Appointing a CISO: Requirements Profile, Duties & vCISO
5
Morten Laufer
Founder
NIS2 makes security responsibility a management task and the CISO a mandatory role in many companies. Salaries range from €120,000–€160,000+, and even higher in critical infrastructure (KRITIS) and financial services. For SMEs, a vCISO is often the more realistic starting point. Nova Search is a founder-led tech recruitment consultancy with cybersecurity as its core niche and over 1,500 pre-qualified security profiles.
Strategic importance: 82% of CISOs now report directly to the CEO (compared to 47% two years prior), underlining its C-level relevance.
Regulatory pressure: NIS2 obliges around 29,500 companies in Germany to implement stricter risk management.
Flexible models: Medium-sized businesses often use external vCISOs to save full-time costs of over €150,000.
Nova Search fills CISO and security leadership roles — first shortlist in 5 working days, 90-day guarantee.
What is a CISO and does the role belong on the C-level?
The Chief Information Security Officer (CISO) acts as a strategic shield for your company's digital assets and operational resilience. Unlike traditional operational IT management or the purely documenting Information Security Officer (ISO), the CISO aligns the security architecture directly with overarching business goals.
The position has seen an enormous upgrade in recent years. While cybersecurity was previously often located beneath the CIO as a purely technical issue, the CISO is now increasingly establishing itself as a permanent C-level fixture. A global study highlights this shift: 82% of CISOs surveyed now report directly to the CEO, compared with 47% two years earlier. A modern CISO develops long-term security roadmaps, assesses business risks in the board context and ensures that digital innovations do not fail due to security vulnerabilities. Anyone building sustainable cybersecurity recruiting must therefore combine strategic risk management with technical leadership strength.
Criterion | Information Security Officer (ISO) | Chief Information Security Officer (CISO) |
|---|---|---|
Focus | Operational compliance, audits and guidelines | Strategic risk management and cyber resilience |
Integration | Staff unit or IT department | C-level or direct reporting line to the CEO |
Decision-making power | Recommending and documenting | Real budget and risk decision-making authority |
Perspective | Compliance with control catalogs | Assessment of business risks and cost of downtime |
Is a CISO mandatory in Germany? (NIS2 & KRITIS)
Although there is no direct legal requirement in the text of the law to explicitly award the protected title of CISO, regulatory requirements effectively force companies to anchor this responsibility at the highest executive level. The strongest driver is the NIS2 Implementation Act (NIS2UmsuCG), which has applied in Germany since December 2025 and obliges around 29,500 entities from 18 sectors to immediately implement risk management measures.
The crucial difference compared to earlier regulations lies in the personal liability of management under Section 38 BSIG. Supervisory bodies and boards of directors can no longer shift omissions in information security management to subordinate units. In addition to NIS2, industry standards such as DORA in the financial sector, ISO 27001 and IEC 62443 in the KRITIS and OT sectors are increasing the pressure to act. Cybersecurity has thus finally turned from a technical duty into a central governance task for management.
Mandatory risk management measures (Section 30 BSIG) to secure the entire digital supply chain
Personal monitoring and training obligation for the management with direct organizational liability
Graduated reporting system for security incidents with strict deadlines starting 24 hours after incident detection
Requirement profile and top CISO certifications
The requirement profile of a CISO combines a deep technological understanding with strong boardroom diplomacy. A successful CISO must be able to translate complex threat scenarios into business risks and convincingly defend budget decisions in front of the board. Practical experience from demanding projects with clients such as avodaq AG proves that the combination of technical architectural competence and strong communication skills makes all the difference for team success.
In order to objectively assess technical qualifications and leadership skills, internationally recognized certifications have established themselves as standard in the market. This great responsibility is clearly reflected at the salary level: depending on the size of the company, an internal CISO in German medium-sized businesses achieves a total compensation of between 150,000 and 250,000 euros per year. Market benchmarks show that specialized qualifications noticeably increase salary potential.
CISSP (Certified Information Systems Security Professional): The global gold standard for holistic security management and security architecture.
CISM (Certified Information Security Manager): Strongly focused on governance, risk management and the alignment of IT security with corporate goals.
CCISO (Certified Chief Information Security Officer): Developed specifically for executive readiness, with a focus on financial management, audit governance and strategic leadership.
Options: Permanent employment, Interim or vCISO?
When filling the CISO role, companies face different models that must be weighed up depending on company size, available budget and regulatory pressure. While large corporations usually rely on an internal full-time employee, medium-sized businesses often choose flexible options.
As shown, a permanent full-time position incurs annual costs of over 150,000 euros. A cost-effective alternative for medium-sized businesses is a Virtual CISO (vCISO), who takes over strategic tasks on a part-time model starting at around 3,600 euros per month. For acute restructuring or time-critical vacancies, on the other hand, an Interim CISO on a project basis is the ideal choice.
If you are looking for long-term reinforcement, Nova Search supports you with specialized services such as permanent recruitment or flexible freelancer staffing (Freelancer & Contract Staffing). Through a two-stage technical screening, we deliver your first qualified profiles for leadership positions in the cybersecurity sector in 5 working days or 48 hours respectively.
Permanent Recruitment: Maximum commitment and deep integration into the management team with full presence.
Freelancer & Contract Staffing (Interim): Immediate availability for crisis situations, restructurings or transition phases.
Virtual CISO (vCISO): Scalable, external consulting for the gradual development of governance and NIS2 compliance.
Read more
Sources
FAQ
What is the difference between a CIO and a CISO?
The Chief Information Officer (CIO) is responsible for setting up and ensuring the smooth operation of IT systems. The Chief Information Security Officer (CISO) role, on the other hand, ensures that these systems and the data processed within them remain secure from attacks. This separation is strategically important to avoid conflicts of interest between availability and security.
When is a CISO mandatory in Germany?
There is no explicit legal requirement for this exact job title. However, regulations such as NIS2 (affecting around 29,500 entities in Germany) and KRITIS force management to demonstrably manage IT security. In practice, this management obligation means that from a certain company size or in critical sectors, a dedicated CISO role becomes indispensable.
Which CISO certifications are the most important?
Internationally recognised top certifications include the CISSP (focusing on holistic corporate security and management), the CISM (focusing on governance and risk management) and the CCISO (specifically for C-level executive readiness). These certificates guarantee a sound understanding of business risks and boardroom communication.
How much does a permanent CISO position cost?
With employer contributions and ancillary costs, the total cost for an internal full-time position quickly amounts to well over 150,000 euros annually.
What does a vCISO (Virtual CISO) do?
An external or Virtual CISO provides strategic leadership in information security on a service-orientated basis. For medium-sized companies in particular, this model offers the advantage of purchasing C-level expertise as and when required, without having to bear the high fixed costs of a full-time permanent position.
How long does it take to fill a CISO position?
As the position is in high demand and requires a high professional and personal standard, the regular market process can take months. As a specialised recruitment consultancy, Nova Search often presents the first vetted profiles within 5 working days through targeted headhunting and our existing network.
