10 Tough Job Interview Questions, and How to Answer Them

10 Tough Job Interview Questions, and How to Answer Them
Recently hired CSOs share what hiring execs want to know in interviews.
by Daintry Duffy, CSO
June 01, 2006  From: www.csoonline.com

1. What is your vision for our security organization?
"The vision thing," as the first President Bush once termed it, is hugely important in selecting a CSO. The
company's executives will have their own vision of what a CSO should be and what he should be able to do for
the company, and they'll expect you to have one too. They want to know that you have experience with their
particular security issues, that you can craft a plan for where security should be in their enterprise—and how you
are going to get it there. "In my case, I had a very complete job description written for them and had
brainstormed what I thought a CSO should be able to provide them," says Robert Champion, CSO of WGL
Holdings, which owns Washington Gas. CSO candidates should try to learn as much as possible about the
company and position, and be prepared to discuss ideas and strategies that match an employer's goals.


2. How will you fit in with our corporate culture?
The CSO's role at IBM or GE and that same position at Google or Yahoo are worlds apart. Every company that
you interview with wants to know whether you can work comfortably with its corporate personality. Before your
interview, talk to employees and, if possible, walk the halls. Is this a straitlaced crew, or will you need reserves of
flexibility in order to fit in?
When Champion took a walk through the facility after his interview, he compared what he saw with what he had
heard during his conversations with executives. "I was able to get a sense of the level of energy, the diversity
picture and the material condition of the facilities," he says. "A little attention to detail will also tell you about the
security culture. Do people wear their IDs? Are doors propped open? Do strangers get challenged? Can
unattended PCs be accessed?" The answers will help you make a career judgment.

3. Do you work well with others?
Hopefully the answer is "Yes!" During the interview process, it's likely that you'll meet with a variety of line-ofbusiness
executives from HR, legal, finance, IT and so on. Each will want to assess whether you are going to be
a partner or a stumbling block to his goals. They're not looking for a pushover (hopefully), but if the company is a collaborative environment, they want to know that you can play in that sandbox. Have examples ready of projects where you have successfully partnered in the past. And talk to these folks about their responsibilities and security concerns in their own language rather than using technical jargon. "They don't have experience in
information security, and these executives are tired of talking to security people that can't talk in business terms,"says Sharon O'Bryan, former CISO at ABN Amro and now president of O'Bryan Advisory Services.
O'Bryan also suggests that candidates underscore their business fluency by asking non-IT executives questions about business operations during the interview, such as: What business transactions and processes are key profit generators? How has the company used technology risk management capabilities to reduce operational risk management costs?

 

4. What do you think about security convergence and its effect on our company?
Executives may not use the word convergence, but you can bet they have heard about or have thought about the movement that security is making toward being part of a larger risk management strategy. It is likely that they will try to suss out your perspective and experience in this area at some point during the interview. "You need to be prepared to discuss convergence, what the pros and cons are, and what your vision is for how to get there," says Champion.

 

5. How do you sell security to other executives?
Good sales and leadership skills are critically important. After all, what good is all that vision and experience if
you can't persuade others to your way of thinking? Veteran security executive Pamela Fusco, an adviser to the
Information Systems Security Association, has often been asked to make a sales pitch for a particular business
case during an interview. "Executive management needs to know that you can talk at multiple levels and build a
business case," says Fusco.

 

6. How do you sell security to the company at large?
Influencing the average employee also comes with the job, and it's often the greatest challenge for security
executives. "You have to demonstrate that you can make people change even when they don't want to," says
Robert Garigue, vice president for information integrity and chief security executive for Bell Canada. Candidates
should go into an interview with examples of situations in which they were able to change ingrained behaviors
and long-established processes to accomplish a security goal.

7. Why are you leaving your current job?
This is a question where CSO candidates can sabotage themselves by going negative. It's important to be
honest but to also stay positive. Perhaps you are looking for greater opportunities for development, a new career challenge or to launch into a different industry or type of company. Don't use the interview to vent about the inadequacies of your current job.
"I've witnessed a lot of senior security position interviews where the individual was crying over spilled milk," says Kevin Lampeter, chief security and fraud officer with a global financial services firm. "If the conversation is about what everyone did to make their job harder, that tells me that they didn't take ownership. That reflects on a candidate's ability to be collaborative and their interpersonal skills." Airing dirty laundry is also poor judgment, says Lampeter. If a candidate is speaking poorly of his current employer, chances are good he'll do the same thing to the next one.

 

8. Are you willing to be accountable for security?
This question digs into your knowledge about government regulations that apply to the prospective employer. A
candidate needs to be conversant with any regulations that affect the company he's interviewing with, and must
show he can integrate business requirements into an overall security program and organization. "They take for
granted that you understand all the baseline physical and IT security stuff," says Champion. "They want to know: [Do] you understand their compliance environment and Sarbanes-Oxley? Can you interpret a SAS 70 report from an IT vendor? How will you keep them out of hot water with regulators, auditors and shareholders?"

 

9. Are you a risk-taker?
Security executives are often walking a fine line when they talk about risk with business owners. Business
leaders want a CSO who is a risk-taker because they want to do more, do it faster, and they don't want a securityexecutive who constantly says no. In the interview you have to demonstrate that you have a balanced approachto risk and that you are willing to explore ways that the company can take on more risk if that's what it wants to do. "We've all got great examples about how we said no," says Garigue. "What we need are examples of how we said 'yes, take the risk,' but in a controlled way."

 

10. What does this role mean to you?
Once you've gotten through some of the more technical and strategic questions, it's likely that at least one
interviewer will throw you an open-ended question like this one. This is your chance to talk about what makes
you unique. When Baird was asked this question at United Rentals, it was a welcome opportunity to lay out his
perspective. "I explained what I could bring to the table, how I would fit in, and I was candid about the type of
organization that I wanted to build. It was a chance to then turn the question back to them and ask if that was the kind of security organization they wanted in their company," he says.
One final thought: CSOs are still the new kids on the block. So don't get hung up on giving the "right" answer or projecting yourself as a traditional CSO, because there is no such thing. "Remember," says Garigue, "the
different organizations,