Hiring the right CISO: Role design and fit in cybersecurity leadership

As cybersecurity threats become more complex, the chief information security officer (CISO) position has emerged as a critical yet frequently misunderstood executive role. Many organizations struggle to define what cybersecurity leadership should look like in their specific context, resulting in misaligned expectations, costly hiring decisions, and underperforming security functions. Drawing on 41 in-depth interviews with CISOs across industries and regions, this study reframes CISO selection as an organizational-design challenge rather than a search for a universally capable individual. We explain three recurring CISO sub-roles: the technical information security officer, the strategic information security officer, and the business information security officer. Each sub-role reflects a coherent alignment of reporting structure, competency profile, and strategic focus, and each is suited to different organizational conditions. Using Big Five personality assessments, we conduct an exploratory analysis of the associations among personality traits, leadership tendencies, and perceived role fit within these sub-roles. Building on this framework, the study outlines how organizations can deliberately select and design CISO roles and manage transitions between sub-roles as priorities evolve. The findings provide boards, CEOs, and hiring managers with a structured approach to aligning cybersecurity leadership with their business strategy and needs.