Chief information security officer (CISO) - SMB / VSB

• Level of educationBac+5
• Recommended baccalaureatescience specialities
• EmployabilityHigh
• Starting salary€3,000
• Experienced salary€5,500
• MobilityGood
• ROME codeM1801
• FAP codeM1Z81

The job in a nutshell:

The IT security manager holds a key position dedicated to protecting a company’s information system. They choose the security strategies. As a source of advice and information, they guide their team of experts in implementing security policies. In an SME or very small business, the chief information security officer is not a dedicated position, and the duties and activities may be carried out by the CIO, the IT manager, an administrator, an operations engineer or an IT project manager.

Equivalent titles: Information Systems Security Officer (ISSO), Civil Service Information Systems Security Officer (FSSI), Head of Digital Trust

Duties

Working with senior management and all the parties involved, the CISO defines the IT security strategy, just like their counterpart in large groups.

Identify

• Define the cybersecurity objectives of their scope
• Identify the risks of incidents affecting business activities
• Define a security policy broken down into an annual or multi-year plan
• Determine the budget needed for the security plan
• Run the cybersecurity organisation of the scope
• Keep a watch on regulatory and technical developments

Protect

• Steer the security action plan
• Define and implement the plan for applying security measures
• Provide technical and methodological support to their scope
• Communicate the information security charters
• Carry out regular audits to assess the actual level of security
• Check that the defined security rules are applied

Act

• Respond to calls for tender from clients concerned about their cybersecurity
• Set up a Security Operation Center
• Define the SOC measures for monitoring security incidents and responding to attacks
• Take part in crisis management with the CSIRT
• Ensure an operational crisis management system is in place

Rebuild

• Draw up business continuity and recovery plans
• Report on the actual level of risk
• Design and propose a cyber resilience strategy
• Advise management and staff on cybersecurity

Our advice: a command of English is a must. 90% of cybersecurity documentation and standards are in English. It is hard to plan a standards-compliant strategy without understanding them.

A typical day as a CISO in a small or medium-sized business

1. MorningThey check the alerts raised by the security tools or the monitoring provider, then handle staff requests about access rights, passwords or a suspicious email.
2. Late morningThey move the security action plan forward: updating the IT charter, checking that the rules are applied or following up a patch with the IT team.
3. AfternoonThey answer the security section of a client tender, prepare an audit or work with management on the business continuity and recovery plan.
4. End of the dayThey review risks and budget with senior management, then spend time keeping up with regulatory and technical changes.

If an incident occurs, they activate the crisis management process, work with the CSIRT to contain the attack and keep management informed until operations return to normal.

Responsibilities of the chief information security officer

The chief information security officer defines the IT security policy with the support of their team of experts. They must develop strategies with an optimised budget. They report to management, to whom they must clearly explain the risks assessed and the decisions taken.

Skills

Know-how

The core of the IT security manager’s job is a perfect understanding of cybersecurity issues. To achieve this, they must:

• know the company’s strategy and business issues;
• know the architecture of an information system and the interfaces used;
• master cybersecurity standards and developments;
• use data and risk analyses;
• develop tools to manage incidents;
• create strategies based on a sound understanding of the risks assessed.

Soft skills

In small and medium-sized organisations, the CISO role is often shared between several experts. So, in addition to a strong ability to work with others, the following behavioural skills are needed:

• ability to manage a team;
• good handling of stress and pressure;
• quick grasp of the issues of the different business lines and of cross-functional work;
• agility and adaptability in the face of uncertainty;
• teaching skills and good interpersonal skills;
• ability to advise and reassure;
• ability to comply with standards.

Salary

The salary of a CISO in a small or medium-sized company ranges from €39,000 gross per year for a beginner to €66,000 gross per year for an experienced professional. As the role is often shared between several cybersecurity players, this salary applies to CISOs who work alone.

Which sector to work in?

Small and medium-sized companies are increasingly aware of the importance of cybersecurity and are looking to hire a CISO who can centralise requests. This CISO can be hired directly by the company or be outsourced.

CISO in an SMB or CISO in a large group: what’s the difference?

The missions are similar, but the organisation and resources are very different: