As CISOs grapple with the C-suite, job satisfaction takes a hit

Cybersecurity jobs pay well, especially as professionals move up the managerial ladder. Salaries for CISOs run anywhere between $400,000 to $1 million per year.

However, as the saying goes, money can’t buy happiness — or job satisfaction. Three in four CISOs considered a job change in 2023, research from IANS and Artico Search found.

CISOs have found acceptance in the C-suite in title but not necessarily with organizational leadership. Security leaders can serve as the scapegoat for cyber incidents and compliance violations, which is contributing to a lack of job satisfaction.

“Regulators and prosecutors are now holding CISOs accountable for transparency, even fraud, on behalf of their organization,” the report found.

CISOs must contend with personal liability and reputational repercussions, while dealing with leadership teams that fail to grasp the gravity of cybersecurity risks, Pathlock CEO Piyush Pandey said via email.

“Combining these issues with pressure from day-to-day security operations without a commensurate compensation uplift would be a significant disincentive,” said Pandey.

The impact of the declining job satisfaction among CISOs

With increasing regulatory requirements around data protection and privacy, and a growing list of IT general controls, the heavy burden resting on the shoulders of CISOs is leading to burnout. It’s a problem that George Jones, CISO at Critical Start, has witnessed firsthand.

“I am seeing my peers struggle with work-life balance and career development,” Jones said.

A lack of CISO satisfaction can have significant implications for corporate security, Jones added, including:

Decreased effectiveness: A dissatisfied CISO may be less motivated to engage in their role managing and mitigating cybersecurity risks.
Retention challenges – Highly dissatisfied CISOs will leave roles early, contributing to higher turnover rates and instability in an organization. This can also create potential gaps in leadership and process.
Cultural impact – CISOs play a crucial role in shaping the security culture of an organization and drive awareness among employees. Dissatisfaction can impact their ability to foster a strong culture of security in an organization.
Vulnerability increases – A lack of satisfaction can also result in insufficient resources allocated to cybersecurity initiatives, leaving organizations more vulnerable to cyber threats and breaches.

Breaking down the barriers between CISOs and leadership

The lack of a defined leadership role for CISOs is hurting job satisfaction. Those CISOs that have more access to the company’s board of directors report higher satisfaction with their job and handling of security requests.

“Just 28% of those without board engagement are satisfied versus 57% with, at least, infrequent or ad hoc board contact,” the IANS and Artico Search report found.

When CISOs and cybersecurity are overlooked in leadership meetings, organizations will struggle to adopt cybersecurity best-practices and meaningfully integrate cybersecurity within their company’s culture.

A priority for businesses must be to break down the barriers between security and business leaders.

This starts with giving CISOs a seat at the table for all board meetings, where cybersecurity initiatives should be proactively and regularly discussed. Organizations must also accept the fact that proactive cybersecurity best-practices and sufficiently funded cybersecurity teams and programs are not cheap. They never will be, either.

“The sooner that board-level decision makers understand that upfront investment is more cost-productive than reactive spending after a breach, notable progress will be made in terms of proper cybersecurity investment and funding,” said Pandey.

The outlook for CISOs is likely to depend on factors such as evolving cybersecurity threats, organizational priorities, regulatory changes, and the effectiveness of measures taken to address the job's challenges.

“This makes it difficult to predict outlook, but the workload and stress levels are not likely to decrease, which means that the stress levels will follow suit,” said Jones.