Chief Information Security Officer (CISO)
When to Use
- Define security program strategy — vision, pillars, 12–36 month roadmap, investment themes
- Set risk appetite with board or audit committee — thresholds, escalation, exceptions
- Prepare board and executive briefings — posture narrative, KRIs, material risks, asks
- Lead incident escalation and crisis comms — executive decisions, regulators, customers, media
- Build security budget and org design — headcount, tooling envelope, build vs buy, vendors
- Manage regulatory and audit relationships at exec level — exam prep, consent agendas, themes
- Define leadership metrics — KRIs, program health, outcome vs activity measures
- Shape cyber insurance and vendor posture — coverage, broker, critical supplier risk
- Align security with enterprise strategy — M&A diligence themes, digital risk, third-party risk
When NOT to Use
- Deploy SSO, SIEM, EDR, hardening, or remediate vulnerabilities →
information-security-engineer
- Build risk registers, FAIR models, or treatment scoring →
security-risk-analyst
- GRC program scope, gap assessments, audit prep packs →
compliance-specialist
- Control testing workpapers, evidence automation →
compliance-engineer
- SOC alert triage, playbooks, shift operations →
soc-analyst
- Run CSIRT containment, forensics, or technical IR →
incident-responder
- Enterprise security reference architecture, zero-trust patterns, ARB standards →
enterprise-security-architect
- Infrastructure capex portfolio and facility supply chain →
vp-of-infrastructure
- Draft press statements, all-hands scripts, or comms templates →
communication-lead
- Broad security strategy without exec/board lens →
cybersecurity
Related skills
| Need |
Skill |
| Control implementation, SIEM/EDR, hardening |
information-security-engineer |
| Risk registers, inherent/residual, treatment |
security-risk-analyst |
| GRC program, frameworks, audit coordination |
compliance-specialist |
| Control testing, evidence automation |
compliance-engineer |
| Declared incident response execution |
incident-responder |
| Enterprise security reference architecture |
enterprise-security-architect |
| Infrastructure portfolio and exec infra narrative |
vp-of-infrastructure |
| Crisis and executive communications drafting |
communication-lead |
| Enterprise security strategy (non-exec depth) |
cybersecurity |
| M&A/investment diligence and IC cyber packs |
cyber-diligence-governance |
Core Workflows
1. Scope and operating model
Clarify CISO authority, committee cadence, and what stays with security engineering vs GRC vs IR.
See references/ciso_scope.md.
2. Security strategy and program
Program pillars, roadmap, investment cases, and measurable outcomes.
See references/security_strategy_and_program.md.
3. Risk appetite and governance
Appetite statements, thresholds, exception governance, and board risk committee inputs.
See references/risk_appetite_and_governance.md.
4. Board and executive communications
Briefing structure, KRIs, materiality, and decision asks for board and audit committee.
See references/board_and_executive_communications.md.
5. Incident, crisis, and regulatory
Escalation paths, crisis comms, regulator notification themes, and audit/exam posture.
See references/incident_crisis_and_regulatory.md.
6. Metrics and org design
KRIs, program metrics, headcount model, budget envelope, and vendor/insurance posture.
See references/security_metrics_and_org_design.md.
Outputs
- Board security briefing — posture, KRIs, top risks, incidents, investments, decisions needed
- Risk appetite memo — thresholds, metrics, escalation, exception process
- Program roadmap — pillars, initiatives, dependencies, budget phasing
- Crisis comms brief — facts, audiences, approvals, regulatory clock
- Budget and org plan — FTE, tooling, contractors, ROI narrative
- Audit/regulatory themes — open items, management responses, systemic fixes
Principles
- Outcomes over activity — measure risk reduction and resilience, not ticket volume
- Materiality for leadership — escalate what changes decisions, capital, or reputation
- Delegate execution — CISO sets direction; engineers and GRC implement
- Single narrative — align board story with risk appetite and program investments
- Document decisions — appetite exceptions, crisis calls, and budget trade-offs
When to load references
- Role boundary and handoffs →
references/ciso_scope.md
- Program strategy and roadmap →
references/security_strategy_and_program.md
- Appetite and governance →
references/risk_appetite_and_governance.md
- Board and exec briefings →
references/board_and_executive_communications.md
- Crisis and regulatory →
references/incident_crisis_and_regulatory.md
- KRIs, budget, org →
references/security_metrics_and_org_design.md
1---2name: chief-information-security-officer3description: Guides executive security leadership—security program strategy and operating model, risk appetite and board or audit-committee reporting, KRIs and leadership metrics, incident escalation and crisis communications, security budget and org design, regulatory and audit relationships at exec level, and cyber insurance and vendor posture. Use when acting as CISO, preparing board security briefings, defining security program strategy or risk appetite, security metrics for board, crisis comms, security budget cases, or reporting to the board audit committee—not hands-on SOC/IR (soc-analyst, incident-responder), control testing workpapers (compliance-engineer), GRC program scope and audit prep (compliance-specialist), enterprise reference architecture (enterprise-security-architect), or control deployment and SIEM engineering (information-security-engineer).4---56# Chief Information Security Officer (CISO)78## When to Use910- Define **security program strategy** — vision, pillars, 12–36 month roadmap, investment themes11- Set **risk appetite** with board or audit committee — thresholds, escalation, exceptions12- Prepare **board and executive briefings** — posture narrative, KRIs, material risks, asks13- Lead **incident escalation and crisis comms** — executive decisions, regulators, customers, media14- Build **security budget and org design** — headcount, tooling envelope, build vs buy, vendors15- Manage **regulatory and audit relationships** at exec level — exam prep, consent agendas, themes16- Define **leadership metrics** — KRIs, program health, outcome vs activity measures17- Shape **cyber insurance and vendor posture** — coverage, broker, critical supplier risk18- Align security with **enterprise strategy** — M&A diligence themes, digital risk, third-party risk1920## When NOT to Use2122- Deploy SSO, SIEM, EDR, hardening, or remediate vulnerabilities → `information-security-engineer`23- Build risk registers, FAIR models, or treatment scoring → `security-risk-analyst`24- GRC program scope, gap assessments, audit prep packs → `compliance-specialist`25- Control testing workpapers, evidence automation → `compliance-engineer`26- SOC alert triage, playbooks, shift operations → `soc-analyst`27- Run CSIRT containment, forensics, or technical IR → `incident-responder`28- Enterprise security reference architecture, zero-trust patterns, ARB standards → `enterprise-security-architect`29- Infrastructure capex portfolio and facility supply chain → `vp-of-infrastructure`30- Draft press statements, all-hands scripts, or comms templates → `communication-lead`31- Broad security strategy without exec/board lens → `cybersecurity`3233## Related skills3435| Need | Skill |36|---|---|37| Control implementation, SIEM/EDR, hardening | `information-security-engineer` |38| Risk registers, inherent/residual, treatment | `security-risk-analyst` |39| GRC program, frameworks, audit coordination | `compliance-specialist` |40| Control testing, evidence automation | `compliance-engineer` |41| Declared incident response execution | `incident-responder` |42| Enterprise security reference architecture | `enterprise-security-architect` |43| Infrastructure portfolio and exec infra narrative | `vp-of-infrastructure` |44| Crisis and executive communications drafting | `communication-lead` |45| Enterprise security strategy (non-exec depth) | `cybersecurity` |46| M&A/investment diligence and IC cyber packs | `cyber-diligence-governance` |4748## Core Workflows4950### 1. Scope and operating model5152Clarify CISO authority, committee cadence, and what stays with security engineering vs GRC vs IR.5354**See `references/ciso_scope.md`.**5556### 2. Security strategy and program5758Program pillars, roadmap, investment cases, and measurable outcomes.5960**See `references/security_strategy_and_program.md`.**6162### 3. Risk appetite and governance6364Appetite statements, thresholds, exception governance, and board risk committee inputs.6566**See `references/risk_appetite_and_governance.md`.**6768### 4. Board and executive communications6970Briefing structure, KRIs, materiality, and decision asks for board and audit committee.7172**See `references/board_and_executive_communications.md`.**7374### 5. Incident, crisis, and regulatory7576Escalation paths, crisis comms, regulator notification themes, and audit/exam posture.7778**See `references/incident_crisis_and_regulatory.md`.**7980### 6. Metrics and org design8182KRIs, program metrics, headcount model, budget envelope, and vendor/insurance posture.8384**See `references/security_metrics_and_org_design.md`.**8586## Outputs8788- **Board security briefing** — posture, KRIs, top risks, incidents, investments, decisions needed89- **Risk appetite memo** — thresholds, metrics, escalation, exception process90- **Program roadmap** — pillars, initiatives, dependencies, budget phasing91- **Crisis comms brief** — facts, audiences, approvals, regulatory clock92- **Budget and org plan** — FTE, tooling, contractors, ROI narrative93- **Audit/regulatory themes** — open items, management responses, systemic fixes9495## Principles9697- **Outcomes over activity** — measure risk reduction and resilience, not ticket volume98- **Materiality for leadership** — escalate what changes decisions, capital, or reputation99- **Delegate execution** — CISO sets direction; engineers and GRC implement100- **Single narrative** — align board story with risk appetite and program investments101- **Document decisions** — appetite exceptions, crisis calls, and budget trade-offs102103## When to load references104105- **Role boundary and handoffs** → `references/ciso_scope.md`106- **Program strategy and roadmap** → `references/security_strategy_and_program.md`107- **Appetite and governance** → `references/risk_appetite_and_governance.md`108- **Board and exec briefings** → `references/board_and_executive_communications.md`109- **Crisis and regulatory** → `references/incident_crisis_and_regulatory.md`110- **KRIs, budget, org** → `references/security_metrics_and_org_design.md`
daemon-blockint-tech