Every cybersecurity career path, from SOC analyst to pentester to GRC to cloud, reports up to the same seat. Somebody has to decide what a company spends on security, which risks it accepts, and how to explain all of it to people who don’t speak cyber. That’s the CISO, and a growing number of companies get one as a service: the virtual CISO, or vCISO.
This post covers what the role is, what the first 90 days with a client look like, and how people actually get there.
CISO, vCISO: what’s the difference?
A Chief Information Security Officer leads an organization’s security program. The job is less about tools than about decisions: setting priorities, owning the risk picture, building the team and the budget, and reporting to executives and the board.
A virtual CISO, or vCISO, does that same job on a part-time or retainer basis. Plenty of organizations need security leadership but don’t need, or can’t yet afford, a full-time executive: small and mid-sized businesses, defense contractors working toward CMMC, credit unions, startups. A vCISO gives them a named leader, a plan, and someone accountable, without the full-time headcount.
The first 90 days with a new client
The details change with every organization. The shape of the first three months usually doesn’t.
- Listen and inventory. What does the business do, what data does it hold, what does it owe regulators and customers, and what’s already in place?
- Assess against a framework. Pick one and use it consistently. The NIST Cybersecurity Framework 2.0 organizes the work into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- Build the risk register. Turn the findings into a ranked list of risks, each with an owner and a decision: fix it, transfer it, accept it or avoid it.
- Write the roadmap. Quick wins first, then the bigger investments, sequenced against the budget the business actually has.
- Report to leadership. The first report sets the tone for the whole engagement. It explains where the organization stands, what matters most, and what you need from them.
Talk about risk in business terms
Executives don’t need to know what lateral movement is. They need to know what could stop the business, how likely it is, what it would cost, and what it takes to prevent it. “Our backups haven’t been tested, so a ransomware incident could stop billing for two weeks” lands. A list of CVEs doesn’t.
Try it yourself: pick one technical risk you know well and explain it in two sentences to someone who has never worked in IT.
The road from analyst to CISO
There isn’t one road. Some CISOs come up through the SOC, some through engineering, some through GRC and audit, and some from military and government service, where leading people and managing risk under pressure is the job. What they tend to have in common is breadth, time spent leading people, and the ability to translate between the technical team and the boardroom.
The credentials on this path are ISC2’s CISSP and ISACA’s CISM. Both expect years of experience, so they tend to come mid-career rather than at the start. You can begin studying well before you qualify.
Tyrone E. Wilson enlisted in the Army in February 1996, has spent the 30 years since in IT and cybersecurity, and today leads Cover6 Solutions’ vCISO practice. He took one of those roads himself, from enlisted soldier to security leadership.
Questions worth thinking through
- What does a vCISO actually deliver in a month, and how is the work measured?
- How do you go from individual contributor to leading people?
- What do CISOs look for when they hire into their own teams?
Where this path leads
The vCISO Pathway is one of the six career paths on Chrysalus, covering vCISO, security director and CISO roles.
- Not sure where you’re starting from? Take the free career path assessment.
- Prep for the certs: CISSP Practice Exam and CISM Practice Exam.
- Browse every Cover6 course.
See it live with Cover6 Community
We cover this live in the Cover6 Community session vCISO Pathway: From Analyst to CISO on Wednesday, November 11 at 6:00 PM ET, streaming to the DMV, Atlanta and South Florida chapters at once. It’s Veterans Day, a fitting night for a session led by an Army veteran. To everyone who served: thank you. Planning to attend? Use this post as your read-ahead. RSVP on Meetup or watch on YouTube. The replay gets added here afterward.