What's a reliable alternative to hiring an in-house security manager?

What's a reliable alternative to hiring an in-house security manager?

TL;DR

1. A full-time hire is expensive and slow. A full-time CISO costs $250,000 to $400,000 a year loaded, and the search alone can take 4 to 6 months. An internal security lead costs $130,000 to $180,000 loaded.
2. A virtual CISO (vCISO) is the most common alternative. Expect $3,000 to $6,000 a month for 1 to 2 days of work, or $8,000 to $16,000 for 4 to 6 days.
3. A vCISO usually starts in 1 to 2 weeks and brings experience from other companies who faced the same audits.
4. The most reliable setup for most companies under 300 people is a vCISO for strategy, plus tools or a managed service for the daily work.
5. Hire in-house
6. Once you need someone every day: several security staff to manage, multiple frameworks at once, or customers who expect weekly access.

At some point every growing SaaS company has the same meeting. A customer wants a security questionnaire answered, an investor asks who owns security, and everyone in the room turns to look at the CTO. The CTO is already doing three jobs and would like it noted that "security" was never one of them.

The obvious fix is to hire a security manager. The less obvious question is whether you need a full-time person, or whether you need security leadership a few days a month. This post compares the options in plain English, with prices.

How much does an in-house security manager cost?

More than the salary on the job ad. The US Bureau of Labor Statistics puts the median for information security analysts at $124,910, and managers earn more. BD Emerson estimates an internal security lead at $130,000 to $180,000 a year once taxes and benefits are added.

If you want a senior leader, the numbers go up fast. BD Emerson's estimates for a full-time CISO:

1. Base salary: $200,000 to $300,000 in most US metro markets, and $300,000 to $400,000 in coastal hubs.
2. Taxes and benefits: another 20% to 30% of base.
3. Recruiter fee: 25% to 30% of first-year pay, or $60,000 to $100,000.
4. Search time: 4 to 6 months, with the seat empty while you look.
5. Tenure: median CISO tenure is close to two years, so you may be paying that recruiter again sooner than you'd like.

Add it up and BD Emerson puts the loaded cost at $250,000 to $400,000 a year, and up to $500,000 in the year you hire. That's a lot to spend on

someone whose first three months are mostly working out where the passwords are kept.

What are the alternatives to a full-time hire?

There are three main ones, and they solve different problems:

These options work together. A platform collects the evidence but can't decide what your security priorities are. A managed provider watches for alerts but won't sit on a call with your biggest prospect's security team. A vCISO does the thinking and talking, but you don't want them watching logs at 3am.

What is a vCISO, and what do they actually do?

A vCISO (virtual or fractional Chief Information Security Officer) is an experienced security leader you hire for part of the month. Consilien's guide lists the usual scope:

1. Building the security program and roadmap
2. Writing and reviewing policies
3. Managing vendor risk
4. Reporting to the board and leadership
5. Guiding compliance work such as SOC 2, ISO 27001 or PCI
6. Planning how you'll respond to an incident

Pricing usually depends on how many days or hours you need. Here's how Consilien breaks it down by company size:

The other advantage is speed. Consilien puts a vCISO at 1 to 2 weeks to become productive, compared with 3 to 6 months for a new full-time CISO. A good vCISO has also seen your exact problem at a dozen other companies, so they skip the part where everyone learns SOC 2 from scratch together.

Which option is the most reliable?

For most companies under 300 people, a vCISO combined with a compliance platform or managed service is the most reliable setup.

The reason is coverage. A single in-house hire is one person. They take holidays, get sick, and on average move on after about two years. When they leave, the knowledge goes with them and you start the search again. With a vCISO firm, the context lives in documents the firm keeps and the firm can assign another person if yours leaves.

The numbers back this up. BD Emerson estimates that most companies under 300 people need 4 to 8 days of security leadership a month, and that fractional work stays cheaper than a full-time CISO until roughly 10 to 12 days a month.

One warning from the same article applies to every option: security only works if the person running it has authority. A vCISO with no budget who reports to someone four levels down will fail just as quickly as a full-time hire in the same position.

When should you hire in-house after all?

Once you need security leadership most days of the week. BD Emerson lists these signs:

1. You have 4 to 6 security staff who need daily direction, often around 500 to 1,000 employees.
2. You're running several compliance frameworks at the same time.
3. You hold contracts that require it, such as FedRAMP or some financial services work.
4. You've had three or more serious incidents in a year.
5. Your board and customers expect weekly access to a security leader.

There's also a middle option for companies of roughly 200 to 750 people: an internal security lead to handle the daily work, plus a vCISO for strategy. BD Emerson puts that combination at $220,000 to $350,000 a year. A vCISO can also help you run the search for your first full-time hire, which means somebody who knows security is writing the job description.

How do you pick a good vCISO provider?

Ask these questions before you sign:

1. Who exactly will I work with? Get a name, and ask what happens if that person leaves.
2. Have you taken companies like mine through this audit? Ask for a reference you can call.
3. What's in the retainer and what isn't? Consilien lists the usual extras: GRC software, hours over your plan at $250 to $400 an hour, penetration tests and the audit itself.
4. Will you join customer security calls? Some vCISOs only write documents. You want one who'll speak to your prospect's reviewers.
5. What's the notice period? BD Emerson says 30 to 60 days is normal. Be careful with anything that ties you in for longer.

If a provider can't answer the first question clearly, you may be paying for whichever junior consultant is free that week.

FAQs

What's the difference between a vCISO and a security consultant? A consultant usually does one project and leaves. A vCISO takes ongoing ownership of your security program, works with you every month, and represents you to customers and auditors.

Can a vCISO get us through SOC 2? Yes, that's one of the most common reasons companies hire one. Consilien lists fixed-fee SOC 2 readiness projects at $10,000 to $75,000, and many vCISOs include audit support in a monthly retainer.

Is a managed security provider enough on its own? Usually not. A managed provider watches for threats and responds to alerts, but it won't set your security priorities, write your policies or speak to buyers on your behalf.

How many hours a month does a small company need? Consilien suggests 5 to 8 hours for companies under 50 people with light compliance needs, and 8 to 15 hours for a 50 to 200 person company working on its first framework.

Will customers accept a vCISO as our security leader? In most cases, yes. Buyers want to know that a qualified person owns security and can answer their questions. Few of them ask whether that person is on payroll.

Can we start with a vCISO and hire later? Yes, and it's a common path. The vCISO builds the program and documentation, and then helps you hire and hand over to a full-time leader when you're ready.

Not sure how much security leadership you need?

Book a free 45-minute gap analysis with CloudSapio. We'll look at what your customers and auditors are asking for, and tell you whether a full-time hire, a vCISO or a mix of both makes sense for where you are now.



Book my free gap analysis

Ready to move faster?

Too much to do,

too important to ignore.