The Scapegoat Score

Can anyone clearly explain why the last security leader left?

A vague answer from everyone you ask is the single most reliable tell.

Did you meet the CEO at any point in the process?

For an executive seat, never meeting the chief executive says how the role is really ranked.

Has this search been open 6+ months, or had multiple failed hires or short-tenured owners?

Either the spec is broken or candidates keep discovering something late.

Would you report to the CEO or one level below (CTO, COO, President)?

Three layers down is not an executive seat, whatever the title says.

Do you get guaranteed board or audit-committee access, at least quarterly?

Accountability to the board without access to the board is the scapegoat geometry.

Do you own the security budget and the headcount plan?

If IT owns your budget, IT owns your program. You own the outcomes.

Are you accountable for breach or compliance outcomes without authority over the engineering priorities that create the risk?

Responsibility without authority is the definition of the trap.

Will they confirm in writing that you are covered as an officer under the D&O policy?

Post-Uber, post-SolarWinds: personal exposure is real. Verbal assurance is not coverage.

Is a board-approved indemnification agreement on the table?

The GC engaging on this seriously is itself a green flag.

Does the offer include severance with termination-without-cause and change-of-control protection?

CISOs get fired for other people’s incidents. Price that in before you sign.

Has anyone senior framed the role as “we just need to get compliant” or “we need someone to own security” (said with relief)?

Listen for the exhale. Relief means they are handing something off, not building something.

When you raised severance, liability, or budget in writing, was the reaction hostile or evasive?

The wrong reaction to a diligence question from the most-scapegoated role in the C-suite is itself the answer.