As Global Head of Research & Leadership Advisory at JRG Partners, I wrote this CISO job description template for employers who want the spec to do real work: attract the right candidates, repel the wrong ones, and align the hiring committee before the first interview. Use the template as the base and the customization guidance to make it yours.
Key Takeaways: Writing a CISO Job Description That Works
- The Chief Information Security Officer owns the company’s security strategy, posture, and response capability, protecting the enterprise, its customers, and its license to operate.
- Write the spec for the candidate you want to attract, not the file you need to complete; strong leaders read job descriptions as evidence of how the company thinks.
- Separate true requirements from preferences ruthlessly; inflated requirement lists shrink slates without improving them.
- Publishing the success metrics up front attracts operators and deters narrators, exactly the sorting you want.
- State reporting line, board access, and liability protections (indemnification, insurance) in the spec; in 2026 serious CISO candidates qualify on all three before compensation.
About the CISO Role
In market-standard structures, the role reports to the Chief Executive Officer, Chief Information Officer, or the Board’s risk committee and leads security operations, engineering, GRC, identity, and incident response. Scope varies by company, which is exactly why the customization guidance below matters, but the template reflects the specification most strong candidates will recognize.
CISO Job Description Template
Position Summary
[Company] is seeking a CISO. The Chief Information Security Officer owns the company’s security strategy, posture, and response capability, protecting the enterprise, its customers, and its license to operate. The position reports to the Chief Executive Officer, Chief Information Officer, or the Board’s risk committee.Key Responsibilities
- Set security strategy proportionate to threat model and regulation
- Own security architecture, controls, and their continuous assurance
- Lead detection, response, and recovery capability, tested, not assumed
- Run governance, risk, and compliance programs to audit standard
- Manage identity, access, and data-protection frameworks
- Own third-party and supply-chain security risk
- Report posture honestly to executive team and board
- Build security culture and organization-wide accountability
Requirements & Qualifications
- 10+ years security leadership; enterprise-scale program ownership
- Incident-leadership experience through real events
- Regulatory fluency for the industry’s specific regime
- Architecture and engineering credibility with technical teams
- Board-communication skill: risk translated to business terms
- Relevant certifications (CISSP or equivalent) typical
- Vendor and MSSP ecosystem management experience
Key Performance Indicators
- Control coverage and framework maturity scores
- Mean time to detect/respond
- Audit and assessment outcomes
- Vulnerability remediation SLAs
- Phishing/awareness metrics trends
- Third-party risk coverage
- Program delivery against roadmap
Compensation
Mid-market base salaries for this role typically run $275,000-$375,000, scaling substantially with company size and mandate; see our CISO Salary Guide 2026 for full benchmarks by revenue tier, ownership structure, and industry.
How to Customize This Template
A template earns nothing until it is tuned. State reporting line, board access, and liability protections (indemnification, insurance) in the spec; in 2026 serious CISO candidates qualify on all three before compensation. Then prune the requirements to the honest minimum, rank the responsibilities so the first three carry the mandate’s weight, and confirm the KPI list matches how the executive will actually be reviewed, because candidates will hold you to it.
Common Mistakes in CISO Job Descriptions
The recurring specification failures are predictable. Requirement inflation: fifteen must-haves that describe a unicorn and guarantee a thin slate. Responsibility laundry lists with no hierarchy, leaving candidates unable to tell what actually matters. Missing success metrics, which signals the company has not decided what it is hiring for. Internal jargon that reads as noise to outsiders. And compensation silence in markets where transparency is now expected or required. Each mistake is cheap to fix in the document and expensive to discover in the search.
From Job Description to Hire
With the specification locked, the search itself begins: calibrate compensation before finalists are in play, and structure the interviews to verify what the spec demands. For the interview stage, our CISO interview questions guide pairs directly with this template.
Frequently Asked Questions
- Q: What does a CISO do?
- A: The Chief Information Security Officer owns the company’s security strategy, posture, and response capability, protecting the enterprise, its customers, and its license to operate. Day to day, the role centers on set security strategy proportionate to threat model and regulation and own security architecture, controls, and their continuous assurance.
- Q: Who does the CISO report to?
- A: Most commonly the Chief Executive Officer, Chief Information Officer, or the Board’s risk committee, with the role leading security operations, engineering, GRC, identity, and incident response. Reporting-line choices signal the seat’s real weight, and candidates read them that way.
- Q: How many years of experience should a CISO have?
- A: Market-standard specifications ask for 10+ years of relevant progressive leadership, but treat tenure as a proxy: the requirement that matters is demonstrated ownership of the outcomes in the KPI list at comparable scale.
- Q: Should the CISO be paid as a C-suite officer or a senior director?
- A: The market has answered: enterprises treating the CISO as a true officer, with peer compensation, board access, and liability protection, are winning the talent, while director-level framing increasingly buys a caretaker in a seat that cannot afford one.
- Q: How long should a CISO job description be?
- A: Keep the public posting to a focused page and hold the extended success profile internally; the two documents serve different readers and merging them serves neither.
- Q: What requirements should we include for a CISO?
- A: Apply one test to each line: would we reject a great candidate who lacks this? If not, move it to preferred, or delete it.
![](https://www.jrgpartners.com/wp-content/uploads/2025/12/tanya-gallardo.jpeg")
Tanya Gallardo
Managing Director, Executive Search & AI Talent Strategy
Tanya Gallardo is the Managing Director of Executive Search & AI Talent Strategy at JRG Partners, leading C-suite and Board engagements across key growth sectors including Technology, Financial Services, and Manufacturing.
With over 18 years of experience specializing in disruptive technology leadership, Tanya is recognized as a leading authority on talent architecture for future-focused executive roles, such as the Chief AI Officer (CAIO) and Chief Digital Officer (CDO). Her expertise lies in accurately assessing the cultural fit and technical depth required to ensure a high return on investment (ROI) for critical leadership appointments.
Prior to her role at JRG Partners, Tanya held senior roles directing global talent acquisition strategies at a major publicly-traded technology firm, advising on organizational design and succession planning for emerging executive functions. She is a recognized speaker and contributor to industry events, sharing data-driven insights on executive compensation, leadership development, and the measurable business impact of C-suite talent.
