I am pretty upfront about my turbulent job history. Some of the issues were due to not doing enough homework up front before taking a job. But as I look back I am not sure I would have made different decisions about which jobs to take even if I had done more homework. A post at SCMagazine by Justin Somaini makes a couple good points about what questions to ask before taking a CISO job. Understanding a company’s standing is always important. Is the company losing revenue? Have executives and/or board members left? Is the company prime for a takeover? Are competitors dominating the industry? All of these questions help determine a company’s health: a factor that will be critical to know if you’re going to make the right move. While risks can pay off, you want to know what you are getting into. A company in turmoil will be more resistant to funding projects, hiring new staff, or making security a priority. Okay, that’s pretty obvious. You need a shot upside the head with a clue bat if you aren’t really scrutinizing the financials and market position of any potential employer. One of the worst aspects of security groups, let alone IT, is staff management. It is common to have to restructure a team based on skills gaps. So always try to determine how large the team is in relation to the overall company and IT staffing. Typical security groups for companies of 10,000 to 15,000 full-time employees will have 25 to 30 staff. This does not include IT operational teams that I usually leave in a separate group. Is last year’s attrition rate at the typical 10 to 15 percent? Is the staff located in key areas for the company? Are there cascading goals from corporate objectives? Are reviews done quarterly and historically attached to goals? What are the results of the latest employee survey? Has there been a layoff or hiring freeze in the past 18 months? As with financial assets, not having the right human capital will only make your job tougher, so ask the questions. I am not sure you will get real answers to these questions. If you are interviewing for the senior role on any team you should expect the senior management to tell you that you will be able to make the necessary changes to deliver results. Of course you can meet all the folks already on the team, but in my experience everyone is on their best behavior during the interview process. They will blow smoke in your hind section if they think they can salvage their jobs. So you won’t really know what folks can do and the internal douche quotient until you get boots on the ground and dig in. That’s why I highly recommend a rent-to-buy scenario. Take a 3-month consulting gig, with the expectation that things will work out and you’ll become permanent at the end of that probationary period. That mitigates risk on both sides and can prevent serious mistakes. I have a good friend who did exactly this prior to a relocation. Within a month he knew the situation wasn’t a good fit, and he exited gracefully after his contract was up. Let me throw one more point at you. There is no excuse for not making a few phone calls to learn what may not be obvious during interviews. Call some folks who will provide honest answers about culture and work environment. Yes, I’m taking about former employees. It still amazes me the number of folks who do not call me before taking a job I had – working for the same folks. I could have given them an informed perspective on some of the good and a lot of the bad. Of course it’s my opinion, but it’s another data point in a pretty important decision. But go in with your head up. Understand you won’t know everything you need to know. Things will be different. Sometimes you’ll be pleasantly surprised. Other times not so much. Which is part of the game. Photo credit: “Rent-A-Center store” originally uploaded by benchilada Share:
