Before you hire a CISO, read this