Skip to content
CISO Spotlights

Glossary

What is a head of security? The title versus the CISO, defined

Head of security is the title for whoever leads an organization's security team. How it compares with CISO in scope, authority and seniority, and how to read it.

Term: Head of security · also head of information security, security lead

By the CISO Spotlights Desk · Published · 4 sources

Head of security is a job title for the person who leads an organization's security function, used most often where there is no C-level security seat or where the role sits below the executive team. The title says who leads the team. It does not by itself say whether the holder has the scope, authority or board access of a chief information security officer (CISO).

Title versus function

Federal workforce guidance separates the work from the label. The NICE Framework, developed by NIST and published through CISA's NICCS portal, states that its work roles are not synonymous with job titles. It describes a Systems Security Management role, responsible for managing the cybersecurity of a program, organization, system or enclave, and a separate Executive Cybersecurity Leadership role that sets vision and direction and holds authority over decisions affecting the whole organization. A head of security can be doing either.

Labor statistics point the same way. The Bureau of Labor Statistics entry for computer and information systems managers says job titles vary with an organization's size and structure, and that some of these managers run one area, such as cybersecurity, rather than a whole department.

How to read the seniority

Three facts say more than the title. The first is the reporting line: a head of security who reports to the chief executive or briefs the board is doing executive work. The second is remit, whether it covers policy, budget and incident decisions or one technical program. The third is disclosure. Item 106 of Regulation S-K asks public companies which management positions are responsible for cyber risk, not which titles, so a 10-K can name a head of security as the accountable executive.

How cisospotlights.com files it

Profiles keep the title exactly as the source gives it. For the path studies, a head of security counts as holding the top seat only when the source shows the role was the organization's top security job, the same test the site applies to every equivalent title. When the source shows the head of security reported to a CISO, the role reads as a step before the seat, not the seat itself.

Where it appears on cisospotlights.com

Related terms

Security leadership titles, chief security officer and fractional CISO.

Sources

  1. 1.
    CISA NICCS, NICE Workforce Framework for Cybersecurity (components v2.2.0)niccs.cisa.gov · published 14 July 2026 · tier A
  2. 2.
    CISA NICCS, NICE Framework Work Role: Executive Cybersecurity Leadershipniccs.cisa.gov · published 19 October 2026 · tier A
  3. 3.
    U.S. Bureau of Labor Statistics, Occupational Outlook Handbook: Computer and Information Systems Managersbls.gov · published 27 August 2026 · tier A
  4. 4.
    U.S. Securities and Exchange Commission, Regulation S-K Item 106 (eCFR)ecfr.gov · published 4 August 2023 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

Cite this definition as “CISO Spotlights glossary” with a link to this page. See an error? Request a correction.