How do you write a CISO job description that attracts the right person?

A good CISO job description defines the outcomes the person must deliver, the executive they report to, the authority they have, and the regulatory duties they carry. Start from a framework such as NIST CSF 2.0 and your legal obligations, then describe results, not a list of tools.

Why do most CISO postings read the same?

Most postings are a pile of certifications and tool names. That attracts people who match keywords and tells serious candidates nothing about whether the role can succeed. A candidate with real options wants to know three things: who they report to, what budget and authority they get, and what happens when they say no to a launch.

If you cannot answer those, fix the organization before you write the posting.

What can you borrow from NIST CSF 2.0?

NIST's Cybersecurity Framework 2.0, published in February 2024, offers a taxonomy of high level cybersecurity outcomes any organization can use regardless of size, sector or maturity. It added a Govern function for leadership accountability, oversight and risk management. CISA's Cross-Sector Performance Goals 2.0 were updated to match, adding goals on cybersecurity oversight and incident communication.

That gives you language for a job description. Instead of "manage the security program", write "establish and communicate cybersecurity risk strategy and report on it to the executive team and board".

Which legal duties belong in the posting?

Some regulations name the role. The FTC Safeguards Rule requires covered financial institutions to designate a "Qualified Individual" to oversee and enforce the information security program, who may be employed by the company, an affiliate or a service provider. If a service provider fills the role, the company keeps responsibility and must designate a senior member of its own staff to oversee that person.

HIPAA's Security Rule requires a covered entity or business associate to identify the security official responsible for developing and implementing its security policies. If your organization is in either group, say so in the posting and name the duty.

What does the structure of a strong posting look like?

Keep it short and concrete. A constructed example for a 300 person software company:

Reports to the CEO, with a standing agenda item at the board risk committee. Owns the security program, the budget line for it and the right to pause a release for a critical unresolved risk. In the first 90 days, produce a written risk assessment and a prioritized plan. In the first year, run a tabletop exercise with executives, reduce time to remediate known exploited vulnerabilities, and report progress against a named framework.

Notice what is missing: no brand names of products, no "10 years of experience with every control family".

How do you avoid a role that is set up to fail?

Look at the mismatch between responsibility and power. If the posting says the person is accountable for breaches but they report three levels down from the CEO, has no budget line and cannot delay a release, you have written a scapegoat role. Good candidates read that between the lines.

The NIST Govern function exists because cybersecurity risk is an enterprise risk decision, not only a technical one. Say in the posting who accepts residual risk and how that decision is recorded. If the answer is "the CISO alone", say that too, and make sure leadership agrees.

Finally, be honest about the starting point. A first CISO at a company with no program needs a builder. A company with a mature team needs a leader and communicator. Mixing the two in one posting attracts neither.

How to check or apply this

1. Decide the reporting line first and write it as the second sentence.
2. List the three to five outcomes for year one, each measurable.
3. Add any named legal role (Qualified Individual, security official) and the regulation behind it.
4. State the authority: budget ownership, ability to stop a release, access to the board.
5. Separate must haves (leadership, risk communication, incident experience) from nice to haves (specific certifications).
6. Ask a current engineer and a current executive to read it and say what the role actually does.

Quick check

Sources

1. NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29
2. CISA, Cross-Sector Cybersecurity Performance Goals
3. eCFR, 16 CFR 314.4 Elements (FTC Safeguards Rule)
4. eCFR, 45 CFR 164.308 Administrative safeguards

Last reviewed: 18 October 2026.