Summary

Being an independent InfoSec consultant is not for everyone. One must not only have the education and experience in the InfoSec profession to be successful, but also the required personality, self-discipline, and confidence. The bottom line is that it's not really better being an independent consultant, just different. New headaches replace old ones, and different benefits arise. The real change is in lifestyle and sources of stress. The new boss is the client, and some can be better or worse than your old boss. The good part is that you only have to deal with a bad "boss" for the duration of the engagement.

Some ISSOs working for corporations believe that they can succeed but have not conducted sufficient, objective analysis to validate their beliefs. Before beginning a career change from a corporate ISSO to an independent InfoSec consultant, you should develop a detailed business plan and supporting project plan. In doing so, you may find that being a consultant is not something you can do. It is better to find that out before making the career change than afterwards.