![image](https://imageio.forbes.com/specials-images/imageserve/65ef5ef5ef258c47d14e2c41/0x0.jpg?format=jpg&height=900&width=1600&fit=bounds)
A CSO, or chief security officer, manages security risks for an organization, from cyber attacks to physical intrusion, with the balance of these two functions depending on the organization. In terms of cybersecurity, the job involves protecting hardware, software, networks and data. Physical security, meanwhile, includes control over access to corporate sites and surveillance, along with liaison with law enforcement and external business partners. For both of these spheres of responsibility, the job involves establishing and evaluating security policies and procedures, along with training staff. Here is a look at what the role entails, and how to become a CSO.
What Is A CSO?
The exact position of a CSO in the corporate hierarchy depends on the size of the organization and the nature of its work, though they usually report to the chief information officer, the chief technology officer or the CEO.
Not every organization has or needs one. The cybersecurity and data security aspects of the job may, for example, be handled by a chief information security officer. Meanwhile, physical security may for many businesses not be a significant issue requiring a senior staff member to carry out oversight — or, alternatively so significant that it requires managing separately. CSOs tend to be found in larger organizations — those with at least 1,000 employees. The role is most common in private companies, though a third of public sector organizations in the U.S. also have one.
What Does A CSO Do?
A CSO has a broad range of duties, covering the security of both physical and digital assets. As such, they are likely to manage both cybersecurity teams and security guards.
On a day-to-day basis, in terms of physical security, the job includes creating and enforcing policies over who is entering corporate sites, along with the security of staff on and off-site. On the cybersecurity side, it involves developing strategies to identify and deflect cyber attacks and protect a company’s systems and data, along with protocols for disaster response and recovery. The CSO will be also responsible for compliance with both health and safety and data protection regulations, and may liaise with regulators and law enforcement bodies. Staff training is an important element of both aspects of the job, covering everything from evacuation drills to basic cybersecurity procedures.
CSO Vs. CISO: What’s The Difference?
A chief information security officer, or CISO, handles the security of an organization’s information systems and data; and the big difference between a CSO and a CISO is that the responsibilities of a CSO include physical security as well as cybersecurity.
Having said that, in many organizations nowadays a CSO focuses entirely on cybersecurity threats, making the two job titles interchangeable to a certain extent. It’s also worth noting that these days there is an element of overlap between cybersecurity and physical security, thanks to the widespread use of electronic devices for site access and the proliferation of internet of things devices in industrial settings. Where an organization has both a CSO and a CISO, the CISO will often report to the CSO, who in turn reports to the CEO or the chief operations officer. The two will work together to develop cybersecurity policies.
What Are The Necessary Skills and Qualifications Of A CSO?
Most CSOs will have a bachelor’s degree, most likely in the area of computer science, data security or cyber security, but perhaps in safety management — although in this case, additional IT certifications will almost certainly be required. Many will have a related master’s degree too.
When it comes to the skills required of a CSO, they’ll need to be pretty versatile. A certain level of technical knowledge is a must – not just as regards cybersecurity, but also in terms of understanding and evaluating surveillance and physical security systems. Management skills will be important for dealing with cybersecurity and security staff, as will communication skills. Meanwhile, problem-solving is an important part of the CSO’s job, particularly when planning policies and when dealing with any incidents; and, finally, good research skills will be required to handle issues such as regulatory compliance and risk mitigation.
Why Is It Important To Have A CSO?
With physical security systems increasingly involving complex technologies — surveillance systems, internet of things devices and the like — it makes sense for many organizations to have a single person in charge.
Indeed, many cybersecurity incidents result from breaches of physical security, such as the loss of storage devices, for example. Consolidating both sets of responsibilities with a chief security officer means it’s possible to set a common set of policies, and make it clearer who is in charge. This also makes it easier for staff to know who to whom they should report any concerns, meaning that other managers don’t get dragged in to dealing with security on an ad-hoc basis. Of course, not every organization needs a CSO: for some, especially smaller firms, physical security is a minor issue; for many others, information security is so important that it merits a senior post of its own.
What Is The Average Salary of a CSO?
Given the broad range of responsibilities of a chief security officer and the years of experience required, the job is relatively well-paid, with good long-term career opportunities.
In the U.S., according to Zippia, the average salary for a chief security officer ranges from $101,000 to $204,000, with a median of $144,017. In the U.K., according to job site Glassdoor, it’s rather lower, varying between £22,000 and £58,000 and with an average CSO salary of just £35,000. The U.S.’s highest CSO salaries are to be found in California, where they average $167,160, followed by Washington at $157,626 and Maryland at $153,957. The best-paid industries are insurance, where CSO’s average $146,069, followed by media at $132,558, hospitality at $127,032 and government at $110,620. The best-paying firms, says Zippia, are McKinsey & Company, TS Imagine, Okta
OKTA
OKTA
and Kaiser Permanente.
How Can You Become a CSO?
There aren’t any rigid educational requirements to become a chief security officer, but most CSOs will have at least a bachelor’s degree, usually in a technical subject, along with various IT certifications. According to Zippia, 17% of CSOs in the U.S. have a master’s, and 4% a doctorate.
It generally takes people several years to work up to the position, and requires management experience, perhaps including risk management, corporate governance and regulatory compliance, as well as experience in contract and vendor negotiation. The first steps towards becoming a CSO might include positions as a security analyst, networks security analyst or network security engineer, followed by more senior cybersecurity roles such as senior security analyst or principal security engineer. While in the past, many CSOs moved up the ranks through positions in the physical security industry while gaining IT certifications along the way, this is now a rather rarer career path.
What Is The Future of Chief Security Officer Roles?
The job of chief security officer has evolved over the years, and is now generally much more focused on cybersecurity than it was in the past — indeed, it can sometimes involve only this.
However, as we’ve seen, the advent of sophisticated surveillance systems and the rise of the internet of things has brought an increasing convergence between physical security and cybersecurity, and this trend is likely to continue. Other cybersecurity risks continue to proliferate, making the role ever more mission-critical; and as a result, salaries are rising. Meanwhile, the number of CSO positions is increasing too. There are currently more than 7,500 people in the role in the U.S., according to Zippia, and the number is predicted to rise by 11% from 2018 to 2028, much faster than the average U.S. job growth of 5%.
Bottom Line
The job of chief security officer is a hybrid role, with responsibility for both physical security and cybersecurity. As the risks of both these aspects increase, CSO salaries are rising faster than the U.S.’s average pay.
This post was originally published on 3rd party site mentioned in the title of this site