Chief Information Security Officer

Public Sector Resourcing CWS; Aberdeen City; Presencial; GBP 90.000 - 110.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Performance bonus

Excellent pension

Life assurance (4x salary)

Group income protection

38 days annual leave

Professional development & training

Flexible working

Descripción de la vacante

Great British Energy (GBE) seeks a Chief Information Security Officer to establish and lead our security function in Aberdeen. You will report to the Chief Digital & Information Officer and join the leadership group shaping our digital strategy.

You will own security strategy, risk management, incident response, and data protection across cloud and on-premises, ensuring UK GDPR compliance and alignment with NCSC frameworks as the estate grows.

Formación

• Senior security leader with track record in complex organisations.
• Executive ownership of security strategy, risk and assurance.
• Operational accountability for detection, response and incident management.

Responsabilidades

• Review security decision logs and drive decisions to delivery.
• Establish security operating model and minimum security requirements.
• Decide and implement detection and response model with governance.
• Confirm standards and close priority gaps with assurance reporting.

Conocimientos

Security leadership

Executive communication

Risk management

Incident response

Security architecture

Educación

CISSP or CISM

Security governance qualification

Herramientas

Cloud security

NCSC frameworks

GRC tools

Descripción del empleo

Salary: £100,000 - 100,000 per year

Requirements:

• Senior security leader (CISO, deputy CISO or head of security) with a track record in complex, fast-moving organisations, including standing up or substantially rebuilding a security function.
• Executive-level ownership of security strategy, risk and assurance, including presenting risk clearly to boards and audit committees.
• Operational accountability for detection, response and incident management, including selecting and directing an in-house, managed service or hybrid delivery model.
• Strong knowledge of security standards and compliance, including the NCSC Cyber Assessment Framework, government security standards or comparable regulated regimes, and experience translating them into practical, proportionate controls.
• Demonstrable expertise in strategic cyber security planning, governance, risk management, security architecture and incident management.
• Experience securing major technology transitions, including cloud adoption, separation from shared or outsourced services, and programmes delivered through multiple partners.
• Accountability for personal data security under UK GDPR, including breach response.
• Ability to communicate security clearly and credibly to executives, boards and non-specialists.
• Comfort working where structures and processes are still being established, making sound decisions at pace with imperfect information.
• Willingness to govern and personally deliver key parts of our security capability.
• Commitment to keeping abreast of changes in the security and regulatory landscape and our business.
• Desirable: experience in energy, utilities or critical national infrastructure, including understanding operational technology and energy-system resilience.
• Desirable: experience in government, arms-length bodies or other high-assurance settings, including working with the NCSC.
• Desirable: experience exiting shared or outsourced services and establishing independently owned security operations.
• Desirable: recognised security qualifications such as CISSP or CISM, or an equivalent demonstrable record.
• Personal qualities: ownership, confidence in decision-making, constructive challenge, outcome focus, collaboration, inclusive relationship-building, adaptability, curiosity, resilience and resourcefulness.

Responsibilities:

• Review the recorded security decision log from our establishment phase, confirm or adjust recommendations against the evidence, and carry decisions through to delivery.
• Establish our security operating model and minimum security requirements, applying best practice and selecting which established ℐCS security foundations within DESNZ we carry forward.
• Decide and implement our model for detecting and responding to attacks, with accountability documented at every stage of separation from shared services.
• Confirm the standards we must meet, close priority gaps and establish an assurance regime reporting through the Digital Investment Governance Committee to the Audit, Assurance and Enterprise Risk Committee.
• Secure our cloud, collaboration, staff identity and access environments as they are established, ensuring new services launch on secure foundations.
• Establish practical incident-response plans, roles, on-call arrangements and exercises.
• Baseline our security maturity, agree a target state and publish a prioritised improvement roadmap with clear ownership and progress measures.
• Embed security requirements in our procurements and strategic partner framework, and assure our first major deliveries against them.
• Develop the case and plan for our permanent security function, growing capability alongside the estate it protects.

Technologies:

• Cloud
• Incident Management
• Support
• Security
• ARM
• Architect
• Exposed

More:

We are Great British Energy (GBE), a national public company working to power the UKs clean energy future through renewable-project development, investment and ownership. We aim to deliver benefits for communities and taxpayers, support jobs and local economies, and expand public ownership. Based in Aberdeen, this Chief Information Security Officer role reports to our Chief Digital & Information Officer and joins the small leadership group establishing our digital function. The postholder will advise on, coordinate and assure our approach to the NCSC Cyber Assessment Framework and the security of personal data under UK GDPR, helping us meet public-body and energy-sector standards. This is a greenfield opportunity: foundational security standards and operating-model work is underway, with decisions and their rationale recorded for the incoming leader to review and own. The role will initially work through delivery partners and transition arrangements with our incumbent provider while building our permanent function as our estate grows. We offer purpose-driven work, career development in clean-energy technologies and strategic investment, collaboration and flexible working, a competitive base salary, performance-related bonus, excellent pension, life assurance at four times salary, group income protection, 38 days annual leave, professional development and training, and a supportive, inclusive working environment. We welcome applications from all backgrounds and communities and can provide reasonable adjustments during recruitment.