10 Tough Questions & How to Answer Them

Before Stephen Baird interviewed for the position of VP of corporate security for United Rentals in 2004, he did his homework. Sure, he checked out its financial filings and the stability of the executive suite, and he networked with a few peers. But Baird also went a step further. He visited a branch office to see what customers experience. "I learned how to rent a piece of equipment, and I basically hung around watching and listening," he says. During the interview, when the CFO asked how Baird saw security playing into revenue generation, he had a ready answer. "I told him, 'I will never make security a revenue generator, but it can contribute to cost savings and increased efficiencies,'" he says. Baird then explained how he had watched customers renting equipment and noticed that although they were offered the option to buy insurance on the equipment, there were no security products available on-site. He talked about products United could offer, like security locks for Bobcats that cut down on damage and theft of rented equipment. "The CFO [who would also be his new boss] just sat back and smiled," Baird recalls.

With the increased visibility and co­dependence of the CSO role with other business functions, applicants for executive security positions can expect a lot tougher job interview questions. Preparation is paramount. We asked several security executives who went through the interview process in recent years what were some of the most challenging questions they had to answer. They shared their advice on crafting the right kinds of answers and the lessons they learned from the interview and selection process.

By the time a CSO has made it to the interview stage, the contents of his resume should be largely moot. Usually both the candidate and company have at least a rough idea of what the other is about. What they are looking for at this stage - and what many of the harder questions are getting at - is a sense of the unique skills and sensibilities the candidate will bring to the job. They may not always state their questions explicitly, but these are the areas that corporate executives will attempt to mine in an interview.

1. What is your vision for our security organization?

"The vision thing", as the first President Bush once termed it, is hugely important in selecting a CSO. The company's executives will have their own vision of what a CSO should be and what he should be able to do for the company, and they'll expect you to have one too. They want to know that you have experience with their particular security issues, that you can craft a plan for where security should be in their enterprise - and how you are going to get it there. "In my case, I had a very complete job description written for them and had brainstormed what I thought a CSO should be able to provide them," says Robert Champion, CSO of WGL Holdings, which owns Washington Gas. CSO candidates should try to learn as much as possible about the company and position, and be prepared to discuss ideas and strategies that match an employer's goals.

2. How will you fit in with our corporate culture?

The CSO's role at IBM or GE and that same position at Google or Yahoo are worlds apart. Every company that you interview with wants to know whether you can work comfortably with its corporate personality. Before your interview, talk to employees and, if possible, walk the halls. Is this a strait-laced crew, or will you need reserves of flexibility in order to fit in?

When Champion took a walk through the facility after his interview, he compared what he saw with what he had heard during his conversations with executives. "I was able to get a sense of the level of energy, the diversity picture and the material condition of the facilities," he says. "A little attention to detail will also tell you about the security culture. Do people wear their IDs? Are doors propped open? Do strangers get challenged? Can unattended PCs be accessed?" The answers will help you make a career judgment.

3. Do you work well with others?

Hopefully the answer is "Yes!" During the interview process, it's likely that you'll meet with a variety of line-of-business executives from HR, legal, finance, IT and so on. Each will want to assess whether you are going to be a partner or a stumbling block to his goals. They're not looking for a pushover (hopefully), but if the company is a collaborative environment, they want to know that you can play in that sandbox. Have examples ready of projects where you have successfully partnered in the past. And talk to these folks about their responsibilities and security concerns in their own language rather than using technical jargon. "They don't have experience in information security, and these executives are tired of talking to security people that can't talk in business terms," says Sharon O'Bryan, former CISO at ABN Amro and now president of O'Bryan Advisory Services.

O'Bryan also suggests that candidates underscore their business fluency by asking non-IT executives questions about business operations during the interview, such as: What business transactions and processes are key profit generators? How has the company used technology risk management capabilities to reduce operational risk management costs?

Page Break

4. What do you think about security convergence and its effect on our company?

Executives may not use the word convergence, but you can bet they have heard about or have thought about the movement that security is making toward being part of a larger risk management strategy. It is likely that they will try to suss out your perspective and experience in this area at some point during the interview. "You need to be prepared to discuss convergence, what the pros and cons are, and what your vision is for how to get there," says Champion.

5. How do you sell security to other executives?

Good sales and leadership skills are critically important. After all, what good is all that vision and experience if you can't persuade others to your way of thinking? Veteran security executive Pamela Fusco, an adviser to the Information Systems Security Association, has often been asked to make a sales pitch for a particular business case during an interview. "Executive management needs to know that you can talk at multiple levels and build a business case," says Fusco.

6. How do you sell security to the company at large?

Influencing the average employee also comes with the job, and it's often the greatest challenge for security executives. "You have to demonstrate that you can make people change even when they don't want to," says Robert Garigue, vice president for information integrity and chief security executive for Bell Canada. Candidates should go into an interview with examples of situations in which they were able to change ingrained behaviours and long-established processes to accomplish a security goal.

7. Why are you leaving your current job?

This is a question where CSO candidates can sabotage themselves by going negative. It's important to be honest but to also stay positive. Perhaps you are looking for greater opportunities for development, a new career challenge or to launch into a different industry or type of company. Don't use the interview to vent about the inadequacies of your current job.

"I've witnessed a lot of senior security position interviews where the individual was crying over spilled milk," says Kevin Lampeter, chief security and fraud officer with a global financial services firm. "If the conversation is about what everyone did to make their job harder, that tells me that they didn't take ownership. That reflects on a candidate's ability to be collaborative and their interpersonal skills." Airing dirty laundry is also poor judgment, says Lampeter. If a candidate is speaking poorly of his current employer, chances are good he'll do the same thing to the next one.

8. Are you willing to be accountable for security?

This question digs into your knowledge about government regulations that apply to the prospective employer. A candidate needs to be conversant with any regulations that affect the company he's interviewing with, and must show he can integrate business requirements into an overall security program and organization. "They take for granted that you understand all the baseline physical and IT security stuff," says Champion. "They want to know: [Do] you understand their compliance environment? Can you interpret an SAS 70 report from an IT vendor? How will you keep them out of hot water with regulators, auditors and shareholders?"

9. Are you a risk-taker?

Security executives are often walking a fine line when they talk about risk with business owners. Business leaders want a CSO who is a risk-taker because they want to do more, do it faster, and they don't want a security executive who constantly says no. In the interview you have to demonstrate that you have a balanced approach to risk and that you are willing to explore ways that the company can take on more risk if that's what it wants to do. "We've all got great examples about how we said no," says Garigue. "What we need are examples of how we said 'yes, take the risk', but in a controlled way."

Page Break

10. What does this role mean to you?

Once you've got through some of the more technical and strategic questions, it's likely that at least one interviewer will throw you an open-ended question like this one. This is your chance to talk about what makes you unique. When Baird was asked this question at United Rentals, it was a welcome opportunity to lay out his perspective. "I explained what I could bring to the table, how I would fit in, and I was candid about the type of organization that I wanted to build. It was a chance to then turn the question back to them and ask if that was the kind of security organization they wanted in their company," he says.

One final thought: CSOs are still the new kids on the block. So don't get hung up on giving the "right" answer or projecting yourself as a traditional CSO, because there is no such thing. "Remember," says Garigue, "the different organizations, problems and laws that you have had to work with have evolved you into the person you are today."

Communication Skills Are Key to Success

What personal skills or attributes are most pivotal to your success as a security leader? (Choose three.)

83% Ability to communicate effectively

71% Strategic thinking and planning

57% Understanding business processes and operations

43% Ability to lead and motivate staff

36% Ability to lead during a crisis

30% Understanding industry trends, business strategy

29% Technical knowledge and skills

19% Negotiation skills

11% Investigative skills

9% Law enforcement background, skills and connections

SOURCE: CSO RESEARCH

Copyright © 2006 IDG Communications, Inc.

The 10 most powerful cybersecurity companies