A full-time information security professional might not be the best use of your organizations resources. A typical ISM adds to your payroll, is hard to find, hard to retain, and (in the humble opinion of this author) not very productive after the first months on the job. Instead of incurring the costs and headaches of an employee dedicated to a limited range of duties, most companies would benefit from employing an effective Information Security Program with the use of automated, cloud-based tools and cost-effective third parties.”]
Source: https://informationsecuritybuzz.com/news/really-need-information-security-manager/