Cybermatch Executive
Hire your CISO or cybersecurity director
Hiring a CISO is about far more than filling a role: the credibility of your security set-up with the executive committee, regulators and clients is at stake. At Cybermatch, these searches fall under executive search: they are led by our partners through direct approach, and every finalist is assessed by a peer from the expert committee, an active CISO or cybersecurity director.
Why this hire has become so difficult
The best CISOs are in post, constantly approached, and say little about their situation. Regulatory requirements (NIS 2, DORA, ISO 27001) have sent demand soaring for leaders able to speak technology, risk and strategy at the same time. A job ad is not enough: these candidates are won over by a direct, confidential approach that is credible on substance, led by someone who knows their profession.
NIS 2 · the coming wave of hiring
Plan your CISO hire before NIS 2 applies
The French transposition law (the “Resilience” bill) is still going through Parliament and ANSSI’s decrees and frameworks are being prepared: once it is adopted, nearly 15,000 essential and important entities across 18 sectors will have to comply. Management bodies become accountable for their organisation’s cyber risk management, with fines of up to €10 million or 2% of worldwide turnover for essential entities. Hundreds of organisations are looking for a CISO at the same time, from a talent pool that hasn’t grown.
- Essential entities: large organisations in highly critical sectors (energy, healthcare, transport, banking, water, digital infrastructure) and central government: a CISO reporting to executive management becomes essential.
- Important entities: medium-sized companies in those sectors, and companies in other critical sectors (food, manufacturing, chemicals, waste management, postal services…): often a first CISO, whose profile shapes the whole compliance programme.
- What we do: scoping the role in light of your NIS 2 status, direct approach of CISOs who have already led a compliance programme, assessment of every finalist by a peer from the committee. To build the team around the CISO, the collective also recruits your GRC and compliance profiles.
Our executive search method
Every search is led by a partner, from scoping to onboarding. Scoping sets the role’s remit, the organisation’s cyber maturity, the reporting line and the sector’s regulatory constraints. The search is then conducted through direct approach, in complete confidence. Finalists meet a member of the expert committee, who provides a written opinion, and take a personality assessment with shared feedback. Confidential due diligence can be carried out with the candidate’s consent.
The roles we recruit
- Group, subsidiary or mid-cap CISO
- Cybersecurity director and CISO, in France or with an international remit
- Deputy CISO set to succeed the current CISO
- Head of information systems security in regulated sectors (banking, insurance, healthcare, energy, defence)
- Interim CISO, to cover a vacancy, an audit or a crisis recovery
Other leadership roles (heads of SOC or CERT, R&D directors, VPs of Sales, executives of cyber companies) are presented on our cybersecurity executive search.
What we check
The assessor is a CISO or cybersecurity director currently in post and a member of the expert committee. Here is what they look at:
- The ability to build and defend a security roadmap before an executive committee that has neither the time nor the vocabulary
- Real experience of the regulatory frameworks listed on the CV: NIS 2, DORA, ISO 27001, French Military Programming Law (LPM), GDPR, with examples of decisions taken and trade-offs accepted
- Handling a difficult incident or audit: what was done, what went wrong, what changed afterwards
- Arbitration between risk, budget and business continuity, on concrete cases
- Management style: recruiting, developing and retaining a security team in a tight market
Salary benchmarks 2026
Gross annual ranges observed in France in 2026, excluding bonus and benefits, compiled by Cybermatch from its own searches and public market studies. Paris and regulated sectors sit at the top of the ranges.
See all ranges by role
| Role | Mid-level | Senior | Lead / head of |
|---|---|---|---|
| CISO (all organisation sizes) | €70k–95k | €95k–140k | €140k–220k |
| Mid-cap and scale-up CISO (by experience) | €90k–105k (6 to 10 years) | €100k–120k (10 to 15 years) | €120k+ (15 years and more) |
| Interim CISO (freelance) | €700–900 / day | €900–1,200 / day | on request |
For comparison, the CESIN study (the French club of information and digital security experts), conducted with OpinionWay in 2024 among 390 security leaders, puts the median gross annual salary of CISOs at €90,000 and the average at €96,543, with 71% receiving variable pay (CESIN 2024 study).
Variable pay commonly represents 10% to 20% for a group CISO. CISSP, CISM and ISO 27001 Lead Implementer certifications, cloud experience and a direct reporting line to executive management push salaries upwards.
Process and timelines
- Scoping with a partner (a few days): remit, reporting line, expected level, target salary, attractiveness pitch. We tell you frankly whether the role is realistic at the planned salary.
- Direct approach (two to three weeks): identification and personal contact of CISOs in post, in France and neighbouring French-speaking countries.
- Peer assessment: interview with a member of the expert committee, written opinion, personality assessment with shared feedback.
- Shortlist within three to four weeks: two to four finalists presented with their background, the peer’s opinion, motivations and conditions.
- Interviews, offer and onboarding: support through to signature, reference checks with the candidate’s consent, review at the end of the probation period.
Frequently asked questions
Do you recruit CISOs for NIS 2 compliance?
Yes. We scope the role according to your status (essential or important entity), your sector and your maturity, then our partners directly approach CISOs who have already led a regulatory compliance programme (NIS 2, DORA, ISO 27001). Every finalist is assessed by an active peer from the expert committee. Given the volume of hiring expected once the transposition law is adopted, we recommend launching the search as early as the mapping and risk-analysis phase, without waiting for the decrees.
How long does it take to hire a CISO?
Allow three to four weeks for a shortlist of qualified CISOs assessed by a peer, then time for interviews and a three-month notice period in most cases. The new hire therefore usually starts four to six months after launch. An interim CISO can cover the gap.
What is the difference between a CISO and a GRC manager?
The CISO owns information security as a whole: strategy, organisation, technology, compliance, crisis management. The GRC manager focuses on governance, risk analysis and regulatory compliance, often within the CISO’s team. At Cybermatch, CISOs and cybersecurity directors fall under executive search; GRC profiles are recruited by the collective (GRC and compliance recruitment).
Does a mid-sized company need a full-time CISO?
From a few hundred employees, regulatory exposure (NIS 2, DORA) or a strong dependence on digital systems, yes. Below that, a part-time or interim CISO backed by a service provider is often more realistic. We help you decide at the scoping stage, with no interest in selling you an unnecessary role.
How do you assess a CISO when you aren’t CISOs yourselves?
We don’t assess them alone. Every finalist meets a CISO or cybersecurity director in post, a member of our expert committee, who writes an opinion. A personality assessment, shared with both the candidate and the client, completes the evaluation. The recruiter assesses background and motivation; the peer assesses competence.
Do you recruit CISOs in Belgium, Switzerland and Luxembourg?
Yes. We work in France, Belgium, Switzerland, Luxembourg and Monaco, for local roles or European remits managed from France, taking into account each country’s regulatory specifics (FINMA, CSSF, transposed NIS 2).
What are your fees for hiring a CISO?
Hiring a CISO or cybersecurity director falls under Cybermatch Executive: the search works on a retainer paid in three instalments (launch, signed offer, end of probation), with fees capped at 28% of gross annual salary.
Let’s talk about your needs
Looking for your CISO or cybersecurity director? Describe the role, the context and your constraints: a partner will call you back within 48 hours, in complete confidence.
Are you a cyber expert? Join our talent pool: we only contact you about roles that match your plans.
CandidatesCybermatch Executive: cybersecurity executive search · the expert committee · Cybermatch Collective: GRC & compliance · SOC & cyber defence · offensive security · incident response & DFIR · security engineering · OT, IoT & embedded · IAM & data protection · business functions · about us · client references