How to become a CISO: the realistic career path

TL;DR: Nobody is promoted into a CISO seat for technical excellence alone. The path runs through running things — a team, a budget, an incident, a board meeting. The fastest route is a deputy CISO or head-of-security role at a company big enough to have real problems, plus deliberate work on the two skills engineering careers don't build: money and narrative.

What do CISOs actually get hired for?

Read enough CISO job specs and the pattern is clear: the deliverables are a program, a budget, a team, and a board relationship. Detection engineering and exploit fluency appear as context, not competencies. Hiring committees — usually a CEO or CIO, a board member, and an executive recruiter — are buying someone who can absorb accountability and communicate risk upward. That's why the strongest individual contributor in the SOC is often not the leading internal candidate, and why the person who ran the messy incident calmly is.

What are the common paths to the seat?

Security operations leadership. SOC manager → director of security operations → deputy CISO → CISO. The most traveled road. Strength: operating credibility. Gap: business finance and communication.

Security engineering / product security. Common in software companies, where the CISO's real constituency is the engineering org. Strength: credibility with builders. Gap: governance, audit, regulators.

GRC, audit, and consulting. Risk leaders and Big Four security consultants step into CISO roles in banks, insurers, and healthcare, where the job is heavily regulatory. Strength: fluent in the language boards and examiners speak. Gap: operational depth — must be covered by strong deputies.

Government and military. Intelligence and defense security leaders move into critical infrastructure and finance seats, bringing incident discipline and clearance-world credibility.

What separates the ones who make it?

Three capabilities, none of them taught by more certifications. Budget fluency: building, defending, and cutting a multi-million-dollar budget, and speaking in risk-per-dollar rather than tool names. Narrative: compressing a technical situation into three sentences a director will remember — the single most-cited skill in how CISOs describe their own break. Scar tissue: having run a real incident end to end, including the executive communication, the hard calls, and the postmortem. Candidates without it face a fair question: what happens the first time it's real?

How do first-time CISOs actually get the seat?

Three doors, in order of frequency. Inheritance: the incumbent leaves and the strongest deputy is elevated — the single most common route, which is why choosing a company whose CISO is senior and visible is a career strategy. The step-down: taking the top seat at a smaller or less mature company than the one where you were a deputy; scope trumps logo. The crisis hire: post-incident companies hire fast and are unusually open to first-timers with strong incident credentials — with the caveat that post-breach seats come with pressure, scrutiny, and sometimes liability. Whichever door, negotiate the role before accepting it: reporting line, board access, budget authority, and what happens on the worst day. The time to ask is before you say yes.