Ethical hacker and CISO are totally different jobs and require different sets of interest. Why would you chart a path like that unless you're primarily motivated by big money?