The information security profession is seeing a transition, as organizations focus more on filling roles related to business and information risk management.