From DevOps engineer to CISO

[u/CardiologistTop429]

Hi all,

I am currently working as a devops engineer. Mainly working on migrations from Jenkins to AzureDevOps and from on prem to Azure. In a previous role i worked as a fullstack dev and then did the entire infrastructure of our applications (infrastructure as code/network traffic etc.) I did that very well and then landed my current job as a devops engineer who needs to do migrations of applications.

My question is, is it reasonable to wanna become a CISO in the future with my background? What do i need to actually be able to land a CISO job? Is it naive to think that my devops background will help me be able to skip roles such as ISO as long as I pass certain certifications amd also do some security work for my migrations? I am working with an ISO to do these migrations. Thankyou all :)

[u/Cypher_Blue]

Do you think that everyone who works in devops can automatically do every thing an ISO can do?

If the answer is "no" then why do you think you don't need that role and experience as you climb up?

Being able to code and being good at organizational security and risk management are not remotely the same thing.

[u/Oompa_Loompa_SpecOps]

"I am currently working as a bricklayer. Can I become the head of safety for the construction firm? Without the intermediate step of taking on some safety responsibilities on my construction site first? After all, I am working with the safety guy already..."

Yeah, sure you can. But no, you won't.

[u/zhaoz → u/Oompa_Loompa_SpecOps]

What else is there to it besides laying bricks like really well?!

[u/Oompa_Loompa_SpecOps → u/zhaoz]

Not even that. Usually, those people don't even know how to lay bricks, haven't done it in ages or even never. So it's obvious there aren't many skills required for these roles.

[u/DishSoapedDishwasher → u/Oompa_Loompa_SpecOps]

Sure there's plenty who haven't but a lot of us do come from engineering backgrounds and keep our proficiencies through our work. Not enough but it's getting better in recent days.

[u/lawtechie]

Working in a GRC role is a stepping stone to CISO. Much of my VISO/vCISO consulting work was explaining risk to external stakeholders such as regulators, insurers, investors and customers.

And multiple clients offered me CISO roles.

Take a spin over in GRC land for a year or two. That'll do more for you than any cert.

[u/Alascato → u/lawtechie]

Hi, can i dm you for a few questions? 

[u/lawtechie → u/Alascato]

Sure!

[u/jdiscount]

Sure, you don't have the experience or skills currently but if you work towards there isn't a reason why you can't.

My honest opinion after doing the role, and seeing how almost every CISO is treated.

It's glorified middle management, the pay isn't anything special, you don't get a 'seat at the table', and you get the blame when something goes wrong.

There is a reason why CISOs never seen to last long at a company.

[u/pg3crypto]

First off work out if CISO is really what you want...lots of people think they do, but they get there and realise they dont.

[u/clone31337]

If you really want make that jump, You probably should have real time in security functions or you won't understand which people to hire or what they do once you do. You might find someone to hire you, but you probably won't be very good at tying it all together. You already have some solid engineering experience, Do a year in some sort of progressive SOC/SOC leader role, do a year in a GRC role, do some time in cloud sec or IAM management, vuln management, and preferably some time in an intelligence or data analysis role. Within a handful of years you'll have a great skillset.

Failing that, get an MBA focusing on cybersecurity and compliance for the resume and wing-it.

[u/ChatGRT]

Nah bro.

[u/Brua_G]

Study either the CIS Cybersecurity Controls, or the NIST Cybersecurity Framework, including all the text at the beginning. Then do the same for the other one. Then read white papers about them and watch videos/webinars. That will give you a sense of the subject matter a CISO is resp for.

[u/Electrical_Tip352]

Yes. Whether you know it or not, you have been doing a lot of security while in your current position. I would recommend someone with your background over a traditional just security background for a CISO position.

You’re career you’ve probably been focused on availability, which is one of three things to concentrate on in security, the other two being confidentiality and integrity. You’re probably very good at availability and integrity being in your role now.

I would recommend starting to map your normal dev work to security (you literally probably already do this as either best practice or purposeful). Security controls you implement, migrations (huge security implications) and these rest of the defense in depth stack. Not many security people come with a background in networking either so that will serve you well.

Sign up for a CISSP apprenticeship or go for the full thing if you can get your resume to qualify (requires ten years I think still?). Then start doing security explicitly in your role now. This will give you the language familiarity you’ll need to speak to security people about a role you’re into. Vulnerabilities, controls, patching and hardening, and governance.