Due to the sophistication of cyber threats, organizations need to be defended on a strategic level, leading to the emergence of the cybersecurity leader role. However, the necessary competencies required for successful response are not fully understood due to the unique demands of the role. To bridge this gap, it is crucial to explore how these competencies manifest in practice. Data were collected through interviews and open ended surveys of cybersecurity leaders, which were analyzed using the method of thematic analysis. Four key themes related to necessary competencies were identified: one on knowledge, two on skills, and one on attitudes. The study found that cybersecurity leaders emphasize the importance of having knowledge about the organizational architecture, skills to simplify incident handling procedures, and the ability to convince management to invest in better incident preparedness. They also highlighted the need for a supportive and approachable environment to facilitate optimal cybersecurity incident handling.

Small fintech companies face significant cybersecurity challenges that require specialized leadership competencies. This study identifies the critical competencies needed by cybersecurity leaders in small Fintech companies, guided by the ISO 27021:2017 standard. Utilizing a mixed-methods approach, the research includes semi-structured interviews and surveys with participants from eleven Fintech companies in Pakistan. Key findings highlight the importance of strategic leadership, particularly in aligning cybersecurity strategies with business objectives, ensuring regulatory compliance, and managing resources effectively. Incident response management is also crucial, emphasizing the need for developing and implementing response playbooks, leading teams effectively, and conducting thorough root cause analyses. Technological proficiency, including familiarity with emerging cybersecurity technologies and strong encryption standards, is essential for maintaining robust defenses. The study concludes with recommendations for training and development programs aimed at enhancing the competencies of cybersecurity leaders in the fintech sector, thereby improving the overall security posture and resilience of small fintech companies.