Interview CISO candidates with scenarios, not trivia: ask how they would rank risks with limited budget, explain a hard tradeoff to a board, run the first day of a serious incident, and build a team. Score answers against criteria you wrote beforehand, and check each claim with references.
What is the job you are hiring for?
Decide first. A CISO at a twenty-person software company writes policy, answers questionnaires and sits in the pipeline. At a large enterprise, the role is mostly governance, funding and communication. NIST's Cybersecurity Framework 2.0 added a Govern function covering risk strategy, roles and oversight, which is a helpful lens: ask which functions the candidate must own and which they will delegate.
Write a one-page scorecard listing four or five outcomes for the first year, such as an agreed risk register, a tested incident plan and board reporting. Interview against it.
What should you ask?
Prefer scenarios that have no single right answer.
Prioritization. "You have budget for one of these three projects: phishing-resistant sign-in, a software inventory, or a 24-hour monitoring contract. Choose and defend." You are listening for reasoning about likelihood, impact and dependencies, and whether they ask about your environment before answering.
Incident judgment. "At 6 a.m. you learn an administrator account has been used from an unfamiliar country. Walk me through the first two hours." Look for containment first, evidence preservation, a clear decision owner and a plan for who gets told. NIST SP 800-61 Revision 3 frames response as part of risk management: preparation, detection, response, recovery and learning. A strong candidate talks about all of those, not just the technical steps.
Board communication. "Explain to a non-technical board why we should delay a product launch for a security fix." Good answers use plain words and business impact, state the options and a recommendation, and admit uncertainty.
Team and culture. "Tell me about a time you disagreed with engineering leadership and how it ended." Listen for how they handled the relationship, not who won.
Failure. "Describe a security decision you got wrong." Candidates who cannot name one are hiding something or have not been tested.
What are warning signs?
Answers made entirely of tool names. No questions back about the business. Claims of preventing every attack. Blaming a previous team for every problem. Inability to describe a past incident in specific terms such as timeline, decision and outcome.
How should you check references?
Ask references about specifics: what the candidate changed, how they handled a bad week, how they worked with the board and with engineering. Ask for a time they saw the candidate deliver bad news. Compare what you hear with the candidate's story. Verify claimed credentials directly with the issuer.
How do you reduce bias?
Use the same scenarios and the same scorecard for each candidate, with two or more interviewers scoring independently before any discussion. Include a business executive and a senior engineer on the panel, since the CISO works with both.
A constructed example: a company runs three finalist interviews with the same incident scenario. One candidate starts by asking what the business can tolerate being offline. Another lists forensic tools. The third gives a crisp communication plan but never mentions containment. The scorecard shows the first candidate strongest on judgment, so the panel ranks by criteria, not by charm.
What should the final stage look like?
Offer finalists a half-day with the people they would work with: engineering leads, legal, finance and a board member if possible. Ask each to rate the candidate on listening and clarity, and ask the candidate what they would need to succeed. The reverse questions reveal their priorities.
How to check or apply this
- Write the first-year outcomes and the scorecard before the first interview.
- Prepare four scenarios and score them on the same one-to-four scale.
- Include a board-style presentation exercise of ten minutes.
- Interview with a panel from security, engineering and the business.
- Call references with specific questions and verify credentials.
- Score independently, then compare.
Quick check
Should a CISO be deeply technical?
They need enough depth to judge technical advice and to be credible with engineers. Beyond that, the role leans on risk judgment and communication.
Sources
- NIST Cybersecurity Framework 2.0
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
- NIST NICE Framework Resource Center
Last reviewed: 18 October 2026.
