Hotline: Cybersecurity and Privacy | November 2026

Twelve Years and Holding

Dear Hotline: I've worked in cybersecurity at a major research university for twelve years, but I still can't seem to get a CISO job. I rarely even get an interview. I recently attended the EDUCAUSE conference in Denver and met plenty of CISOs who, honestly, didn't seem as qualified as I am. I'm frustrated and can't figure out what I'm missing. What do I need to do to get my career moving and land a CISO role?

Stuck in the Boondocks

Dear Boondocks: This couldn't be a timelier question, and it's one I've heard often from colleagues and mentees. In fact, it's a question that echoes through the halls at conferences such as the EDUCAUSE Cybersecurity and Privacy Professionals Conference and the EDUCAUSE Annual Conference. Thus, I'm devoting the entire column to it this month.

Given the steady drumbeat of news items claiming there are hundreds of thousands of open cybersecurity positions, one would think we'd be getting random text messages offering us CISO roles three times a day.^Footnote1 Before I offer my advice, I reached out to some colleagues for their input. Your ad hoc panel of peers consists of Cheryl Washington, Leo Nelson, and Stacy Cahill, all experienced CISOs who have faced the very challenge you're asking about.

Cheryl Washington, CISO at the University of California, Davis, told me that building and leveraging a professional network is essential. "You may believe you're ready for a CISO job, but getting someone more experienced to look at your résumé and discuss what it means to take on the CISO role is essential," she explained. "Maybe you are ready and just need to raise your game in how you present yourself. Or maybe you're not as ready as you think."

This isn't just a question of presentation. In an era of AI-polished résumés, that part is easy. What your résumé tells a recruiter or committee about your readiness for the role is much more difficult to get right.

Leo Nelson, CISO at Villanova, expressed a similar view: "I understand the frustration, but from my perspective, readiness involves much more than technical expertise or years of experience. It includes earning trust, developing people, navigating difficult tradeoffs, and connecting security to teaching, research, and the university's mission. A conference conversation may not reveal those strengths in someone else. Since you're rarely getting interviews, consider a personal brand audit and ask a trusted CISO or executive recruiter (hat tip to the folks at Leadership Lounge) to candidly assess you and your résumé against the roles you're pursuing. Make sure it shows leadership outcomes: priorities you established, partnerships you built, people you developed, and institutional risks you helped address. Where you have gaps in budgets, strategy, governance, or personnel leadership, be the first person to raise a hand or seek opportunities to build that experience.

"The right mentors can help you identify those gaps, challenge your assumptions, and recognize opportunities you might overlook," Nelson continued. "There were many in my own security and privacy career who made a difference by advocating for me in rooms I wasn't in. That's where mentorship becomes sponsorship: someone who knows your work and judgment is willing to put their credibility behind you. Those relationships grow through trust, follow-through, and openness to honest feedback. Alongside strengthening your application, invest in relationships with people who can help you grow and speak to your readiness when opportunities arise."

Stacy Cahill, CISO at the University of Maryland, Baltimore County, offered some very practical, tactical advice. "One of the most interesting aspects of the CISO role is how much it varies across organizations," she said. "In some organizations, the role leans heavily toward governance, while in others, it is strictly technical or focused on business enablement and transformation.

"I think one area that can truly set candidates apart when applying for a CISO position is not just stating what they have accomplished but also demonstrating how they managed risk while pursuing those accomplishments. For example, if the candidate includes a bullet around an effort to reduce vulnerabilities at an organization, they should consider including how they approached and prioritized the remediation to provide the recruiter with helpful insight into their risk management approach."

This is terrific advice. Demonstrating that you're solving a real problem and not just operating technology is precisely what differentiates leadership from operations.

Essentially, there are three dimensions to consider in your search:

• Readiness: Do you have the skills and experience to perform the job?
• Fit: Does the institution want your particular background and leadership style?
• Circumstance: Does the search committee favor an internal candidate, someone who would provide continuity, or someone who would bring an outside perspective?

Much of what my colleagues have touched on concerns readiness: professional networking, finding mentors who can also serve as sponsors, demonstrating strategic thinking, and doing some soul-searching not only about your readiness but also about what you're really looking for.

Too many people view years of experience as a kind of civil service qualification. They think, "I've put in my time; now I'm ready to be the boss and make big decisions." But the CISO role in 2026 is not the same as the CISO role in 2003. The position is no longer just the director of cybersecurity operations; it is an executive partner to the CIO. While I'd like to believe my technical skills have kept up with the times, I know they haven't—and that's not relevant. They're sufficient to ground me in conversations with technical staff and allow me to communicate with nontechnical leaders. So ask yourself whether your twelve years of experience have trained you to lead information security in all its dimensions or have made you one fine security engineer.

Fit is perhaps the trickiest dimension to assess because hiring outcomes are often unpredictable. Finding a new position isn't simply a version of Tetris—fitting the right shapes together. Hiring is idiosyncratic. Search committees can be capricious. While some search committees long for a new outside perspective, many others are more comfortable hiring from within. If the outgoing CISO has been successful, is the committee looking for continuity over invigoration?

Worse, campus leaders often aren't completely honest with themselves about what they're looking for. Nearly every conversation I've had with leadership teams as they're putting together a CISO search has focused on executive partnership and strategy development. Yet many of those same teams still expect the CISO to run every incident and spend far too much time with "hands-on-keyboard" activities. It's as if they want a transformational leader as the CIO who also installs Windows updates.

Let's not forget that sometimes we drive the bus, and sometimes we're just along for the ride. Some circumstances are beyond our control. The economy is also affecting your search. A quick search gave me estimates of between ten thousand and twenty thousand security jobs being cut from corporate America in the last two years.^Footnote2 That means you're now potentially competing with a new pool of individuals, not merely people from higher education.

Circumstances aren't driven solely by the institution or the job market. They're also influenced by the constraints you're willing, or able, to accept. One constraint I've seen play a major role in many careers is geographic mobility. Are you prepared to move? For those of us working in large urban areas, "moving" may mean getting off at a different subway stop. For people who work at a larger state college or university, changing jobs can mean leaving the region. This is often an underappreciated source of inertia.

Speaking from personal experience, I chose to leave a state school to enable some career advancement. But leaving meant leaving friends—and a pension system—behind and moving to a far more expensive area. In fact, I did this twice. Was it worth it? Absolutely. Was there a cost to it? Absolutely. Spending another ten years in that original pension system would have been financially wise. But living on both coasts, making new friends, and, of course, working at multiple institutions have been invaluable experiences.

Having considered readiness, fit, and circumstance, what else can you do to improve your prospects? First, let me thank my ad hoc panel for their sage advice. I'll finish by giving you, dear Boondocks, a few homework assignments.

• Decide what type of position you're qualified for and interested in. If it's truly a security executive position you want, talk to your current manager about how you can get exposed to that layer of activity. For me, that opportunity came when I was asked to lead a major policy development effort to unify three campuses under a single policy. It was definitely a trial by fire.
• Rewrite your résumé around executive outcomes, not technical tools. For example, replace "Managed Palo Alto firewalls and CrowdStrike EDR" with "Partnered with the vice president for research to establish governance for federally compliant research enclaves."
• Get a candid brand audit. Ask a current CISO, CIO, or executive recruiter to read your résumé and tell you what story it actually tells.
• Decide if you're willing to move. If you aren't willing to pack up and leave your regional pension bubble, recognize that your job market isn't all of higher education—it's a fifty-mile radius.

Whatever you do, don't lose hope. The job market is highly competitive, often influenced by chance and not always fair. Focus on creating the conditions that maximize your competitiveness, while removing barriers within your control. You can't control the search committee, the applicant pool, or whether campus leaders agree on what they want from the role. You can control whether you're ready, whether you can articulate your value, and whether you're willing to pursue the opportunities that will get you there. Do those things well, and you'll give yourself the best chance to move forward instead of staying stuck in the boondocks.

Notes

1. I once tried to track down the provenance of all of these claims about the vast number of open cybersecurity positions. As far as I could determine, they all seem to trace back to CyberSeek's "Cybersecurity Supply/Demand Heat Map." The statistics, if true, are astonishing. However, I wonder how much of this narrative is driven by those offering certifications or boot camps; i.e., those who can profit from it. Jump back to footnote 1 in the text.↩
2. My estimates are derived from sources such as "Tech Layoff Tracker," TrueUp; and "Complete List of Recent Cybersecurity Layoffs," Usearch.. Jump back to footnote 2 in the text.↩

---

Michael Corn is an Executive Strategic Consultant at Vantage Technology Consulting Group.