Chief information security officer: salary, day rates & demand.
A chief information security officer sets information security priorities and helps the business decide with the risks in view. What the role contains varies with the activities, the maturity of the organisation and the teams already in place. Establishing governance, coordinating a remediation programme and holding a part-time function are not the same commitment. The budget has to account for the autonomy and the relationship with senior management as much as for technical knowledge. A good brief names the assets to protect, the decisions delegated and the delivery expertise available, and separates security leadership from the technical work given to other specialists.
Key figures
Apec · Responsable sécurité informatique F/H · See source and scope
down 8,2 points year on year · national average 43.8 %
Information systems experts and consultants
France Travail, BMO survey 2026
In short
- What they do
- Ranks security risks, decides what gets treated and in what order, and makes those trade-offs legible to the leadership.
- When you call on them
- Governance to build, a remediation programme to coordinate, or a function to hold on a part-time basis without recruiting.
- What moves the price
- The scope of activities and systems, the maturity of the organisation, the decisions delegated, and how much delivery is kept in-house.
- Related roles
- Operational security manager, security architect, data protection officer, chief information officer.
The role
Role
A chief information security officer carries information security as a governance function, not as delivery work. They set priorities from the risks, connect them to the resources available, and make the trade-offs legible to the leadership. What the role contains varies with the organisation's activities, its maturity and the teams already in place: the same title covers very different commitments, and that scope — more than the size of the organisation — is what describes the job.
Responsibilities
Establish and maintain the security policy across the agreed scope. Run the risk analysis, then derive an order of treatment and a timetable from it. Take the decisions and the residual risks to the leadership. Coordinate the remediation workstreams without standing in for the teams that carry them out. Organise incident response and the review that follows. The boundary matters: deciding what an organisation treats, and treating it, are two different commitments.
Skills
Technical
- Risk analysis (EBIOS RM)
- Information security policy
- Incident management
- Business continuity and recovery
- Compliance (NIS 2, GDPR)
- Raising awareness across teams
Tools
- Risk dashboards
- SIEM and monitoring tools
- Maturity frameworks
Certifications
- CISSP
- ISO 27001 Lead Implementer
Typical paths
Routes into the role come from technical expertise — networks, systems, operational security — moving towards governance; from IT leadership widened to security; and from audit, internal control or compliance. Progression leads towards broader scopes, a group-level function, or a succession of part-time assignments. A certification establishes a body of knowledge, not the authority to arbitrate: what someone has actually decided, and what changed afterwards, places their experience better.
What moves the budget
Security scope
Identify the activities, the systems, the data and the entities in scope, and the decisions to be taken.
Organisational maturity
Describe existing governance, available teams and work already underway.
Engagement type
Distinguish ownership of the function, programme support and specialist expertise.
Apec · Responsable sécurité informatique F/H · Salaried role · all experience levels · Fixed and variable pay; all experience levels. Checked September 2026; period and sample unspecified. This salary is not a day rate.
A typical assignment
Scoping
Scope, assets to protect and delegated decisions agreed with the leadership.
Assessment
Risks, measures already in place and workstreams already under way.
Plan and trade-offs
Priorities, resources and timetable taken to the committee.
Delivery and follow-up
Workstreams steered and reported back to the leadership.
Illustrative example, no client reference.
For companies: three situations to discuss at interview
| Situation | What to discuss |
|---|---|
| An incident occurs during the assignment | How they separate the immediate response from the underlying workstream, and what they take to the leadership without waiting |
| Security spans several teams | How they arbitrate between priorities held by different managers, and what they do with the disagreements |
| The budget does not cover everything | What they base the order of workstreams on, and how they word the residual risk being accepted |
To prepare before the conversation
- The activities, systems and data to protect.
- The governance in place and the teams that can be called on.
- The decisions delegated to the CISO and those that stay with the leadership.
- The technical work entrusted to others.
Your questions about the CISO role
Are a CISO and a cybersecurity specialist interchangeable?
Not automatically. The CISO holds a governance and coordination role that needs a defined scope. Specialist technical expertise may contribute without involving the same decisions or responsibilities.
How should a part-time CISO be budgeted?
Define the scope, the availability, the working days and what happens to requests outside the schedule. Cost is built on those commitments: a simple fraction of a permanent role does not always describe the need.
What salary range is useful for a CISO?
The range of €40,000–€80,000 gross per year covers 80% of advertised salaries, including fixed and variable pay. It refers to information security leadership, including roles known in France as RSSI. Organisational maturity, available teams and the extent of delegated responsibility help refine the comparison.
Can a part-time CISO commit the organisation?
It depends on what is delegated to them, and the contract has to say so. A part-time function can carry trade-offs and present them to the committee; decisions that commit the organisation durably stay with the leadership. That division is settled at scoping, not when a decision comes up.
Is a CISO needed when a provider already handles security?
A provider carries out work within a contractual scope; it does not decide the organisation's priorities or the risk it accepts. The CISO carries those trade-offs and checks that what is delivered matches what was decided. The two roles add up more often than they replace one another.
How long before security governance has an effect?
The first trade-offs are made within a few weeks, the time it takes to establish the assessment. The measurable effects of a remediation programme are counted in quarters, because they depend on the teams carrying it out as much as on the plan.
Related roles and pages
Sources
- Apec · Responsable sécurité informatique F/H · checked on 18 September 2026