I have been in the IT field for over 15 years professionally and 30 years as a hobby/interest. One of the things I find as I move up in the IT Security field is the lack of soft skills in security professionals. I have found in agencies that are struggling with security adoption that there is usually one or two security professionals that come from the old school of INFOSEC and still want to see security as black and white, yes or no. These people with rigid views limit themselves in their career. I have heard from hiring managers above these people that they did not promote this person because they were too rigid. They were not problem solvers only roadblocks to solutions. They lacked in people skills (often called soft skills). They were labeled "hard to work with", "Dr. No", the place where ideas go to die, etc..
If you wish to rise up to managerial levels I suggest you work hard on your people skills AND business skills. If you cannot get past the response of "The regulation says X, so we must do X!" then you will struggle. Higher management has to look at the whole picture, not just can we comply with regulation X. If the solution you are proposing costs a million dollars and the executive does not have it in her budget, then no amount of demanding, stalling, denying other things, or refusal to let them go forward will help. You need to get to a point where you can say something like this:
ISO: The regulations say X. It will cost us $1,000,000 to implement option A.
Exec: I don't have $1,000,000.
ISO: OK, then our risk exposure of not being compliant with X is this. We can (reduce, mitigate, transfer, etc.) by doing option B which will cut our risk to Y, but will leave the remaining risk at level K. It will only cost $200,000.
Exec: I'm sorry but I don't even have that in the budget.
ISO: OK. So if we do nothing we will not be in compliance with X. Our level of risk is at level M. This leaves us vulnerable to X,Y,Z. We will continue to look for ways to reduce this risk but for the mean time, are you OK with accepting that level of risk?
Exec: That is where we are, so yes, I will accept that risk.
ISO: I will get the paperwork fixed up for you to sign. Thank you.
Please go work on your people skills and become more flexible in your approach. Learn how to integrate the business portion into the solutions you provide. Tie your security initiatives to the strategic plan/goals of the organization. Learn business, leadership and managerial skills. Understand that there is a difference between management and leadership. Your local libraries are often a good source of free information. Doing these things will help get more of your solutions accepted and help you be more promotable.
