Is the CISO Role Now the Least Desirable Job in Business? Here’s What You Need to Know

Picture this: You’re a senior leader with a seat just outside the boardroom. You’re responsible for warding off relentless cyber threats, ensuring compliance with a maze of regulations, and shouldering the weight of enterprise risk—all while lacking the authority to enforce real change. The phone never stops ringing. The pressure never lets up. And even if you do everything right, you’re the first in the firing line if something goes wrong.

Welcome to the world of today’s Chief Information Security Officer (CISO).

Over the past few years, the CISO role has gone from a quietly vital back-office function to a high-profile, high-risk, and—some would argue—highly undesirable position. But is it really the least desirable job in business? Or is it just misunderstood, undervalued, and in desperate need of a rethink?

Let’s dig into the real story behind the CISO’s crisis, demystify the causes of record-high burnout, and explore what needs to change if organizations want to attract and retain top cybersecurity talent.

The CISO Paradox: Outsized Responsibility, Limited Authority

Let’s start by addressing the elephant in the server room. The CISO today bears enormous responsibility: protecting the company from cyber threats, ensuring compliance with increasingly complex regulations, and even certifying the organization’s cybersecurity posture. But here’s the rub—they often lack the resources, reporting lines, and authority to make real, systemic changes.

Imagine being asked to plug every leak in a ship while only controlling half the valves. That’s the daily reality for many CISOs.

Why the Reporting Structure Is a Game-Changer

A significant pain point for CISOs is their place in the organizational chart. Too often, they report to the CTO, CFO, or even further down the hierarchy—far from the decision-makers. As George Gerchow, veteran CSO and CISO, puts it:

“I’ll never report to a CTO or CFO again. I have to have a seat at the table.”

Without direct access to the board or CEO, CISOs are forced to play a game of telephone—translating urgent security risks through layers of management who may not share the same priorities. This disconnect leaves CISOs structurally underpowered to tackle the very risks for which they’re held accountable.

The Accountability Trap

Recent regulatory changes—including the EU’s Digital Operational Resilience Act (DORA)—and a steady stream of high-profile breaches have shifted the spotlight onto CISOs. In some cases, they’re now required to personally certify the organization’s security posture. Any slip-up? The legal and reputational consequences fall squarely on their shoulders.

It’s a textbook case of maximum accountability, minimum authority—a recipe for frustration, burnout, and rapid turnover.

Burnout and Turnover: The Human Cost of a Broken System

Stress Levels That Break Records

Let’s get real. Being a CISO is not just stressful—it’s a pressure cooker. According to a Nominet survey, a staggering 91% of CISOs report moderate to high stress levels. Many describe the job as a never-ending game of dodgeball, with new threats coming from every direction.

“The job involves a perpetual cycle of stress, knowing a cybersecurity incident could hit anytime.”
— Corey Nachreiner, CISO/CSO at WatchGuard

The Great CISO Exodus

The data points to a worrying trend: Senior security leaders are leaving their posts at record rates. Industry insiders like Gerchow and Korn Ferry’s Maggie Myers observe that burnout and a perceived lack of support are driving more CISOs to exit the field or shift into advisory roles.

Key reasons for CISO burnout and turnover: – Mismatched responsibility and authority – Lack of formal legal protection and indemnification – Insufficient budget and resources – Cybersecurity seen as a cost center, not a business driver – Poor succession planning and support from leadership

Real-Life Fallout

The consequences of this churn go far beyond the individuals. High turnover at the CISO level weakens organizations’ security posture, disrupts continuity, and makes it even harder to recruit qualified talent for these mission-critical roles. In sectors like finance and healthcare, the stakes are especially high.

Regulatory Overload: When Compliance Becomes a Crushing Burden

The regulatory landscape for CISOs has never been more complex. New laws and frameworks—from DORA to the SEC’s cyber disclosure rules—are piling on responsibilities, often with little additional support.

Let me break it down: – Personal Liability: Some regulations require CISOs to personally certify compliance, putting their reputations—and even their freedom—on the line. – Ambiguous Guidance: The expectations are high, but what “sufficient” security looks like is often left vague, creating risk for CISOs no matter what they do. – Resource Gaps: The mandates grow, but budgets don’t. As a result, CISOs must do more with less.

Here’s why that matters: When a CISO is tasked with meeting ever-increasing compliance demands but isn’t given the power or resources to achieve them, it’s not just unfair—it’s unsustainable.

The CISO Paradox: All Risk, Little Reward

Let’s call it what it is: The CISO paradox. The role has never been more critical to the business—yet it’s never felt so fraught with risk and ambiguity.

Why Is Cybersecurity Still Seen as a Cost Center?

One of the most demoralizing aspects for CISOs is that, despite the existential threat posed by cyberattacks, many companies still treat information security as a “necessary evil.” Security budgets are the first to face the axe in tough times, and business leaders may resist security initiatives that don’t deliver a clear, immediate ROI.

Here’s an analogy: Imagine being in charge of fire safety for a skyscraper, but your budget can only cover a few smoke detectors and some fire drills. Everyone hopes the building never burns—but if it does, you’re the one held responsible.

Lack of Collaboration: The “Herding Cats” Problem

Security isn’t just a technology issue—it’s a people issue. CISOs need buy-in from every department, but motivating employees to prioritize security often feels like…well, herding cats. When collaboration is lacking, morale plummets and risk multiplies.

Is It a Position Problem, or a People Problem?

Some experts argue that burnout and high turnover aren’t unique to CISOs—they’re a symptom of poor organizational health. As Patricia Titus, former CISO and now field CISO at Abnormal AI, points out:

“The regulatory scrutiny has been there all along. … Regulators may be getting smarter and asking more direct questions. But we’re not doing a good job of balancing. That to me is a human problem versus a position problem.”

What does that mean in practice?
– Burnout is exacerbated by a lack of support, unclear roles, and bad leadership. – Good succession planning, shared responsibility, and a culture of collaboration can make the CISO role more sustainable. – Elevating the CISO to a true C-level role—with board access and authority commensurate with responsibility—can help.

Titus puts it simply: “The CISO job of 20 years ago is gone. It’s an evolving field and position.”

The Path Forward: How to Make the CISO Role Sustainable (and Desirable Again)

Despite the daunting challenges, the CISO role doesn’t have to be the least desirable job in business. In fact, with the right changes, it can become one of the most exciting and impactful positions in the C-suite.

1. Elevate the CISO’s Status and Authority

Direct Reporting to the CEO or Board: Give CISOs a genuine seat at the table so their insights and recommendations carry real weight.
Clear Mandate: Define the scope of the CISO’s authority and ensure it matches their accountability.
Inclusion in Strategy: Involve CISOs in broader business decisions, not just IT.

2. Provide Legal Protection and Professional Recognition

Formal Indemnification: Protect CISOs from personal liability for good-faith decisions.
Professional Associations: Support industry groups like The Professional Association of CISOs (PAC) that provide accreditation, peer support, and ethical standards.
D&O Insurance: Ensure CISOs are covered under directors and officers liability policies.

3. Resource the Role Appropriately

Sufficient Budget: Cybersecurity must be funded as a strategic priority, not an afterthought.
Build Strong Teams: Invest in talent, training, and tools so CISOs aren’t fighting alone.
Succession Planning: Develop internal talent pipelines to prevent burnout and ensure continuity.

4. Foster a Culture of Shared Responsibility

Cross-Departmental Collaboration: Make cybersecurity everyone’s job, not just the CISO’s.
Executive Sponsorship: The board and CEO must publicly support security initiatives.
Continuous Education: Empower all staff with regular, engaging security training.

Silver Linings: Why Some Still Love the CISO Role

It’s not all doom and gloom. For those with the right mindset, being a CISO is an opportunity to drive real change, learn constantly, and play a central role in business resilience.

“If you thrive in an environment where your curiosity is never satisfied, you’re always thinking a step ahead, and every day is different, the CISO role remains ideal.”
— Patricia Titus, Abnormal AI

Corey Nachreiner sums it up:

“Realizing that the CISO role is more human-centric and political than technical is key. It’s not just about wizardry with network defenses; it’s convincing the board to greenlight projects, rallying department heads, and nudging employees to tweak their everyday habits.”

For those who embrace these challenges, the CISO job can be deeply rewarding and meaningful.

What’s Next? The Future of the CISO Role

There’s no doubt: The stakes for CISOs have never been higher. But with thoughtful reforms—clear authority, legal protections, adequate resources, and cultural change—the role can be rehabilitated. In fact, as cyber risk becomes a board-level issue, organizations that treat their CISOs as true partners will have a major edge.

As Amit Basu, VP, CIO, and CISO of International Seaways, puts it:

“The CISO role is not becoming undesirable because it lacks relevance. On the contrary, it is vital to the future of enterprise trust and resilience. It is undesirable only when we fail to match responsibility with protection.”

In other words: If we want to safeguard our organizations in an era of relentless cyber risk, we must also safeguard those entrusted to lead the charge.

FAQs About the CISO Role

1. How does personal liability impact CISO career choices?
Personal liability is a growing concern for CISOs, especially as regulations increasingly require them to certify cybersecurity controls. The fear of legal action or personal financial loss is causing some CISOs to leave their roles or avoid operational positions altogether. Learn more about CISO liability.

2. How do increasing regulatory demands affect the CISO role?
New regulations like DORA and the SEC’s cyber rules increase the job’s complexity and accountability, often without providing clear guidelines or extra resources. This leads to higher stress and greater risk for CISOs.

3. What percentage of CISOs experience high stress or plan to leave?
Surveys consistently report that over 90% of CISOs experience moderate to high stress. Some studies indicate nearly half of CISOs are considering leaving their current role within the next two years due to burnout.

4. What are the implications of the CISO paradox?
The CISO paradox—maximum accountability, minimum authority—results in high burnout and turnover, degraded security postures, and difficulty recruiting top talent. Addressing this paradox is essential for organizational resilience.

5. Why is cybersecurity often viewed as a cost center?
Many organizations see cybersecurity as an expense rather than a value driver because its benefits are preventive and not immediately measurable. Shifting this perspective requires ongoing education and strong leadership.

Final Takeaway: Redefining the CISO Role for the Modern Era

The CISO job is at a crossroads. It can be a high-stress, thankless position—or it can become the linchpin of enterprise trust and innovation. The difference lies in how organizations empower, support, and protect their cybersecurity leaders.

For companies serious about resilience, the path forward is clear:
– Elevate the CISO’s authority and visibility. – Match responsibility with resources and legal protection. – Treat cybersecurity as a strategic enabler, not a check-box exercise.

By making these changes, organizations can turn the CISO role from a revolving door into a destination for the best and brightest in security leadership.

Want to keep up with the latest in cybersecurity leadership? Subscribe for more expert insight and actionable advice. Your security—and your peace of mind—depend on it.

Image Credit: Jacob Lund / Shutterstock

Discover more at InnoVirtuoso.com

I would love some feedback on my writing so if you have any, please don’t hesitate to leave a comment around here or in any platforms that is convenient for you.

For more on tech and other topics, explore InnoVirtuoso.com anytime. Subscribe to my newsletter and join our growing community—we’ll create something magical together. I promise, it’ll never be boring!

Stay updated with the latest news—subscribe to our newsletter today!

Thank you all—wishing you an amazing day ahead!

Is the CISO Role Now the Least Desirable Job in Business? Here’s What You Need to Know

The CISO Paradox: Outsized Responsibility, Limited Authority