You Are Three Years In and Wondering What Comes Next: The Ten Year Plan From Analyst to CISO

The views expressed are my own and do not represent those of my employer.

Most CISOs did not plan the path; you can.

Look at how most people reach the title. A good manager tapped them on the shoulder. An incident landed on their desk and they stayed to finish it. A job opened and they said yes. Looking back, it all seemed to follow a plan. At the time it was a string of decisions that made sense one at a time.

You do not have to wait for hindsight. The stages are visible in advance, and the people who move through them on purpose get there with fewer wasted years.

Search for how to become a CISO and you will find dozens of guides. Many come from training providers, and they tend to point you toward the next course. They also disagree on the basics. Some put a fixed number of years on the path. One 2026 roadmap written by a sitting CISO now says there is no universal timetable at all. If you are three years in and trying to plan, that is not much help.

This post is the version I wish someone had handed me. It covers the jobs that built the path, the skills that carried weight, the certifications that opened doors, and the ones that were noise. It also covers where business skills enter the picture, because that is where most technical people stall. By the end you should be able to place yourself on the path and pick your next two moves.

The Timeline Question, Settled

Here is my answer. It took me about 15 years to reach CISO, and I started in IT operations, not security. That is my path, not a rule. Your own timeline depends less on the calendar and more on how quickly you collect the experiences in the next sections.

The guides disagree because they measure the wrong thing. They count years. Hiring executives do not count years. They ask what you have owned.

Years do not make a CISO. The scope you have owned, defended and explained to the business does.

Someone with eight years of varied, escalating responsibility will beat someone with fifteen years of the same job repeated. Size of company moves the timeline more than talent does. A small organization may hand the seat to a strong director years earlier than a large enterprise would. That trade comes with its own costs, which I cover below.

Think of the path in four stages: build the base, go where things break, build something, take the seat. The year ranges are rough. The sequence is what matters.

Stage One: Make the Thing Work Before You Secure It

Years zero to three belong to operations. Help desk, network administration, systems administration, junior SOC analyst. The title matters less than the exposure. You need to learn how real systems behave when real people depend on them.

I started as a network and systems admin, focused on making things work. Security was not my job. Then the FBI knocked on the door of the company I worked at. They had identified traffic from the network I was responsible for going to a criminal organization. I got a chance to learn some of the basics of security from them, and I grew my career from there.

That is a strange origin story, but the lesson applies to you. The people who defend systems best are the ones who have kept them running. When you later tell a plant manager that a change will take a system offline for four hours, you will know whether that estimate is honest. Credibility with the business starts here.

What to learn in this stage: networking fundamentals, directory services, logging, and how change actually happens in an organization. Learn who approves outages. Learn what the help desk hears first. These are the skills that never appear on a certification outline.

What is noise at this stage: chasing advanced offensive training before you can describe a normal day on your own network. If you are starting from zero, my complete guide to breaking into information security covers the entry points in detail.

Stage Two: Go Where the Fire Is

Years three to seven are for specializing, and I recommend specializing where things break. Incident response, security operations, detection engineering, identity, cloud, or governance and audit work. Pick one and get good enough that people ask for you by name.

My own move came through that FBI connection. They connected me with a security consulting firm focused on incident response. That is where I learned the principles of good security and good hygiene. I worked for a number of Global 50 and Fortune 500 companies, helping them remediate breaches and incidents and secure their environments.

Two things from that period matter for your path. The first is repetition. Seeing many organizations fail in similar ways teaches you pattern recognition that a single employer never can. The second is teaching. Most of my engagements included time to sit with the client's teams and teach them about security over time. That teaching was also leadership practice. You cannot teach what you cannot explain, and you cannot lead what you cannot explain.

You do not need a consulting career to get this. Incident response rotations, tabletop exercises, audit support, and cross team projects all give you exposure to many systems and many stakeholders. Ask for the work other people avoid. My incident responder career profile shows what that role looks like day to day.

One point from the guides is worth repeating. A 2026 roadmap by a sitting CISO makes the case that you do not need to be the best penetration tester in the room. You need to understand what that tester is telling you and why it matters. I agree. Deep technical skill earns respect and a seat on the incident bridge. It does not teach you budgets, risk appetite or board communication.

Stage Three: Build Something From Nothing

Years seven to twelve are where candidates separate. You stop being the best individual contributor and start owning outcomes through other people. Security manager, director, deputy CISO, head of a program, regional security lead.

The experience hiring executives value most here is building. An organization I worked with as a consultant liked what they saw and hired me away into a management role. It was a Global 50 organization that I really liked, and I helped build their security program up from scratch. I eventually moved into a regional CISO role. Building a program from zero forces you through every hard decision in order. You pick a framework. You decide what to buy and what to skip. You choose which risks to accept in writing. You learn to sequence work so the business sees progress before patience runs out.

You do not need a blank slate to get this. Take ownership of any program that lacks an owner: vendor risk, security awareness, access reviews, or incident response planning. Write the charter. Set the metrics. Report the results upward. That is a mini CISO job with a smaller blast radius.

Collect scope evidence. Track the budget you managed, the people you led, the audits you supported, the incidents you ran, and the executives you briefed. Interviews for CISO roles run on scope evidence. Titles alone do not carry them.

Certifications: What Opened Doors and What Was Noise

No certification makes you a CISO. Two matter more than the rest, and each has an experience gate that tells you when to pursue it.

The CISSP from ISC2 requires a minimum of five years of cumulative, full time experience in two or more of the eight exam domains. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it. A relevant degree or an approved additional credential can waive one year, and only one. The CISSP is broad. It shows you can speak across the whole field, which is exactly what a CISO must do.

The CISM from ISACA leans toward management. ISACA requires at least five years of information security management work experience across at least three of the four CISM domains, gained within the ten years before you apply. You will not hold the management years until stage three, so the CISM naturally lands later.

My recommendation is simple. Take one entry level credential early if you need a foothold. Earn the CISSP somewhere around years four to six. Consider the CISM once you are managing people or programs. Stop there.

Certifications clear the resume filter. Scope evidence, a crisis you ran, and the way you explain risk win the interview.

The noise is the fourth and fifth certification. Time spent collecting extra letters is time not spent running a program, leading a project, or standing in front of an executive. An advanced degree falls in the same category. Some employers prefer a master's degree or MBA, but there is no universal advanced degree requirement. An MBA can help if you want to learn finance fast. It does not replace the experience.

The Skills Nobody Puts in a Course Outline

Here is where technical people stall. They reach director level, they are excellent, and the CISO seat still goes to someone else. The gap is almost always business skill.

The data points the same direction. A 2026 benchmark report from IANS, Artico Search and The CAP Group, based on a survey of 17 board directors, found that only 30% of boards describe their relationship with the CISO as strong and collaborative. The same report found a gap in what directors value. While 82% of directors rate CISO reporting on regulatory trends as satisfactory or excellent, only 47% feel that way about the CISO's ability to articulate the impact of evolving threats. Boards can see the activity. They want help understanding what it means for the business.

Confidence runs low on the CISO side too. A 2026 report from Pulse Security AI, built on a 42 respondent survey plus interviews, found that only 12.5% of CISOs are very confident their board accurately understands the true state of the security program after a presentation. Seventy-one percent spend 10 or more hours preparing each board or audit committee cycle. It is a small sample, so treat the percentages as directional. The direction is still clear.

That same report offers a useful correction for people who think the answer is just better slides. It suggests the communication challenges are rooted more in governance than presentation skills. Many organizations still lack a formally defined cyber risk appetite. A future CISO needs to understand risk appetite, not just present against it.

Learn to read the business. Understand how the company makes money, where margin is thin, what a day of downtime costs, and which customers matter most. Learn to read a budget and defend a line item. Learn to describe a risk as a business decision with a cost and an owner.

I wrote about this in more detail in The Most Important Skills for a Cybersecurity GRC Professional. The skills there are not technical, and they transfer directly to the CISO seat. Once you are close to the role, Winning the Room covers how to earn executive support.

The technical skills get you to director. The business skills get you the seat.

Choosing the Seat: Big Company, Midsize, or Something Else

Your first CISO seat will probably not be your last. In the 2026 State of the CISO Benchmark Report, IANS and Artico Search surveyed 662 CISOs between April and November 2025. The respondents reported an average tenure of nine years, with most having served as CISO at multiple organizations and across multiple industries. Nearly seven in ten said they were open to a career move within the next year.

That mobility is good news for you. It means the path has several entry points, and a smaller seat can be a stepping stone as well as a destination.

Size changes the job. The same report found that more than half of CISOs (52%) say their scope is no longer fully manageable, particularly in smaller organizations and industries with leaner teams. A midsize organization may hand you the title sooner. It will also hand you a wider scope and fewer people to cover it. Ask about team size, executive access and budget before you accept.

My next move was about balance. After the Global 50 program build and the regional CISO role, I wanted more work life balance. I landed in a midsize organization CISO role, which I love. I enjoy growing a cyber program and helping the business understand risk. The work is about balancing cyber risk against business risk so the business can be effective and deliver value. Big company or midsize, that balancing act is the job.

When you do land the seat, start with my posts on the first 30 days and the priorities checklist for your first 30 days, six months and year. They assume you already have the job. This post is about getting there.

Find Yourself on the Map and Pick Two Moves

Here is how to use this. Find your stage, then commit to two moves for the next twelve months. Not ten. Two.

If you are in stage one (operations or junior analyst): Move one: take the jobs closest to incidents, access and change control. Move two: learn to write. Document one process end to end and have a senior person critique it.

If you are in stage two (specializing): Move one: pick the domain where things break and become the person others call. Move two: ask to brief someone senior on your work, even once a quarter. Start practicing the translation from technical detail to business consequence.

If you are in stage three (managing or directing): Move one: own a program from charter to metrics. Move two: get in front of audit, legal and finance. Learn their questions. Ask to sit in when the audit committee reviews risk, even if you only listen.

If you are ready for the seat: Move one: assemble your scope evidence into a one page summary. Move two: interview the CISOs you respect and ask what they wish they had known. Choose your first seat for scope and executive access, not title alone.

Getting Organizational Support for Your Own Climb

Nobody reaches CISO alone. You need support at every level, and you get it by framing your growth in terms of business risk, not personal ambition.

Your manager. Do not ask for a promotion. Ask for a gap to close. Say that you want to be able to cover the risk reporting for the team if your manager is out, and ask what would prove you are ready. Managers support what reduces their own key person risk.

Your peers in IT, legal, finance and audit. Offer help before you ask for it. When you remove a finding for audit or answer a vendor questionnaire for legal, you build allies who will describe you as someone who gets things done. Those peers often sit on the panel that approves a future promotion.

Senior executives. Find a sponsor, someone who has seen your work and can speak to your judgment. Make the case in their terms. A leader who understands the business and can explain security risk lowers the chance of a surprise that reaches the CEO.

The board. You will rarely present to the board before you hold the title, so earn exposure indirectly. Offer to draft the risk summary your leader presents. Study how the board asks questions. If your organization has a succession plan for security leadership, your growth is part of that plan. Directors care about continuity, and a prepared internal successor is a business continuity answer.

Training and finance. When you request development funds, tie them to risk. A course on risk quantification supports better budget conversations. A leadership program reduces the chance of regrettable attrition on your team. Finance approves outcomes. Leave the credential talk out of it.

Key Points

• There is no fixed timeline. It took me about 15 years. Scope owned matters more than years served.
• Build the base in operations before you specialize. Credibility with the business starts there.
• Specialize where things break, then build a program from nothing, even a small one.
• Earn the CISSP around years four to six and the CISM once you manage people or programs. Skip the rest.
• Learn finance, risk appetite and executive communication before you need them.
• Collect scope evidence: budgets, people, audits, incidents and executive briefings.
• Pick two moves for the next twelve months, not ten.

Pro Tips

Keep a scope ledger. Every quarter, write down what you owned: money, people, systems and decisions. When a recruiter or executive asks what you have done, you will have an honest, specific answer instead of a vague one.

Teach to learn. My consulting years included time to teach client teams about security. Teaching exposes every gap in your understanding. Run a lunch session, mentor a junior analyst, or brief a business unit. If you cannot explain it plainly, you do not own it yet.

Interview your future peers. Ask sitting CISOs about the first year, the board relationship and the thing they would do differently. Most will talk. Their answers will correct your assumptions faster than any guide.

Practice the one page memo. Pick a real risk and write it as a business decision: what could happen, what it costs, what you recommend, what you need. Do it monthly. Executive communication is a skill you build through repetition.

Ask about the reporting line before the salary. Who the CISO reports to, and how often the board hears from them, tells you how much influence the seat carries.

Pitfalls to Avoid

Do not collect certifications as a substitute for experience. Letters on a resume clear a filter, and then someone asks what you have run.

Do not stay in a purely technical lane because it feels safe. Technical depth is respected, but it will not carry you through the board conversation.

Do not wait for permission to lead. Take ownership of a program nobody owns. That is how directors are made.

Do not ignore the business. If you cannot explain how your company makes money and what downtime costs, you cannot prioritize risk in a way executives will trust.

Do not accept a first CISO seat without checking scope, team, budget and executive access. A title with no authority is a burnout trap.

Do not treat the path as a straight line. Moves sideways into audit, consulting or a smaller company often build the missing pieces faster than the next promotion.

Final Thought

The path to CISO is long, but it is not mysterious: learn how systems run, go where things break, build something from nothing, learn to speak for the business, and choose your seat with open eyes. Every stage rewards the people who pick up responsibility before it is assigned. Start your next two moves this quarter, because the years pass whether you plan them or not.

If this helped you place yourself on the path, share it with someone two years behind you. Subscribe to get the next post in your inbox. Leave a comment with your current stage and the two moves you are choosing. I read every one.