Roadmaps Security roadmaps Governance, risk, compliance and audit
Run a security function: strategy, operating model, budgets, hiring, metrics and board reporting, from first security manager to CISO.
Estimated time: 21–42 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Your job changes from doing the work to making the team effective. Learn delegation, prioritisation and letting go of being the best technician.
Hire for potential and diversity of thinking, onboard well, give clear goals and feedback, and fight burnout. Retention beats recruitment.
There is always more to do than people to do it. Use risk, business impact and effort to decide, and say no clearly to the rest.
IT, engineering, legal, HR, finance and the business each want different things from security. Learn what each needs and speak their language.
In a crisis the team looks to you for calm, decisions and cover. Prepare your role, rehearse it, and protect the team's wellbeing afterwards.
Track what the team delivers and the risk it reduces, not hours or tickets. Use metrics to improve and to tell the team's story upward.
A strategy says what you will protect, against what, to what level, and how you will get there over several years. Tie it to business strategy.
Centralised, federated or hybrid; in-house or outsourced; where security sits in the organisation. Each shapes what you can do. Choose deliberately.
Build a budget from the strategy, justify spending by risk reduced, and manage it through the year. Learn how finance thinks.
Maturity models such as NIST CSF tiers and C2M2 show where you are and help set targets. Use them honestly; the score is not the goal.
Choose a small set of metrics that show risk reduced, control coverage and response capability, and report them consistently over time.
Most security functions buy tools and services. Learn to select, negotiate, manage and exit them without being captured by them.
Boards want to know the top risks, whether the programme is adequate, and what decisions they need to make. Learn their language and their concerns.
Incident disclosure rules, regulatory relationships and personal liability now shape the CISO role. Work closely with legal and know your obligations.
Position cyber alongside the other enterprise risks, with appetite, quantification and ownership by the business, not just by security.
The CISO controls little directly. Progress comes from relationships, credibility and making security part of how others succeed.
A major breach tests the whole organisation. Lead the response, the communications and the recovery, and be ready for scrutiny afterwards.
AI, cloud and new regulation change the risk picture fast. Keep the strategy adaptable and the team learning.
Accountable for security across the organisation, often with limited authority and high personal exposure. Define the role, its reporting line and its support.
Build the next generation of security leaders deliberately: stretch roles, mentoring and honest feedback. Your legacy is the people you grew.
Share what you learn, contribute to standards and communities, and help raise the baseline beyond your own organisation.
Security leadership turns technical capability into an organisation-wide programme: deciding what to protect and how much to spend, building and running teams, measuring progress and representing security to executives, boards, regulators and customers.
The path runs from leading a team to running a programme to being the CISO. It needs business understanding, communication and judgement under uncertainty as much as technical depth, and the ability to make trade-offs that no framework will make for you.
Security programmes fail from poor leadership more often than from poor tools. Organisations need leaders who can set direction, win resources, keep teams, and give boards an honest picture of risk.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact