Evolving Expectations and Structural Constraints of Cybersecurity Leadership: A Transatlantic Longitudinal Analysis of CISO Job Advertisements
This longitudinal analysis of 720 CISO job advertisements across the DACH region and the United States reveals persistent role ambiguities, regional structural disparities, and a critical misalignment between advertised expectations and the strategic realities of the position, which collectively risk undermining recruitment effectiveness and executive integration.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Every modern organization relies on a guardian to protect its digital life: the Chief Information Security Officer, or CISO. This person stands at the intersection of technology, business strategy, and risk management, tasked with keeping sensitive data safe from invisible threats. To do this job well, they need a rare mix of skills: deep technical knowledge to understand how systems work, and strong leadership abilities to explain those risks to company executives and make tough decisions. However, there is a persistent problem in how companies hire these leaders. Often, the job descriptions written to attract candidates do not match the reality of what the role actually requires or the support the organization is willing to provide. This mismatch can leave new hires feeling confused, unsupported, and overwhelmed before they even start their first day.
A team of researchers from Munich set out to investigate this disconnect by looking at the actual job advertisements for CISO positions across two major regions: the United States and the DACH area, which includes Germany, Austria, and Switzerland. They gathered a massive collection of 720 job postings, comparing ads from 2023 with newer ones from 2026. Their goal was not just to count skills, but to see if the promises made in these ads aligned with what experts know about the pressures and responsibilities of the job. They examined everything from the required degrees and years of experience to the reporting structure—who the CISO answers to—and the budget they control. By treating these advertisements as a window into what companies truly expect, the researchers uncovered a story of evolving demands and structural contradictions that could be putting the security of entire organizations at risk.
The study reveals that while the demand for CISOs is growing, the way companies define the role is often inconsistent and sometimes contradictory. In the United States, job ads increasingly emphasize business acumen, financial management, and strategic leadership. Companies there are more likely to ask for a CISO who can speak the language of the boardroom, manage a budget, and integrate security into the overall business plan. In contrast, advertisements in the DACH region continue to focus heavily on technical expertise. While these ads also mention leadership, they place a much stronger emphasis on the candidate's ability to handle complex technical systems and specific security standards. This regional split suggests that American companies are viewing the CISO as a strategic executive, while European companies often still see the role primarily as a senior technical expert.
Perhaps more concerning than these regional differences is a structural paradox that has emerged over time. The researchers found that job advertisements are increasingly asking for more responsibility without granting the necessary authority to fulfill it. In 2026, a significantly higher number of ads explicitly stated that the CISO would have supervisory duties, meaning they would be responsible for hiring and managing a team. However, the same ads rarely mentioned that the CISO would have control over the budget needed to pay that team or buy the tools they need. It is as if a company asks a manager to build a house and hire the workers, but refuses to give them the keys to the bank account or the authority to purchase materials. This lack of clarity creates a situation where leaders are expected to deliver results but are denied the resources to do so, a dynamic that the researchers suggest leads to confusion and burnout.
The human cost of these unclear expectations is becoming harder to ignore. The study noted that while job ads increasingly demand "stress resistance" and the ability to work under pressure, they almost never explain what support systems are in place to help the CISO manage that stress. There is little mention of coaching, leadership training, or clear protocols for handling the intense pressure that comes with a cyber crisis. In fact, the ads often fail to specify if the CISO needs to be available twenty-four hours a day during an emergency, despite the fact that cyberattacks can happen at any time. This silence leaves candidates guessing about the true nature of the job, potentially leading to a mismatch between what the person expects and what the company demands.
Another critical finding involves the path to the top. For a CISO to be effective, they need a direct line of communication to the highest levels of leadership, such as the CEO or the board of directors. The researchers found that in the DACH region, job ads are more likely to specify a direct reporting line to top executives, with a significantly higher prevalence of direct reporting compared to the United States. In the US, the CISO is more often described as reporting indirectly through another department, such as the Chief Information Officer. This indirect structure can create a conflict of interest, as the person responsible for security might be answering to the very person in charge of the technology systems they are supposed to be auditing. The study suggests that this reporting arrangement can weaken the CISO's ability to speak truth to power and advocate for necessary security measures.
The data also shows a shift in what qualifications companies are seeking. In the past, job ads heavily favored candidates with purely technical degrees. By 2026, there was a noticeable shift toward valuing business degrees and extensive professional experience. Companies are beginning to realize that leading a security team requires more than just knowing how to code; it requires understanding how a business makes money and how to manage people. Yet, even as the requirements for experience and education have become more rigorous, the transparency regarding salary and resources has not kept pace. Many job ads still list vague salary ranges or omit compensation details entirely, and in the DACH region, the salaries listed often fall below international benchmarks. This lack of clarity can discourage highly qualified candidates from applying, leaving organizations with fewer options for filling these critical roles.
Ultimately, the researchers argue that the way companies write job advertisements is a signal of their organizational intent. When these ads are vague, contradictory, or fail to match the reality of the work, they set the stage for failure before the hiring process even begins. The study does not claim that every CISO faces these exact conditions, but it highlights a widespread pattern where the pre-employment promise does not align with the operational reality. To fix this, the authors suggest that organizations need to be more honest and specific in their job postings. They need to clearly define the scope of authority, the available resources, and the true nature of the challenges the CISO will face. By doing so, companies can attract candidates who are truly prepared for the role and build a foundation for effective leadership that protects both the organization and the people within it.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.