CISO (Chief Information Security Officer)

In France, the role is known as RSSI, short for responsable de la sécurité des systèmes d’information, the person responsible for information systems security. Also called the CISO (Chief Information Security Officer), they lead cybersecurity within a defined scope. They develop or adapt the security policy, organise its implementation and inform management about risks affecting the company’s systems, services and information.

Their work connects business concerns with security decisions. They identify risks, propose priorities and negotiate the resources needed to address them. Management approves the proposed direction and decides on the risks presented: which to address and which residual risks to accept. The CISO then monitors the actions and reports difficulties that require a further decision. This division of responsibilities must be explicit when defining the role.

The scope may cover an organisation or some of its activities within a given geographical area. Depending on the company’s size, the CISO takes part directly in implementation or manages a team. Their responsibilities may also include overseeing activities entrusted to service providers. The job title alone therefore does not indicate how much operational work the role involves.

CISO, IT management and cybersecurity specialists: who does what?

• The CISO owns the security policy within their scope, prepares options for management to decide between competing priorities and checks that the policy is applied.
• With IT management and, depending on the organisation, the CTO, clarify each party’s responsibilities in projects and in implementing security decisions.
• Cybersecurity specialists carry out specialist activities, such as penetration testing or incident response. The CISO aligns their work with security priorities.

To define the reporting line, identify the management team that approves the direction, the business contacts and the route for escalating alerts. Access to decision-makers must allow the CISO to present a risk, its consequences and the resources requested.

A CISO helps the company turn technical risks into decisions that people can understand. An inventory of vulnerabilities is not enough to decide which actions to fund. These findings need to be linked to the activities affected, appropriate responses selected and their implementation monitored. Recruitment quality therefore also depends on the candidate’s ability to explain their priorities.

A poorly defined role can leave decisions without a clearly identified owner. If the CISO recommends an action, who authorises the necessary resources? Who carries it out and who checks its implementation? Clarifying these points avoids confusing responsibility for leading security with carrying out all the technical work. Recruitment planning must identify the contacts the CISO will need to move actions forward.

Preparing to handle incidents is another important issue. The CISO contributes to crisis management arrangements, IT continuity and recovery. The relevant specialists take part in these arrangements. Assess the ability to prepare a collective response as well as knowledge of protective measures.

Finally, security concerns users, technicians and decision-makers. A candidate who can adapt their explanations can help different audiences understand a rule and its purpose. Conversely, an exclusively technical explanation leaves a business leader without the information needed to decide. A general explanation, without an understanding of systems and threats, is also insufficient to justify the proposed choices.

• Define or adapt the security policy within the role’s scope and obtain management approval for its direction.
• Identify major risks and develop a risk treatment plan linked to business concerns.
• Negotiate the resources needed for the cybersecurity strategy.
• Organise audits and check that security rules are applied, including by third parties and subcontractors.
• Contribute to incident management and prepare IT continuity and recovery with the relevant participants.
• Coordinate the teams and service providers involved in implementing the security policy.
• Tailor awareness activities to users, technical teams and decision-makers.
• Track risks, actions and incidents through dashboards that are useful to management.

Pathways to a CISO role can combine IT education, practical security experience and coordination responsibilities. French master’s degrees specialising in security and French engineering degrees (diplômes d’ingénieur) are possible routes. Apec also cites shorter IT courses, particularly in computing and networks. These pathways do not amount to a single degree requirement for every role.

To assess what candidates have learnt, connect their education with the responsibilities they have actually held. Experience in networks or architecture can provide an understanding of systems. A background in IT security can develop the ability to analyse threats and protective measures. Leading projects or holding responsibility for IT can prepare someone to coordinate contributors and organise actions. None of these backgrounds, on its own, demonstrates mastery of the entire role.

Knowledge of security standards, frameworks and certifications is useful. Education criteria should remain linked to the responsibilities of the role, without turning a particular certification into a universal entry requirement.

GetPro’s assessment framework

GetPro structures assessment around a set of approximately ten criteria at most. It distinguishes verifiable aspects of a candidate’s background from skills to explore further at interview and assigns an assessment method to each criterion. This framework guides discussions on the points that still need clarification.

The interview explores three or four key criteria through open questions and concrete examples. Reference checks complement the examination of strengths and areas requiring attention. These discussions explore skills in the context of the working relationship and include requests for examples. A summary brings together the information needed to make the decision.

Guidance on adapting assessment to the CISO role

The following five steps suggest criteria, questions and a case exercise suited to the role. They are guidance for employers, rather than a documented CISO-specific protocol used by GetPro.

1. Define criteria linked to the role

Distinguish between security policy, risk analysis, operational coordination and the line management expected. For each responsibility, specify what the candidate will need to do directly and what they will need to have others do.

Link each criterion to expected evidence: an explanation of a choice, an anonymised deliverable or a description of an action they monitored. Use the same criteria to compare candidates and record the points that need further exploration.

Divide the assessment tasks among the relevant participants. Management examines decisions on competing priorities and communication. Someone with cybersecurity expertise explores the technical reasoning. If this expertise is unavailable internally, bring in a qualified specialist.

2. Examine past achievements

Ask the candidate to present a risk they helped address. Have them specify the activity concerned, the information available, the options considered and the decision made.

Distinguish their personal contribution from those of the teams and management. Ask how actions were monitored and what led to adjustments. Accept anonymised materials to protect confidential information.

For a certification presented by a candidate, ask which concepts they used in a real situation and what the limitations were.

Treat an explanation that connects risk, decision and action as a positive sign. Probe further when an account consists only of tool names, with no explanation of choices or identifiable personal role.

3. Use a case exercise that reflects the role’s responsibilities

Fictional example: a company has a risk register, several audit findings and limited resources to initiate security actions.

Ask the candidate what information they need before proposing priorities. Have them present the actions they envisage, the participants they would involve and the decisions to submit to management.

Examine the link between priorities and the company’s activities. Also observe their ability to distinguish an assumption from an established fact. A well-reasoned answer may leave several options open, depending on the information available.

Question a list of solutions presented without an examination of the risks. Do not reward verbal fluency alone: return to the reasons for the choices and how their implementation would be checked.

4. Explore communication and coordination

Ask the candidate to explain the same risk to a business leader and then to a technical contact. Compare how accurately they explain the risk and how they adapt the information to each audience.

Then explore a situation in which they have worked under pressure. Have them specify who was informed, which decisions they helped prepare and which responsibilities were assigned to specialists. If the role includes management, ask how actions were allocated and monitored.

Look for explanations that make the collective work clear. Probe further when candidates present themselves as the sole decision-maker without explaining the role of management or the other participants.

5. Cross-check the decisive points

With the candidate’s agreement, use references to explore their stated responsibilities and ways of working with others. Ask targeted questions about the points that matter most for the role.

Compare this information with the interviews and the case exercise. Record areas of agreement, limitations and open questions before deciding. A general impression does not replace examination of the criteria defined at the outset.