Real CISO interview questions for first-time and seasoned CISOs — board readiness, programme strategy, incident leadership, regulatory fluency.
Walk me through your first 90 days.
Frame: listen tour (every executive, audit chair, top customers/suppliers), inherit + reframe risk register in business language, identify the top 3 risks needing immediate action, deliver a 100-day roadmap in week 12 with budget asks tied to risk reduction.
How do you talk about cyber risk to a non-technical board?
In business terms: revenue impact, customer trust, regulatory exposure, M&A diligence drag. Use scenarios, not heat maps. Quantify where possible (FAIR, ALE). Always end with 'here is what we are doing / asking for'.
You are 30 days in and your top engineer resigns. What do you do?
Diagnose: comp, role, manager, work. Counter where economically rational. If they leave: coverage plan, knowledge transfer, retention conversation with the rest of the team, accelerate hiring backfill. Treat as a leadership signal — investigate.
How do you prioritise security spend?
Risk-led: top inherent risks × likelihood × business impact, minus existing controls = residual; spend reduces residual. Map each spend ask to a board-readable risk reduction. Avoid the trap of 'we need product X because Gartner says so'.
Walk me through how you would handle a ransomware incident.
Activate IR plan. Containment first (isolate, not unplug — preserve evidence). Convene crisis team (IR, legal, comms, exec). Engage IR retainer + NCSC / law enforcement. Decide on negotiation posture early but recover from backups as default. Customer comms within 24–72h depending on materiality. Post-incident: NCSC briefing, lessons learned, board reporting.
How do you measure security programme effectiveness?
Outcome metrics, not activity. Detection MTTD/MTTR trends. Mean time to patch critical CVEs. % audit findings closed on time. Phishing simulation click-then-report. Security debt burn-down. Coverage of crown-jewel applications by controls baseline.
Tell me about a strategic mistake you made as a security leader.
Behavioural. Real, owned mistake with concrete impact, the root cause, what you changed in your operating model. Avoid 'I cared too much' tropes.
How do you handle disagreement with the CTO over a security control they see as friction?
Joint risk framing — show the cost of the control vs the cost of the residual risk. Offer a paved-road alternative (secure-by-default library) that removes friction. Escalate to CEO only if the residual is unacceptable and you cannot find compromise. Disagree-and-commit if overruled — but document the risk decision.
Explain DORA / NIS2 / FCA SYSC and how they shape your programme.
DORA — operational resilience for EU FS, incl. ICT risk, third-party concentration, threat-led pen testing. NIS2 — EU critical sectors, expanded scope, board accountability. FCA SYSC + PRA SS1/21 — UK operational resilience, impact tolerances, third-party risk. Show fluency without reciting clauses.
How do you build the security team you want to inherit in 3 years?
Define target capability map (skills × seniority × specialism). Identify gaps. Mix build (graduate scheme, apprenticeships, internal moves) and buy (key hires). Develop a leadership bench — at least 2 successors for the top 3 roles.
Have you been through a CISO transition before? What did you learn?
Behavioural for repeat CISOs. Cover handover, audit-trail of decisions inherited, what you changed in the first year, what you wished you had asked the outgoing CISO.
Why this role, why now, why us?
Show you have read the org's 10-K / annual report, the regulator's last enforcement, the recent press. Connect to your career arc explicitly.
8–16 weeks. Multiple rounds with execs, audit committee, sometimes a board member, often a case study or written submission.
Some, but at concept level. The bar is 'does this person understand enough technology to be credible to the CTO?' not 'can they write a Sigma rule?'
If asked, yes — but always conditional ('based on what I know now, here is my hypothesis'). Showing humility about what you don't yet know is the actual signal.
Coming across as deputy-CISO-shaped. Practise speaking in CEO/board cadence: business outcomes, customer impact, regulator narrative — not technical implementation.
Run AI-graded mock interviews with panel personas and structured feedback.