Skip to content
sec/atlas
all careers

careers

CISO

Own the security strategy, the budget and the answer to the question: are we safe?

The chief information security officer leads the security function and answers to the executive team and the board. The job is less about tools and more about decisions: where to put limited people and money, which risks the business accepts, and how to lead the company through a crisis. It requires technical credibility and business fluency.

see this path on the journey map

A day in the job

  • Set the strategy and roadmap from the business goals and the main risks.
  • Decide and defend the budget, and report the program's results to executives and the board.
  • Make risk acceptance explicit and owned by the right executive.
  • Lead the organization during a serious incident, including communication.
0 of 8 studiedNext topic: Security risk management

  1. Stage 1· Foundations

    Build the foundations of risk, frameworks and incident handling.

    Study here

    Learn elsewhere

    • Hands-on technical depth in at least one security domain
    • Basic finance: budgets, cost of risk, return on spend

    Build this

    Write a one-page security vision for a fictional company: its crown jewels, top risks and three priorities.

  2. Stage 2· Practitioner

    Design the program and learn to measure and explain it.

    Study here

    Learn elsewhere

    • Executive communication and storytelling with data
    • The legal and regulatory landscape for your business

    Build this

    Define ten metrics that tie to decisions and draft the first board dashboard.

  3. Stage 3· Advanced

    Lead: strategy, budget, crisis and culture.

    Study here

    Learn elsewhere

    • People leadership: hiring, retention, managing managers
    • Negotiation and influence across the executive team

    Build this

    Draft a two-year roadmap with a budget and a list of the risks accepted for now, and run a crisis tabletop with executives.

What to show

  • A strategy and roadmap document with priorities, trade-offs and measures of success.
  • A crisis communication plan with templates and a tabletop exercise report.

Certifications (examples)

  • CISM (ISACA)
  • CISSP (ISC2)
  • executive programs such as an MBA or a security leadership course

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles