Before Stephen Baird interviewed for the position of VP of corporate security for United Rentals in 2004, he did his homework. Sure, he checked out its financial filings and the stability of the executive suite, and he networked with a few peers. But Baird also went a step further. He visited a branch office to see what customers experience. "I learned how to rent a piece of equipment, and I basically hung around watching and listening," he says. During the interview, when the CFO asked how Baird saw security playing into revenue generation, he had a ready answer. "I told him, 'I will never make security a revenue generator, but it can contribute to cost savings and increased efficiencies,'" he says. Baird then explained how he had watched customers renting equipment and noticed that although they were offered the option to buy insurance on the equipment, there were no security products available on-site. He talked about products United could offer, like security locks for Bobcats that cut down on damage and theft of rented equipment. "The CFO [who would also be his new boss] just sat back and smiled," Baird recalls.
With the increased visibility and codependence of the CSO role with other business functions, applicants for executive security positions can expect a lot tougher job interview questions. Preparation is paramount. We asked several security executives who went through the interview process in recent years what were some of the most challenging questions they had to answer. They shared their advice on crafting the right kinds of answers and the lessons they learned from the interview and selection process.
By the time a CSO has made it to the interview stage, the contents of his resume should be largely moot. Usually both the candidate and company have at least a rough idea of what the other is about. What they are looking for at this stage - and what many of the harder questions are getting at - is a sense of the unique skills and sensibilities the candidate will bring to the job. They may not always state their questions explicitly, but these are the areas that corporate executives will attempt to mine in an interview.
1. What is your vision for our security organization?
"The vision thing", as the first President Bush once termed it, is hugely important in selecting a CSO. The company's executives will have their own vision of what a CSO should be and what he should be able to do for the company, and they'll expect you to have one too. They want to know that you have experience with their particular security issues, that you can craft a plan for where security should be in their enterprise - and how you are going to get it there. "In my case, I had a very complete job description written for them and had brainstormed what I thought a CSO should be able to provide them," says Robert Champion, CSO of WGL Holdings, which owns Washington Gas. CSO candidates should try to learn as much as possible about the company and position, and be prepared to discuss ideas and strategies that match an employer's goals.
2. How will you fit in with our corporate culture?
The CSO's role at IBM or GE and that same position at Google or Yahoo are worlds apart. Every company that you interview with wants to know whether you can work comfortably with its corporate personality. Before your interview, talk to employees and, if possible, walk the halls. Is this a strait-laced crew, or will you need reserves of flexibility in order to fit in?
When Champion took a walk through the facility after his interview, he compared what he saw with what he had heard during his conversations with executives. "I was able to get a sense of the level of energy, the diversity picture and the material condition of the facilities," he says. "A little attention to detail will also tell you about the security culture. Do people wear their IDs? Are doors propped open? Do strangers get challenged? Can unattended PCs be accessed?" The answers will help you make a career judgment.
3. Do you work well with others?
Hopefully the answer is "Yes!" During the interview process, it's likely that you'll meet with a variety of line-of-business executives from HR, legal, finance, IT and so on. Each will want to assess whether you are going to be a partner or a stumbling block to his goals. They're not looking for a pushover (hopefully), but if the company is a collaborative environment, they want to know that you can play in that sandbox. Have examples ready of projects where you have successfully partnered in the past. And talk to these folks about their responsibilities and security concerns in their own language rather than using technical jargon. "They don't have experience in information security, and these executives are tired of talking to security people that can't talk in business terms," says Sharon O'Bryan, former CISO at ABN Amro and now president of O'Bryan Advisory Services.
O'Bryan also suggests that candidates underscore their business fluency by asking non-IT executives questions about business operations during the interview, such as: What business transactions and processes are key profit generators? How has the company used technology risk management capabilities to reduce operational risk management costs?