Rise of the Chief Security Officer

As a result, the company is open to security breaches. "Companies assume things are fine until a catastrophic event or an external reviewer looks through the architecture and finds the flaws," he says.

Related Stories

Curbing Security Threats is Red Cross Exec's Priority: The first chief information security officer at the Red Cross talks about protecting networks and data - and why the CISO position is surfacing in enterprises like his. Chief Security Officers' Pay Varies Widely: CSOs in financial services can expect to earn significantly more than their counterparts in utilities, manufacturing and other fields. Companies Confront Rising Network Security Threats : Many companies aren't doing nearly enough to protect their networks from increasingly potent and global threats. Email Article Print Article Share Articles Digg del.icio.us Newvine StumbleUpon Reddit

Kovar says chief information officers and chief operating officers simply have too much to do and shouldn't be responsible for ensuring a company's IT security.

"The solution that they will get to -- and it may be willingly or kicking and screaming -- is that they need to release some of this responsibility by providing an infrastructure that can address all those needs that are no longer COO or CIO tasks," Kovar says. "Companies should have a chief security officer. They should be required to have a CSO by the shareholders, the stakeholders."

CSO shortage expected

The question, then, is where to find a chief security officer.

The best ones, Byrnes says, are those who have an information security background. But they also must be familiar with corporate politics and have been in a policy-setting role in the past.

Some chief security officers seek certification as a Certified Information Systems Security Professional (CISSP), which is offered by the Intentional Information Systems Security Certification Consortium. Certified chief security officers earn about $200,000 to $300,000 a year, Byrnes says.

He says about 9,000 people have received a CISSP certificate. However, Meta Group estimates there are about 24,000 chief security officer jobs to be filled.

"We're not in too bad of shape because of lot of organizations have not tried to create the SCO position yet," Byrnes says. "As the trend continues, we'll have more of a shortage and that will drive salaries higher."

Freelance writer Cynthia Flash covers business and technology from Bellevue, Wash. She can be reached at cynthia@flashmediaservices.com.