@JKWiniger wrote:
As I am currently in the market for a new position I am faced with how bad IT and security job descriptions are.
This has been a problem for a long time, and it is only getting worse. Foremost, on this issue of CISO's and to which other CxO they report, these titles are often considered a matter of vanity or corporate cutesy (naming someone the "chief vision officer," etc.). The corporate officer title alters both the liability and indemnification of the individual. Board and senior management might not realize that since most of them are happily naked standing in front of the governance mirror, admiring their well-tailored arrogance, but likely under state law, their bylaws, and their directors and officers insurance, there is a huge factor in whether someone is designated an "officer" in their job title.
I would strongly encourage organizations to use the "officer" title sparingly. In a similar vein, don't call managers "directors" unless they are truly a director (i.e. have some strategic responsibility in addition to an executive one).
The problem is the title "manager" got too pedestrian for the workplace so we had to start creating these elaborate and amorphous titles, and then so as to not make decisions or hurt people's feelings, we started making dotted reporting lines, and you end up in the Office Space scenario where one person has five bosses.
When that one person leaves (due largely to burnout), HR asks for a job description, and it ends up reflecting the five departments to which the person "reported." These are not trivial issues. In addition to encouraging managerial bloat, if you don't define your roles, it's like drafting a football team of all quarterbacks. You need a structure, roles, and titles that reflect both so end up with a team that works well.
Ultimately, it all gets back to governance, which is to say it gets back to the board.
