3 ms·

What’s the difference between CISO and Director of Security?

by cpach 4y ago

tptacek 4y ago
* A CISO designs and staffs the whole security practice. * A CISO is management-team and, especially, customer-facing. * A CISO's reports tend to be managers, not IC's. * A CISO often reports to the CEO, the CFO (if they own risk), and, sometimes, to the board. * A CISO will tend to own multiple security sub-practices: product security, IT security, abuse, sometimes risk. * A Dir/Sec tends to report to engineering management. * A Dir/Sec is occasionally customer-facing, but it's not most of the job. * A Dir/Sec will tend not to own things like abuse and risk. * A Dir/Sec will usually, when first hired, do IC-level work on prodsec and IT security. * A Dir/Sec's reports are usually ICs. A pretty normal progression might be: 1. Hire a Sr Sec Eng 2. Hire another Sr Sec Eng 3. Hire a Dir/Sec 4. Hire a bunch of Sec Eng (build out an ops team, a product security team, and a team for IT stuff) 5. Promote the Dir/Sec to VP/Sec and hire managers for the teams. 6. Get real big. 7. Promote or hire a CISO (the CISO hire is often an opportunity to bring a marquee resume into the company to impress the market). I think the thing to remember about startups is that even startups with traction rarely have the headcount slots to get past (2) or (3) on that list until they have lots of engineers; I don't have numbers to back this up but my guess is that the median startup with a 3+ person security team has over 100 employees. So, if you're talking about your first security hire, as a young startup, it's hard to make a CISO make sense. You might call your first security hire "the CISO", but I'd say willingness to be called a "CISO" at a startup when you have low-single-digit reports is probably a mild red flag for that person. It may be an idiosyncrasy of mine to call the title "Dir/Sec"; "Dir/Sec" is the fluffiest title I think an experienced security person would be comfortable taking in a young startup. But you could also call that person a "Security Manager" or a "Security Lead"; some of this also depends on how flat your org is.
- archi42 4y ago
  Ah, that's a better choice then. If they have no idea about security, both opsec and product, they should get someone who can help them get better (or take the risk and take no systematic approach to security). You're right, full CISO role is a bit too much, but someone who takes care about security and might have some internal power to say "don't do that insecure stuff". Security Manager sounds good. (Ah, well, obviously I have no idea about startups ;))

What’s the difference between CISO and Director of Security?

by cpach 4y ago

What’s the difference between CISO and Director of Security?

* A CISO designs and staffs the whole security practice. * A CISO is management-team and, especially, customer-facing. * A CISO's reports tend to be managers, not IC's. * A CISO often reports to the CEO, the CFO (if they own risk), and, sometimes, to the board. * A CISO will tend to own multiple security sub-practices: product security, IT security, abuse, sometimes risk. * A Dir/Sec tends to report to engineering management. * A Dir/Sec is occasionally customer-facing, but it's not most of the job. * A Dir/Sec will tend not to own things like abuse and risk. * A Dir/Sec will usually, when first hired, do IC-level work on prodsec and IT security. * A Dir/Sec's reports are usually ICs. A pretty normal progression might be: 1. Hire a Sr Sec Eng 2. Hire another Sr Sec Eng 3. Hire a Dir/Sec 4. Hire a bunch of Sec Eng (build out an ops team, a product security team, and a team for IT stuff) 5. Promote the Dir/Sec to VP/Sec and hire managers for the teams. 6. Get real big. 7. Promote or hire a CISO (the CISO hire is often an opportunity to bring a marquee resume into the company to impress the market). I think the thing to remember about startups is that even startups with traction rarely have the headcount slots to get past (2) or (3) on that list until they have lots of engineers; I don't have numbers to back this up but my guess is that the median startup with a 3+ person security team has over 100 employees. So, if you're talking about your first security hire, as a young startup, it's hard to make a CISO make sense. You might call your first security hire "the CISO", but I'd say willingness to be called a "CISO" at a startup when you have low-single-digit reports is probably a mild red flag for that person. It may be an idiosyncrasy of mine to call the title "Dir/Sec"; "Dir/Sec" is the fluffiest title I think an experienced security person would be comfortable taking in a young startup. But you could also call that person a "Security Manager" or a "Security Lead"; some of this also depends on how flat your org is.

archi42 4y ago
Ah, that's a better choice then. If they have no idea about security, both opsec and product, they should get someone who can help them get better (or take the risk and take no systematic approach to security). You're right, full CISO role is a bit too much, but someone who takes care about security and might have some internal power to say "don't do that insecure stuff". Security Manager sounds good. (Ah, well, obviously I have no idea about startups ;))