make sure it is actually applied, not just written.
• Drive compliance with applicable requirements and prepare audits.
• Organise incident management and crisis readiness with leadership and IT.
• Lead the security team and vendors, and grow internal skills.

Comment: five to seven responsibilities, ranked by real weight. Replace "contribute to" with the actual level of ownership: does the CISO lead, decide, propose or advise? If the role includes significant hands-on work, say so.

5. Resources

• Budget, described qualitatively if you prefer not to give a figure: to be built, existing, growing.
• The current team and planned hires.
• Vendors in place: outsourced SOC, auditors, integrators.
• Comment: a CISO role with no resources described is read as a role with no resources. If hires are planned, name the roles: a future GRC analyst or a SOC to be set up tells candidates where the function is heading.

6. The profile

Keep two short, separate lists.

Must have (for a structuring mandate):

• Build a roadmap from an assessment and explain what you choose not to do.
• Present a risk to the executive committee without jargon, with a clear decision to make.
• Have led, or been closely involved in, the handling of a significant incident.
• Enough technical depth to challenge IT, architects and vendors.

Nice to have:

• Experience of a certification project or a regulatory framework similar to yours.
• Managing a security team.
• Knowledge of your sector.
• A recognised governance or security certification.

Comment: phrase skills as observable actions. A certification belongs in the "nice to have" column; our look at certifications in hiring explains why it is not enough to judge a CISO.

7. Conditions

• Salary range and any variable component.
• Status, remote work, travel between sites.
• Availability expected during a crisis, and how it is organised.
• Delegations of authority, liability cover, training.
• Comment: CISO pay varies widely with company size, sector, regulation and the breadth of the mandate. A realistic range avoids losing a finalist at the last minute.

Phrases that drive candidates away

• "Guardian of the company's security": without authority or resources, this reads as a future scapegoat for every incident.
• A list of frameworks: naming ISO 27001, NIS2, DORA, GDPR and EBIOS Risk Manager in one sentence does not describe the role. Say which ones actually apply and what needs doing.
• "Reports to the CIO" with nothing else: the candidate will immediately wonder whether they can flag a risk IT would rather not see.

Describe the assessment process

A CISO is assessed on their ability to prioritise, persuade and decide under pressure. Setting out the process in the ad shows that you have taken the hire seriously. A typical process:

1. A first conversation about background, the type of mandate sought and the candidate's expectations.
2. An interview with the future manager about the mandate, resources and governance.
3. A case study sent a few days ahead: a company context, an extract of a risk map, budget constraints, and a request to present three priorities for the first six months.
4. A presentation to a varied panel (leadership, IT, a business executive, an independent security reviewer), with a simulated incident during the session.

State how long each stage takes and that the case study uses fictional or anonymised data. To build a shared scoring grid, use our method for assessing cybersecurity skills. From the candidate side, our article on becoming a CISO shows what people moving into the role expect from this process.

Checklist before publishing

• The type of mandate is clear and carries through to the responsibilities.
• The reporting line and access to leadership are written down.
• Maturity and the reason for the opening are described honestly.
• Resources are presented, even qualitatively.
• The must-haves fit in four or five actions.
• Pay, crisis availability and the process are announced.

In short

A good CISO job description describes a mandate before it describes a person. It commits to a type of role, states the reporting line, sets out the resources, separates must-haves from nice-to-haves and announces a serious assessment. The same logic applies to the roles that will surround them, as our SOC analyst job description shows.

Opening a CISO role and want an outside view on the mandate? At Cyber Recrut, a recruiter and a security practitioner build the job description with you, then assess candidates through concrete scenarios; for the more technical roles in the team, our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your hiring need.