Now that President Bush has given the thumbs up to the U.S. Department of Homeland Security (DHS), one might expect corporate America to start hiring security experts like mad. But they’re not. In fact, despite all the attention lavished on security during the past 18 months, the number of companies actively looking to fill CSO/CISO positions has remained steady.
What’s holding them back, you ask? According to executive recruiter Marc Lewis, the two fundamental barriers to more CSO hires continue to be the paucity of qualified candidates and the lack of clarity about the CSO role and responsibilities.
“Right now there’s still more talk than action,” Lewis said. “That’s partly due to the fact that a lot of physical security experts haven’t been able to absorb the challenges of information security fast enough to become viable candidates for CSO jobs.” In the case of CSO candidates, the dearth of experience runs both ways. Companies that are focusing their search on individuals with information security backgrounds are finding that very few candidates are also suited to managing the physical side of the security equation.
Lewis said he’s seen companies search specifically for a candidate with expertise in IT security but then hand the person responsibility for physical security after he is in the door – not a recipe for success. He’s also watched as reporting structures have shifted like sand in a stiff breeze. “It’s very common for CSOs who were supposed to report to the CIO to end up reporting to the COO after being handed responsibility for physical security,” he said.
Of course, certain industry sectors have taken a more active approach to CSO hiring, such as airlines, financial services and pharmaceuticals, many of whom had significant investments in security prior to 2001.
As for major corporations that are still dragging their feet, the only thing that will get them to pick up the pace is direct personal or corporate experience with an actual or potential security threat, Lewis said. Even having a federal security organization won’t change things immediately. “It’s going to take several years for the new DHS to become more rooted before companies realize they have no choice but to shore up their own security infrastructure,” he said.