A deputy CISO is the second in command of a security organisation. They run the program day to day, stand in for the chief information security officer, and own a defined slice such as operations, risk or governance. A company needs one when the CISO can no longer be both strategist and operator.
Is there a standard definition?
No. The title has no formal standard, and responsibilities vary by company. Treat any description, including this one, as a pattern, and check the actual job scope before you hire or accept a role.
What public frameworks do offer is a way to divide the work. NIST Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0 and covers the context, strategy, roles, responsibilities and oversight for the whole program. A natural split gives the CISO the Govern function and board relationship, and the deputy the operational functions.
What does the role usually cover?
Operations. Run detection and response, vulnerability management and access reviews. Make sure on call coverage exists and incidents are handled to a written plan. NIST SP 800-61 Rev. 3 is a public reference for what an incident response capability includes.
Delivery. Turn strategy into a roadmap with owners and dates, then track it.
People. Hire, coach and set priorities for team leads.
Risk and compliance. Keep the risk register current, coordinate audits and evidence, and chase remediation.
Continuity. Make decisions when the CISO is away, including declaring an incident.
How does it differ from a CISO?
The CISO usually owns external relationships: board, regulators, major customers, auditors. They set direction and budget and carry accountability for outcomes. The deputy owns execution and carries delegated authority. In a crisis the two split: one handles the technical response, the other handles executives, legal and communications.
When does a company need a deputy?
Signs include a CISO who is the single approver of everything, incident response that stalls when they travel, a team of more than a dozen with no layer between, or audit work crowding out strategy. The opposite sign matters too: in a small team a deputy adds a layer without adding capacity. A senior engineer or a security manager may serve better.
What are the risks of the role?
Two failure modes recur. The first is unclear authority: the deputy is accountable for results but cannot approve spending, make hires or accept risk, so every decision queues for the CISO and the role adds a hop. The second is a shadow CISO: the deputy gets the visible work and the CISO drifts away from operations, so the two give different answers to the same question. Both are fixed by the written delegation and the regular meeting described below, and both are easier to prevent than to repair after someone has resigned.
A constructed example
A company's CISO leads eleven people and also personally fields every customer security questionnaire and every audit request. A ransomware tabletop exercise shows nobody else can authorise isolating a production system. The company creates a deputy role with written delegated authority over operations and incident declaration. The CISO keeps the board, the customers and the budget. After two quarters questionnaires move to a standing process and audit evidence sits in one tracker.
How to check or apply this
- Write the CISO's responsibilities in a list, then mark which could be delegated tomorrow.
- Use the NIST CSF 2.0 functions to decide which the deputy owns.
- Put delegated authority in writing: who can declare an incident, accept risk up to what amount, approve emergency changes.
- Define how decisions are shared with the CISO and how often you meet.
- Set a clear succession rule for absences.
- Pick measures for the role, such as time to contain incidents and remediation aging, and review them quarterly.
- Rehearse the pair in a tabletop exercise.
Quick check
Is a deputy CISO the same as a head of security?
Not always. Where there is no CISO, a head of security may lead the program. A deputy by definition works under a CISO and shares their remit.
Should a deputy come from engineering or from governance?
Choose the complement of the CISO. If the CISO is strong on governance and communication, pick an operator. If the reverse, pick someone strong on risk and audit.
Sources
- NIST Cybersecurity Framework
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations
Last reviewed: 18 October 2026.
