I read a lot of CISO job descriptions from the hiring side of security-leadership searches, and most of them quietly repel the candidates the company most wants. The problem is rarely the list of duties; it is that the language reveals a seat built without authority, or a company that thinks of security as a technical function rather than an executive one. Strong CISO candidates read the job description as a diagnostic, and a badly constructed one filters them out before you ever get to talk. This guide gives you a template that works, and, just as important, the language to avoid.
What should a CISO job description include?
A strong CISO job description states the reporting line and board access up front, names the budget and headcount the role owns, defines the mandate (security strategy, enterprise risk, incident leadership, compliance) in terms of outcomes, describes the regulatory and business context, and reads unmistakably as a senior executive role with real authority. The specifics matter less than the signal: every line either tells a strong candidate the seat is real or tells them it is not.
The template
Adapt the sections below. Keep it tight; a strong candidate should be able to tell within a minute that this is an executive seat with authority.
Role and reporting. Chief Information Security Officer, reporting to [CEO / COO / General Counsel], with a standing line to the audit committee. State this first. It is the single most-read line for a serious candidate.
The mandate. Own the company’s security strategy and enterprise cyber and information risk. Lead incident response and crisis management. Meet regulatory and compliance obligations across [SOC 2 / PCI / HIPAA / SEC disclosure / GDPR / DORA, as applicable]. Represent security risk to the executive team and the board. Build and lead the security organization.
Scope and authority. Own a security budget of [range or “to be built”] and a team of [size or “to be hired”]. Full authority over security hiring, tooling, and program priorities. A seat on [relevant governance or architecture forums] so security is present in decisions, not consulted after them.
What we are looking for. Demonstrated executive scope: a track record owning a security budget and organization, board or audit-committee exposure, and experience leading at least one major incident end to end. Fluency in translating security into business and board language. Experience in [your industry / regulatory environment]. Certifications such as CISSP or CISM are welcome but not what we are selecting on.
What this seat offers. Genuine authority and board access, D&O coverage as a named officer, a board-approved indemnification agreement, and compensation matched to the accountability. Be specific where you can; strong candidates notice when a company volunteers the protections instead of making them ask.
About the challenge. One honest paragraph on the real problem to solve: the current state, the reason the seat exists, and what success looks like in the first year. Candor here attracts the operators who want a real problem and screens out the ones who want a title.
The language that repels strong candidates
What you leave out and how you phrase things matters as much as the template. Avoid:
- A reporting line buried under IT with no board access. This is the first thing a serious candidate checks, and burying it reads as an under-ranked seat.
- Accountability without authority. Any phrasing that makes the CISO responsible for breach outcomes while giving them no control over budget, hiring, or the engineering decisions that create risk. This is the scapegoat-seat signal, and it is covered in depth in the offer red flags guide that your best candidates have read.
- A tool laundry list. A job description that reads as a list of technologies signals that you are hiring a senior engineer, not an executive. Describe outcomes and mandate instead.
- “We need someone to own security” with a note of relief. It reads as handing off a problem rather than building a function.
- Silence on liability. Omitting D&O and indemnification does not hide the issue; it makes the candidate raise it, and how you respond becomes the test.
Why the job description is a hiring advantage, not a formality
Most companies treat the CISO job description as boilerplate and lose candidates they never realize they lost. A job description written to signal authority, independence, and honesty does the opposite: it makes strong, employed, skeptical candidates lean in, because it is the first evidence that this company understands what the role requires. The full playbook for the rest of the process, from where to find candidates to structuring the offer, is in the how to hire a CISO guide. And if you want to reach in-market security leaders directly, the CISO Network lets vetted hiring teams see private candidate profiles, anonymous until the candidate approves an introduction.