The people hiring CISOs are usually not security experts.

Instead, it’s the general counsel, because security reports to legal. It’s the CTO, who knows technology but not all aspects of security leadership. It’s the CFO, because security has budget implications.

Sometimes it’s even the CEO directly.

External recruiters can find candidates; they’re experts at sourcing people who meet criteria and matching skills to job descriptions. But when it comes to assessing whether a candidate will actually fit your culture, understand your specific challenges, and build the right program for your company? The recruiters can’t evaluate that, and if you don’t know security, you don’t know either.

This is why CISO hiring cycles can drag on for months. This is why companies struggle to find the right mix of skill set, experience, and cost. And this is ultimately why the eventual hire sometimes doesn’t work out despite impressive credentials.

The Credential Trap

Impressive backgrounds don’t guarantee performance.

We’ve seen candidates from prestigious security programs who couldn’t explain basic tools in depth. When asked about specifics, they gave general responses. “Wiz works on metadata.” Okay, what kind of metadata? Silence.

Many security professionals have floated through large organizations with large security teams. They contributed to something, but they quite never owned anything. They can describe participating in programs but struggle to explain how they would build one from scratch.

The credentials look right, and resume shows impressive companies. The candidate speaks the right language at a high level. But when you dig into specifics, the depth isn’t there.

If you’re not a security expert, you can’t distinguish between someone who’s seen security happen around them and someone who’s actually driven security outcomes.

What Non-Experts Can Evaluate

You may not be able to assess technical security depth, but you can evaluate other things that matter:

Business partnership ability. Does this person understand that security serves the business, not the other way around? Can they talk about security tradeoffs in business terms? Can they articulate how they would partner with your CTO, your engineering team, or your legal function?

Communication clarity. Can they explain security concepts in ways you understand? If they can’t communicate with you, then they can’t communicate with your board, your customers, or your executive team.

Program building experience. Have they built security programs, or have they worked in programs someone else built? Ask them to walk through how they would assess your current state and what the first 90 days would look like.

Adaptability. Security leaders need to pivot when business circumstances change. Ask about times when they had to change direction, stop doing things that were no longer relevant, or adapt a program to new business realities.

Honest assessment. Give them information about your company and ask what they’d prioritize. Do they give a generic answer, or do they engage with your specific situation? Are they willing to say “I don’t know” about things they’d need to learn?

The Interim Bridge

One of the most effective approaches: use an interim or fractional CISO during your search.

An experienced interim brings relevant knowledge to the hiring process. They can:

Vet candidates technically. They can probe for the depth you can’t evaluate. They know the right follow-up questions. They can distinguish between someone who’s seen things and someone who’s done things.

Define what you actually need. Before you’ve hired, you may not know exactly what skill set is right for your organization. An interim can assess your environment and tell you what kind of leader would fit.

Keep the program moving. Hiring takes time. Six months is a common duration. A year isn’t unusual. An interim keeps things progressing while you search, so you’re not losing ground.

Provide honest perspective. Interims aren’t building empires. They’re not competing for the permanent role (usually). They’ll tell you directly what you need, even if it’s different from what you thought.

The arrangement is transparent. Everyone knows it’s temporary. The interim helps you hire their replacement.

Questions to Ask

Whether you’re interviewing directly or working with an interim to vet candidates, these questions reveal more than credentials:

“Walk me through how you’d assess our security in the first 90 days.” Look for a structured approach that starts with understanding the business, not jumping to tools and controls.

“Tell me about a time you stopped doing something in security because it was no longer relevant.” This reveals whether they can adapt.

“How would you explain our security posture to our board?” Can they communicate at the executive level? Do they translate security into business risk language?

“What would you need to learn to be effective here?” Self-awareness about gaps is a good sign.

“Describe a security program you built from scratch.” The key here is a program they actually created, not just contributed to. What decisions did they make? What tradeoffs did they navigate? What would they do differently?

“What’s the most important thing we should be doing that we’re probably not doing?” Give them some information about your company and see if they can generate specific, relevant insights rather than generic advice.

Signs of Good Fit

Beyond technical competence, look for the following:

Business orientation. These are the security leaders who see their role as enabling the business, not blocking it. They understand that security investment competes with other priorities.

Communication range. These leaders can speak to engineers in technical detail. But they can also talk to executives in business terms and connect within ways that build trust.

Right-sizing instinct. This type understands that the right security program depends on the company. They are realistically not trying to build a Fortune 500 security organization at a 200-person startup.

Execution focus. Finally, these candidates have built things, not just evaluated things. They know the difference between strategy and getting things done.

The Long Hiring Cycle

Honestly, expect this process to take time. Quality CISO candidates are in demand. Finding the right fit for your specific organization, culture, and challenges narrows the field further.

Don’t rush the hire to fill the seat. A wrong hire is worse than a slow hire. Use interim leadership to bridge the gap, and take the time to find someone who fits.

The companies that handle this well accept that CISO hiring is hard, plan for a multi-month process, and put structures in place to keep security progressing while the search continues.

Hiring a CISO when you’re not a security expert is one of the hardest hires to get right. Use interim expertise, ask the right questions, and take the time to find a genuine fit.