Technology

Hire a virtual CISO in Greece and Cyprus

Security leadership a few days a month, from someone who has held the seat: the program, the risk register and the board report, with NIS2 now on the agenda.

Schedule a call How our vetting works

NIS2, transposed in Greece by law 5160/2024, has made cybersecurity a management duty, not an IT task. Few mid-market companies need a full-time security chief, but all of them need someone who owns security: a virtual CISO holds that seat a few days a month. The usual triggers:

The company falls under NIS2 and must register, name a security officer and report incidents
Management is personally accountable and wants the risk in front of it
DORA applies to the company or to the financial clients it serves in Cyprus and Greece
The managed security provider reports to nobody who can judge its work

The virtual CISOs on Hellenic Talent are elite professionals who have led security at banks, telecoms operators and consultancies, and taken companies through ISO 27001. They know what the authority and the auditor ask, and the difference between a control that operates and one that exists on paper.

What does a virtual CISO actually do?

Own the security program on a fixed rhythm of days each month
Keep the risk register ordered by what would actually hurt the business
Turn NIS2, DORA and ISO 27001 into controls with an owner and evidence each
Lead the incident response and rehearse it before it is needed
Manage the security providers against what the company needs, not what they sell
Report to the board and prepare management for the authority's questions

How to choose the right virtual CISO

What to test in the first conversation, whoever you end up hiring.

A proven part-time rhythm
Has run security a few days a month before and can say what fits in that time and what does not.
Registered an entity under NIS2
Knows what the national cybersecurity authority asks for after registration, because they have registered an entity themselves.
One page for the board
Can show the one-page security report they give a board: the top risks, what moved and what needs deciding.