vCISO job description you can post or hand over

Write the job description before you decide whether to hire or to rent. It is the cheapest test there is: if the responsibilities fill a week, hire, and if they fill four days a month, put the same document in front of a fractional provider.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

A vCISO job description covers seven things: the reporting line, the scope of the program the person owns, the recurring responsibilities, the first ninety days, the Canadian statutory duties attached to the role, what the company will provide, and the terms of engagement. The whole document is below. Copy it into a posting or send it to a fractional provider as the scope you expect a proposal against. It is the same job either way, and only the number of days changes.

Most companies skip this and go straight to asking what a vCISO costs. That is the wrong order. A provider quoting against "we need a vCISO" is guessing at hours. Quoting against the document below is the only way two proposals become comparable.

Title and reporting line

Give the role a real title. "Virtual CISO", "fractional CISO" and "chief information security officer, part time" all work. Pick the one your customers will see, because the title ends up in vendor questionnaires and trust documentation.

The reporting line matters more than the title and is the part companies get wrong. The security lead should report to the CEO, the COO or the board, not to the CTO or the VP of engineering. When the person who builds the platform also owns the assurance of it, there is no second opinion, and auditors, insurers and enterprise procurement teams all eventually notice. If you cannot avoid a reporting line into engineering, give the role a standing agenda item with the board so the escalation path exists on paper.

Reports to

Chief executive, chief operating officer, or the audit committee.

Works with

Engineering leadership, IT, legal or the privacy officer, sales for customer security reviews, and finance for the security budget.

Authority

Sets security policy, accepts or escalates risk within a written tolerance, approves exceptions, and signs the security answers the company gives customers.

Does not own

Day to day IT administration, alert monitoring, or building the fixes. The role directs that work rather than doing it.

Purpose of the role

Copy this paragraph and edit the specifics. "The security lead owns the company's information security program: the risk position the business accepts, the policies and controls that hold it, the compliance obligations we carry under Canadian law and under customer contracts, and the reporting that lets the board discharge its duty of care. The role exists so that security decisions are made deliberately by an accountable person rather than incidentally by whoever is closest to the system."

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

Responsibilities

These are the lines that consume time. Delete what does not apply to you. A job description that describes everything describes nothing, and a provider will price the worst reading of it.

The incident row is why the totals are ranges. A quarter with no incident costs nothing on that line. A quarter with a real one costs more than everything else on the table put together, and any engagement that does not say what happens in that week has left the most expensive question unanswered.

The Canadian duties to write in

This section separates a usable Canadian job description from an American template. Most postings leave it out.

• PIPEDA accountability. The company must designate an individual accountable for personal information. Name whether that is this role or a separate privacy officer, because "everyone assumed it was the other one" is a real finding.
• Breach assessment and the 24 month record. PIPEDA requires a report to the Privacy Commissioner and notice to individuals where a breach creates a real risk of significant harm, and separately requires a record of every breach for 24 months whether or not it met that threshold. Say who makes that call and who keeps that register.
• Quebec Law 25, if you have Quebec customers or staff. Privacy impact assessments, rules on automated decision-making, and a privacy officer role that defaults to the most senior person in the company unless it is delegated in writing. Delegate it in writing.
• Health information. PHIPA in Ontario and its provincial equivalents elsewhere apply separately from the private-sector statute. Holding health data for a custodian usually makes you an agent under that Act, which is a heavier duty than being a supplier.
• Contractual security obligations. Whatever your customer contracts already commit you to. Somebody has to read them, and it is normally this role, and it is normally the first time anyone has.

The first ninety days, written as objectives

Put these in the posting or the statement of work with dates against them. An engagement without a first quarter defined is where both employees and retainers drift.

1. An inventory of systems, data stores, cloud accounts, suppliers and administrative access, delivered in the first month.
2. A gap assessment against whatever you are actually being measured on, which may be a framework, a customer questionnaire or an insurer's application.
3. A risk register of twelve to twenty entries with an executive named against each, short enough that a board will read it.
4. A roadmap with dates and CAD costs, split into what unblocks the deal in front of you and what is important but can wait.
5. A first report to the board or the executive team, in the shape set out in the board report template.

Requirements, and the ones worth dropping

Take a position here rather than listing every certification. The Canadian pool of people who have held this role at your size is small, and a requirements list copied from a bank's posting will return nobody.

What to put in the compensation line

For an employee, a CISO at a Canadian company of 50 to 500 people generally sits between $180,000 and $300,000 CAD base, with the top of that band concentrated in Toronto financial services and the bottom in smaller markets and unregulated sectors. There is no large published Canadian CISO compensation survey. Treat that as a range assembled from posted roles and recruiter guidance, not a sourced figure. Loaded with bonus, employer burden and the search fee, the first year lands between $275,000 and $540,000 CAD, which is broken down line by line on fractional CISO cost.

For a fractional engagement, the same document supports a retainer of $3,000 to $12,000 CAD a month depending on which of the two totals in the responsibilities table you landed on. How providers structure that fee, and the contract terms that change the annual number more than the rate does, are on vCISO pricing.

Before you post it

Every item here, left undecided, turns into a renegotiation in month three.

0 of 0 settled · Reset

• The reporting line is decided and it is not into engineering
• The monthly hours are estimated line by line, not assumed
• Whether this person is named to customers and to the insurer is settled
• The PIPEDA accountable individual is named, and Law 25 delegation is in writing if Quebec applies
• What happens in an incident week is written down, including cost
• Somebody internal is available to implement what the role decides
• The security budget the role controls is stated, in CAD
• Ownership of policies, register and evidence is yours in writing, whoever produced them
• The first ninety day objectives have dates against them

A stripped down version of this document is the single most useful thing a company under 50 people can write, even with nobody external involved: what the internal owner decides alone, what needs the CEO, and how much time is theirs. Assigning security with no CISO covers what to keep and what to cut.

Common questions