I know very few startups that have or had a CSO/CISO. I would assume that most startups that have one, are in one of the following fields security/fintech/healthcare/education. Typically it falls on the CTO at early stage startups to ensure that appropriate security measures have been taken