Chief information security officer (CISO) - Large groups
The IT security manager is responsible for studying the flaws in his company's IT system in order to manage an optimized protection plan. It offers solutions to guarantee cybersecurity.
Education level: Bac +5
Recommended baccalaureate: Scientific specialties
Employability: Strong
Starting salary: €3,300
Confirmed salary: €6,500
Mobility: Good
ROME Code: M1801
DPF Code: M1Z81
SUMMARY :
1. The position in a nutshell
2. Tasks
3. Responsibility of the cybersecurity expert
4. Skills
5. Salary
6. In which sector to work?
7. How do I access the profession?
The post in a nutshell:
The Chief information security officer (CISO) manages the cybersecurity approach on an organizational and/or geographical perimeter within the organization. It defines or declines, depending on the size of the organization, the information systems security policy (prevention, protection, detection, resilience, remediation) and oversees its application. It provides advice, assistance, information, training and alerts, in particular to business managers and/or management within its scope. He ensures the implementation of solutions and operational processes to guarantee data protection and the level of security of information systems.
Depending on the size of the organization, he plays an operational role in the implementation of the IS security policy or manages a team.
Equivalent title: Information Systems Security Officer (OSSI), Information Systems Security Officer (FSSI), Head of Digital Trust (RCN)
Missions
Identify:
- Define the axes and strategic objectives in terms of cybersecurity for its perimeter and have them validated by the competent management on it
- Identify the major security issues and risks within its scope
- Decline and maintain the IS security policy in collaboration with stakeholders
- Define an annual or multi-year action plan within its scope
- Define an investment policy with regard to security objectives
- Contribute to defining the organization of cybersecurity within its scope and lead it
- Follow regulatory and technical developments in your field
- Ensure relations with the players in its sector of activity around cybersecurity
Protect :
- Organize the structures for steering safety action plans within the entities
- Define the organizational and technical measures to be implemented to achieve the security objectives
- Provide implementation support by providing technical and methodological assistance as well as security tools and services, possibly through a catalog of services
- Disseminate an ISS culture to users and decision-makers Ensure the promotion of IT security charters within its scope
- Evaluate the level of security within its scope, in particular through the performance of periodic audits and permanent controls
- Check that IS security policies and rules are applied within its scope and vis-à-vis third parties and subcontractors (third parties)
- Contribute to responding to requests from prospects and customers of the organization on security aspects (particularly in the context of calls for tenders)
Detect and respond:
- Take technical and/or organizational measures allowing the monitoring of security events, the assessment of security incidents and the reaction to attacks, ensure the establishment of a SOC (Security Operation Center)
Ensuring continuity and rebuilding
- Prepare and implement an IT continuity plan, as part of the business continuity plan (BCP)
- Prepare and implement an IT recovery plan, as part of the Business Resumption Plan (BRP)
- Propose the cyber-resilience strategy
Report:
- Report regularly to his hierarchy on the current level of IS security risk coverage Provide an advisory role to his hierarchy and the businesses within his scope
- Represent the organization in relations with regulatory authorities
- Propose the cyber-resilience strategy
Our advice: this position is open to women and men. Motivation and the desire to learn are the fundamental qualities for the success of your project. Don’t put a barrier on yourself, you can do it.
Skills
Know how
- Good knowledge of the organization’s challenges and professions
- Ability to build the organization’s cybersecurity strategy
- Ability to understand cybersecurity threats
- Knowledge of the information system and architecture principles
- Mastery of the fundamentals in the main fields of ISS
- Knowledge of security technologies and related tools
- Risk management, cybersecurity policy and ISMS
- Legal knowledge of IT law related to IS security and data protection Cyberdefence: knowledge of crisis management
- Knowledge of governance, norms and standards in the field of security: ISO standards (2700X), sector standards (PCI-DSS, etc.)
Abilities
- Ability to influence
- Sense of general interest
- Team management
- Ability to report back to management
- Ability to work cross-functionally within the organization
- Ability to withstand pressure
- Ability to appropriate business issues
Salary
The RSSI is a position of responsibility whose salary depends on the structure. On average, gross annual compensation is between €40 and €80,000. Some structures offer salaries of up to €120,000 gross.
In which sector to work?
An RSSI can be requested in a specialized consulting firm such as in a company in finance, defence, telecommunications or industry.
Which companies recruit IT security managers?
- Agricultural credit ;
- Government services;
- Bouygues Telecom ;
- Thales;
- Hays;
- Orange Business Services.
Description of the profession in the ANSSI directory
In organizations with industrial IS, there is generally an RSSI for the industrial perimeter. In organizations that develop products comprising IS, a CISO may be appointed (in this case, we can speak of a Product Security Officer (PSO)).
How to access into the job?
Education: Bac + 5 with a specialization in cybersecurity Professional experience: more than 5 years in the field of cybersecurity
Our Intra-company training
From 2023 the CSB SCHOOL will offer you to train your employees to help them develop their different skills in the cybersecurity field. After a thorough study of the need by our development manager, you will be put in touch with our different pedagogical experts on the identified theme.
The complete career guide
Condimentum lacinia quis vel eros donec ac odio. Nibh cras pulvinar mattis nunc sed blandit libero volutpat. Facilisis gravida neque convallis a cras semper auctor neque vitae.
Same field jobs
Our school provides training in 21 cybersecurity jobs, from technical to supervising positions, from IT operations to industrial systems security. Here is the list of jobs you will be trained for by attending one of our training programs.