CISOs at semiconductor, manufacturing and defense-technology companies: how the role is framed

What the sources cover

The question asks how manufacturing, semiconductor and defense-contractor companies describe the CISO role. The documents supplied for this guide cover one company: Taiwan Semiconductor Manufacturing Company (TSMC). They are its executives page, its investor-site information security page, and its 2024 Annual Report, printed on March 12, 2025. None is from a defense contractor or a general manufacturer. This guide therefore describes how one semiconductor foundry frames the role. It does not compare sectors, and nothing here should be read as a sector-wide pattern.

The executives page and the information security page carry no publication date. The annual report states that it was printed on March 12, 2025.

How TSMC introduces the role

TSMC's information security page opens by tying the function to commitments. The page states: It then names the role directly. The page says:

The framing is tied to the company's mission as well. The annual report states: The report also lists "Customer Trust" among TSMC's core values. The information security page describes the function in similar terms. Its security statement is meant to state TSMC's determination to maintain its competitive advantage and to safeguard the interests of customers and business partners.

Where the CISO sits

TSMC's CISO is not described as a standalone security executive. The executives page lists the holder under an operations title. It states: The same page says he is also a deputy of Mr. Y.P. Chyn, who is Executive Vice President and Co-Chief Operating Officer. The page describes Mr. Chyn's responsibility as the operation and management of all fabs in Taiwan and overseas.

The page also gives the holder's background. It says: His listed experience includes Senior Vice President of Technology Development and Senior Vice President of Europe and Asia Sales. The executives page does not say what his security responsibilities are. The information security page covers that.

The company also lists a separate Chief Information Officer, who is a Vice President. The executives page states: The page says his responsibility spans information technology, including intelligent manufacturing, high performance computing, digital supply chain and infrastructure re-engineering. In TSMC's disclosures, then, the CISO and the CIO are two different people with different titles.

What the CISO is in charge of

The information security page describes the governance structure. It begins with the board: The page then assigns the CISO role within a dedicated organization called Global Security Management (GSM). The page says the company assigned the holder .

Reporting to the board runs through a fixed cycle. The page states: . It lists what those reports include: global information security trends, company information security policies, plans and implementation results. The page adds that the chairman of the Audit and Risk Committee reports to the Board of Directors on the effectiveness of security supervision and risk control measures.

The committees the CISO chairs

The page names two committees chaired by the CISO. The first is the Proprietary Information Protection (PIP) and Risk Committee. The page states: Its members are the Vice Presidents of Legal, Human Resources, Research and Development, and Operations, plus the highest-level supervisor of GSM. The page gives its work:

The second is the IT Security Committee. The page states: It is made up of the Vice President and Directors of Information Technology. The page says it meets monthly

Taken together, the first committee pulls in legal, HR, R&D and operations leaders, and the second pulls in IT leaders. Both are chaired by the CISO. The page describes them as the way GSM works with the company's information technology and related organizations.

Scope of the work and certifications

The page gives a list of annual focus areas. It names ten, including cyber security management, proprietary information protection, information asset inventory management and access control, software security, supply chain security, and internal and external information security assessment and risk management. One item reads . The list shows that proprietary information protection and supply chain security sit alongside conventional cybersecurity topics.

The page describes manufacturing-specific controls. It says the measures include advanced virus scanning tools to prevent a fab from installing virus-infected tools, and firewall and network controls to prevent computer viruses from spreading among tools and fabs. It also says:

On incidents, the page says TSMC has defined procedures that assign specific personnel to handle major security incidents. It adds:

On certification, the page states: It adds that The page says the certification scope covers customer design and manufacturing information from frontend to backend, including mask making and 300mm wafer production in Tainan. It also says TSMC continues to obtain ISO/IEC 15408 certifications to accelerate customers' security product launches.

What the documents leave out

The documents do not say how many people work in GSM, what the security budget is, or whether the CISO reports to the CEO. The executives page gives the CISO's title and deputy relationship to the Co-COO. The security page gives the governance structure above. The annual report's table of contents lists a section called "Information Security Management" at page 111, but the portion of the report supplied ends before that section.

For readers comparing career paths, the documents support this: at TSMC, the CISO title is held by a senior vice president with a technology development and sales background, and it sits inside the operations leadership group. The documents do not say whether other semiconductor, manufacturing or defense-technology companies frame the role the same way. Answering that would take their own disclosures.