<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: security-leadership
description: >-
  Security leadership and CISO-level strategy including program
  development, budget management, team building, vendor oversight, metrics
  programs, board reporting, culture initiatives, innovation labs, capability
  assessments, partnership frameworks, communication strategy, and advisory consulting.
domain: cybersecurity
subdomain: security-leadership
tags:
  - ciso
  - security-strategy
  - security-program
  - security-budget
  - security-metrics
  - board-reporting
  - security-culture
  - vendor-management
  - team-development
  - security-innovation
  - capability-assessment
  - security-partnerships
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack:
    - T1195
    - T1199
    - T1078
    - T1566
    - T1190
  nist-csf:
    - GV.OC
    - GV.RM
    - GV.RR
    - GV.SC
    - ID.AM
    - ID.RA
  frameworks:
    - "NIST CSF 2.0"
    - "ISO 27001:2022"
    - "COSO ERM"
---

# SKILL: Security Leadership & CISO Advisory

## When to Use

Activate this skill when the operator asks about:
- **Security program strategy** — roadmap development, maturity modeling, capability planning
- **Budget management** — cost modeling, ROI analysis, capital vs operational allocation
- **Team development** — hiring pipelines, skills matrices, career ladders, retention
- **Vendor management** — third-party risk, contract negotiation, SLA enforcement
- **Metrics programs** — KPI/KRI definition, dashboard design, trend analysis
- **Board reporting** — executive communication, risk translation, business alignment
- **Culture programs** — security champions, awareness campaigns, behavioral change
- **Innovation labs** — emerging tech evaluation, proof-of-concept frameworks, R&D
- **Capability assessment** — maturity models, gap analysis, benchmarking
- **Partnership frameworks** — ISAC participation, vendor ecosystems, academic partnerships
- **Communication strategy** — stakeholder management, crisis communication, internal branding
- **CISO advisory** — fractional CISO services, board advisory, program audits

## Prerequisites

| Requirement | Purpose |
|---|---|
| NIST CSF 2.0 | Governance and risk management framework |
| ISO 27001:2022 | Information security management system standard |
| FAIR Model | Factor Analysis of Information Risk for quantitative risk |
| Project Management Tools | Jira, Asana, or Monday.com for tracking |
| Balanced Scorecard | Strategic performance management framework |

## Quick Reference

### Security Program Maturity Assessment

```python
maturity_levels = {
    1: "Initial — ad hoc, reactive",
    2: "Developing — documented but inconsistent",
    3: "Defined — standardized and repeatable",
    4: "Managed — measured and controlled",
    5: "Optimizing — continuous improvement",
}

def assess_maturity(scores: dict[str, int]) -> dict:
    avg = sum(scores.values()) / len(scores)
    gaps = {k: v for k, v in scores.items() if v < 3}
    return {"average": round(avg, 1), "level": maturity_levels[int(avg)], "gaps": gaps}
```

| Task | Detail |
|---|---|
| Define security charter | Document mission, scope, authority, reporting structure |
| Assess current maturity | NIST CSF self-assessment across all functions |
| Build 3-year roadmap | Prioritize by risk reduction ROI, map to business objectives |
| Establish KPI/KRI | Define leading and lagging indicators per program area |
| Board reporting cadence | Quarterly risk dashboard, annual strategy review |
| Vendor risk tiering | Critical / High / Medium / Low by data access and blast radius |

## Workflow

### 1. Program Strategy Development

Define security mission, align to business objectives, build multi-year roadmap
with measurable milestones. Conduct maturity assessment as baseline.

→ **Deep reference:** [references/program-strategy.md](references/program-strategy.md)
  - Program charter templates and maturity models
  - 3-year roadmap planning frameworks
  - Business alignment methodologies
  - Capability maturity model (CMM) for security

### 2. Metrics & Reporting

Establish KPI/KRI framework, build executive dashboards, automate data
collection. Report risk posture in business terms.

→ **Deep reference:** [references/metrics-reporting.md](references/metrics-reporting.md)
  - KPI/KRI catalog by security domain
  - Executive dashboard design patterns
  - Board reporting templates and cadence
  - Risk quantification with FAIR model

### 3. Team & Culture

Build hiring pipeline, define career ladders, establish security champions
program. Measure culture through behavioral indicators.

→ **Deep reference:** [references/team-culture.md](references/team-culture.md)
  - Security team organizational models
  - Career ladder frameworks (IC and management tracks)
  - Security champions program playbook
  - Culture measurement methodologies

## Verification

| Check | Method |
|---|---|
| Program charter approved | Signed by executive sponsor with defined authority |
| Maturity baseline documented | NIST CSF assessment scores for all functions |
| KPI dashboard live | Automated metrics collection with executive visibility |
| Board report delivered | Quarterly cadence established with feedback loop |
| Team roadmap defined | Hiring plan, skills matrix, career ladders documented |
| Vendor risk tiered | All critical vendors assessed and monitored |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [ISO 27001:2022](https://www.iso.org/standard/27001)
- [CIS Controls v8](https://www.cisecurity.org/controls)

---
v1.0 | Validated: 2026-03-18
