Why Be a CISO in 2026?
Over the last few months, I’ve been sitting with a question I never thought I’d seriously ask:
Why be a CISO in 2026?
It started becoming real after I enrolled in Carnegie Mellon’s CISO Executive Program. I’m currently the Director of GRC, reporting directly to my CISO, and as a very Type-A, “what’s next?” kind of person, I can’t help but look ahead. I’m not in a rush to leave my role, but I’m also not the kind of person who waits for the future to happen to me. I like to be intentional.
And right now, the role that feels like the natural next step… is the CISO one.
So I wanted to write my way through the question that’s been on my mind:
Why step into one of the hardest jobs in cybersecurity at one of the hardest times to do it?
Where This All Started
A year ago, my CISO pulled me aside and said something that stuck:
“You’re not just a GRC leader. You’re a senior leader on the security team. Start thinking beyond your lane.”
So I did. I’ve spent the last year learning everything I can about how the entire security program works. And the more I did that, the more a new question started to form:
Could I be a CISO?
And do I actually want to be one?
I’ve had the privilege of working under strong, competent CISOs who made the job look meaningful—not glamorous, but meaningful. That planted a seed.
Then I learned about Carnegie Mellon’s CISO Program. A mentor of mine took it, and the network he built was incredibly valuable. And I won’t lie: in today’s job market, who you know—and who knows you—matters just as much as what you know.
With some personal timing lining up, and my company willing to cover a good portion of the cost, it just felt like the right moment.
So here I am: preparing to start the program, talking to current CISOs, and really trying to understand the nature of the role.
And it turns out… it’s a lot.
The Hard Truth About Being a CISO in 2026
The more CISOs I talk to, the clearer it becomes:
This is not a glamorous job.
In 2026, the stakes are even higher than they’ve ever been.
You are the “throat to choke.”
If something goes wrong, it’s on you. Period.
There’s a level of accountability that follows you everywhere—board meetings, crisis calls, vendor issues, legal reviews, you name it.
The threat landscape is getting wilder.
AI is scaling attacks at a speed we’ve never seen.
The pace and complexity of threats make this role uniquely exhausting.
Support is not guaranteed.
Some CISOs told me outright:
“If I could go back, I don’t know if I’d do it again.”
Why?
Underfunding
Understaffing
Constant pressure
Stress that bleeds into your personal life
The emotional and relational cost
It’s not uncommon to hear stories about burnout, failed marriages, or CISOs who feel completely isolated in their roles.
And then there’s the industry itself.
Not all CISO jobs are the same. Some companies want a strategic leader. Others want a scapegoat with a fancy title.
Some industries face relentless, existential threats; others simply want compliance.
It’s a lot to take in.
The “What Happens After?” Question
A surprising fear that popped up for me:
What happens after being a CISO? Does the career ladder stop?
It’s weird to think that far ahead, but I’m wired that way. I like to know the runway.
I wondered:
If I ever stepped down, would I be “too senior” for anything else?
Would I get stuck in a perpetual cycle of CISO roles?
Talking to mentors eased that anxiety. There are plenty of paths post-CISO:
Board positions
Consulting
Field CISO roles
Joining a larger company in a senior leadership position
Teaching
Advisory work
It doesn’t have to be the final destination. It can be an important chapter.
So… Why Do It?
Despite all the warnings, the stress, the stories of burnout, and the sheer scale of responsibility…
I still feel drawn to it.
Here’s why:
1. I love leading teams.
I don’t want to be a lifelong “GRC person.”
I want to lead security at the highest level, help shape culture, and create an environment where people bring their best work.
2. I want to be closer to the business.
One of my mentors said that becoming a CISO made him feel like he was finally part of the business—not just supporting it from the outside.
That appeals to me. I want to help influence the direction of a company, not just react to it.
3. I believe in human-centered security.
A lot of CISOs communicate like robots.
I don’t.
(If anything, I communicate like a comedian trapped in cybersecurity.)
I genuinely think I can bring something different and valuable to the role.
4. Yes, the money matters.
Let’s be honest.
The compensation is attractive.
But the pay-to-stress ratio is something I’ll need to calibrate. There’s a point where money can’t buy back peace of mind. Still… the financial upside is part of the picture.
5. And most of all: I want to see if I can do it.
The closer I get to the role, the more I feel like—
“You know what? I think I could do this.”
Not because it’s easy.
But because it’s hard.
Because it matters.
Because I’m ready for a challenge that stretches me.
So Why Be a CISO in 2026?
After all this reflection, here’s my honest answer:
Because I think I can make a difference.
Because I want to contribute at the highest level.
Because I want to help shape a security culture that’s human, not robotic.
Because I want to guide a company through the messy intersection of AI, risk, business, and people.
Because I’m at a point in my career where I’m close enough to the role that it no longer feels impossible.
And because—even if it ends up being hard, stressful, or not what I imagined—I want the story of having done it at least once.
Maybe it’ll be great.
Maybe it’ll be terrible.
But either way…
It feels like a chapter worth writing.