Appointing a permanent CISO is a board-level decision. The CISO determines how your organisation handles cyber risk, reports to the executive team or board and, under NIS2 and DORA, is increasingly part of formal governance. The strongest candidates rarely respond to job adverts; they are employed and need to be approached. That is why organisations work with a specialist headhunter for this role. MVPeople Group is a hyper-niche cybersecurity recruitment firm based in Amsterdam. Through our MVPermanent label we run executive search for CISOs, Heads of Information Security and Deputy CISOs. This page is about hiring a permanent CISO. If you need someone to step into the role at short notice, see interim CISO at /expertise/ciso.
In short
CISO executive search is a targeted, confidential search for a permanent Chief Information Security Officer in which candidates are approached directly rather than responding to an advert. MVPeople Group runs CISO executive search in the Netherlands through MVPermanent; if you need a CISO on a temporary basis, MVPeople provides interim CISOs.
Executive search is a recruitment method for senior roles in which the firm maps the market and approaches candidates personally. Unlike standard recruitment, you are not limited to whoever happens to be looking. The aim is to find the best available person for your situation, even if they were not considering a move.
For a CISO role, that means a focused search for security leaders with the right combination of experience: sector, organisation size, regulation and the stage your security programme is at. A CISO who can run a mature programme is a different profile from someone who has to build a security function from scratch.
Discretion is often essential, for instance when the current CISO is leaving and this is not yet public, or when the role is part of a wider reorganisation.
An interim CISO fills the role temporarily: to bridge a vacancy, set up a programme or restore order quickly after an incident. An interim CISO can often start within 2 weeks. We provide this through MVPeople; see /expertise/ciso and /services/mvpeople.
A permanent CISO builds for the long term: a multi-year security strategy, an in-house team, a working relationship with the board and regulators, and a culture in which security is taken for granted. That calls for a different type of candidate and a different hiring process.
The two are not mutually exclusive. Many organisations bring in an interim CISO while the executive search for the permanent CISO runs. The role stays covered and the permanent successor receives a clean handover.
The NIS2 Directive, implemented in the Netherlands through the Cyberbeveiligingswet, places responsibility squarely with the board. Management bodies of essential and important entities must approve cybersecurity risk management measures, oversee their implementation and follow training themselves, and they can be held liable for infringements of those obligations.
For financial entities, DORA states that the management body bears ultimate responsibility for managing ICT risk. In both cases the board needs someone who turns cyber risk into decisions, reports and priorities. That is the core of the CISO role.
As a result, the profile is shifting. Technical depth is still required, but the ability to advise at board level, justify budget and provide constructive challenge now weighs more heavily than it did a decade ago.
We start with an intake with the hiring executive and key stakeholders. Together we define what the CISO needs to achieve, the reporting line, the mandate and budget, and which experience is non-negotiable. The result is a position profile you sign off before we approach the market.
We then map the market: which security leaders fit the profile, where they work today and what would motivate them to move. Candidates are approached personally and in confidence. With suitable candidates we hold in-depth interviews about their approach, track record and leadership style.
You receive a shortlist with a clear rationale for each candidate. We manage the interview process, take references and support the offer and transition. After the start date we stay in touch with both you and your new CISO.
A common mistake is hiring a strong CISO into a role without influence. Whether the CISO reports to the CIO, CEO, CFO or CRO shapes both which candidates are interested and how effective the CISO can be. Reporting to the CIO can work well, provided there is a direct line to the board or audit committee for escalations.
Also clarify the relationship with the second and third lines. Does the CISO own the security programme, or mainly oversee and challenge it? How does the role relate to risk management and compliance; see /expertise/grc-compliance and /expertise/it-risk-management.
We advise on this upfront, because experienced CISOs ask these questions in the first conversation. A clear answer increases the chance that your preferred candidate says yes.
A strong CISO combines three things: credibility with technical teams, the ability to explain risk in board language, and the leadership to bring a team and an organisation along. Candidates often come from security management, IT risk, IT audit or consulting.
Certifications such as CISSP, CISM and CCISO show command of the subject matter but say little about leadership. That is why we ask about specific situations: a budget that had to be defended, an incident explained to the board, a team that was built or restructured.
We also assess fit with your stage and culture. A CISO from a large bank will not automatically thrive in a fast-growing scale-up, and the reverse is just as true.
In CISO executive search the firm actively and confidentially approaches the best candidates in the market, including people who are not looking. Standard recruitment largely depends on who responds to an advert. For a role with this much impact and so few qualified candidates, direct approach is usually the only way to get a real choice.
No, you can combine both. An interim CISO through MVPeople covers the role and can often start within 2 weeks, while MVPermanent recruits the permanent CISO. Read more about interim CISOs at /expertise/ciso.
A CISO executive search usually takes longer than an interim assignment, because candidates have notice periods and several interview rounds are common. We present first CVs within 72 hours of the intake, and a signed contract typically follows within 6 to 10 weeks. The total time to start date depends mostly on the notice period of the chosen candidate.
Yes, discretion is standard in CISO executive search. We approach candidates without naming your organisation until there is mutual interest, and we do not publish an advert unless you want one. This matters most when the current CISO is still in post.
For CISO executive search we charge 30% of the gross annual salary, paid in three instalments: at the start, at the shortlist and at placement. This comes with a 3-month guarantee. As an indication, a permanent senior CISO earns €120,000 to €160,000 gross per year (MVPeople Salary Checker 2026). We set out the terms in a proposal after the intake, so you know where you stand in advance.
Lead security strategy and governance for a major organisation. You shape policies, manage enterprise risks, and report to board level on security posture and compliance.
Lead security strategy and operations for a growing organisation. You drive incident response, manage security teams, and shape risk management across the business.
Last updated by Mathijs Visser, Co-founder and Lead Consultant MVPeople Group.
Book a confidential intake. We respond within 4 hours to discuss your role, mandate and search profile.
