Chief Information Security Officer

Spencer Scott - Technology Recruitment; Greater London; Hybrid; GBP 135,000 - 165,000; Full time

Benefits offered by this job

Company pension

Private health care

Hybrid work format

Job summary

[Unknown] is seeking a Chief Information Security Officer to define and lead the enterprise cyber security strategy in London. The role focuses on governance, risk, and operational resilience across data, systems and third parties.

You will oversee security operations, architecture, and incident response, while aligning with regulatory requirements and a strong security culture. Hybrid work with two days in London office.

Qualifications

• Proven experience as a CISO or senior cyber security leader in regulated financial services.
• Experience defining and delivering enterprise cyber security strategies, roadmaps and investment plans.
• Strong knowledge of cyber security governance, risk management, operational resilience and frameworks like ISO 27001 and NIST.
• Experience leading Security Operations, incident response, threat management and vulnerability management.
• Expertise in cyber risk management across cloud, infrastructure, applications, identity and third-party suppliers.
• Knowledge of FCA, PRA, Lloyd's regulations and GDPR; ability to report to executives and boards.
• Desirable professional qualifications such as CISSP, CISM, CRISC.

Responsibilities

• Define the enterprise cyber security vision, strategy, roadmap, investment priorities and risk reduction aligned to business objectives.
• Own cyber security policies, standards, control frameworks and governance forums, and lead risk reporting across the organisation.
• Lead enterprise cyber risk management, assessing and reporting risks across technology, data, services, suppliers and changes.
• Oversee security operations including SOC, SIEM, threat detection and vulnerability management.
• Define cyber resilience and recovery requirements and ensure capabilities to respond to cyber disruption and incidents.
• Provide leadership for security architecture across cloud, infrastructure, applications, identity, APIs and DevSecOps.
• Govern third-party cyber security risk across SaaS, cloud services and MSPs within the risk framework.
• Lead regulatory and audit assurance activities and reporting to regulators, internal/external audit, and Board committees.
• Lead cyber-security incidents response with crisis management, legal, comms and operations partners.
• Foster a strong security culture through awareness and secure-by-design practices.

Skills

CISO leadership

Cyber governance

Risk management

ISO 27001

NIST

Regulatory awareness FCA PRA Lloyd's

Executive reporting

Education

CISSP/CISM/CRISC or equivalent

Job description

We have a new opportunity for a Chief Information Security Officer (CISO) to join a London City based Financial Services organisation. This permanent position will be responsible for defining and leading the Company’s enterprise cyber and information security strategy.

The new CISO will lead the protection of the business’ data, systems, services, customers, market operations and reputation through effective governance, risk management, security controls, cyber operations, incident response, cyber assurance of third parties and support for the cyber aspects of operational resilience.

This CISO position will work on a Hybrid format with two days per week spent in the Company’s London City office with the remaining days based working from home. The position will offer a basic salary up to £150,000 + Annual Bonus, Company Pension, Private Health Care plus various other benefits promoting a brilliant work / life balance.

While in any CISO position there is rarely a typical day, here’s an insight into some of the key parts of the role:

• Define the enterprise cyber security vision, strategy, roadmap, investment priorities, target maturity and risk reduction plan aligned to business objectives.
• Own cyber security policies, standards, control frameworks, governance forums, exception processes, and lead cyber risk reporting across the organisation.
• Lead the enterprise cyber risk management framework, assessing, challenging and reporting cyber risks across technology, data, business services, suppliers and change portfolios.
• Oversee security operations including SOC, SIEM, threat detection, vulnerability management, cyber monitoring and operational security controls.
• Define cyber resilience and recovery requirements and ensure that appropriate capabilities are in place to respond to and recover from cyber disruption, ransomware, data corruption, identity compromise, cloud outages and supplier incidents, aligned with the overall operational resilience framework.
• Provide leadership for security architecture and engineering, ensuring secure design across cloud, infrastructure, applications, identity, APIs, DevSecOps and digital services.
• Define requirements for, assess and govern third-party and supply-chain cyber security risk across SaaS providers, cloud services, managed service providers, outsourced operations, brokers, coverholders, DCAs and TPAs, working within the wider third-party risk framework.
• Lead cyber security related regulatory and audit assurance activities, providing evidence and reporting to Lloyd’s, FCA, PRA, ICO, internal audit, external audit and Board committees.
• Lead cyber-security and related technical response to major cyber incidents, working with crisis management, legal, communications, privacy, operations and technology teams in line with the established crisis management framework and leadership.
• Build a strong security culture through enterprise-wide awareness, training, behavioural change initiatives and secure-by-design practices.

For this particular role there are some important qualifications and experience we are looking for;

• Proven experience as a CISO, Deputy CISO or senior cyber security leader within regulated financial services or other large scale data-rich business.
• Demonstrable experience defining and delivering enterprise cyber security strategies, roadmaps and investment plans.
• Strong knowledge of cyber security governance, risk management, operational resilience and industry frameworks such as ISO 27001 and NIST.
• Experience leading Security Operations, incident response, threat management and vulnerability management functions.
• Expertise in cyber risk management across cloud, infrastructure, applications, identity and third-party suppliers.
• Knowledge and experience of the cyber security requirements of FCA, PRA, Lloyd's and the wider regulatory landscape, including GDPR and audit requirements.
• Experience presenting cyber risk, security performance and major incidents to Executive Committees, Boards and Risk Committees.
• Relevant professional qualifications such as CISSP, CISM, CRISC or equivalent are desirable.

Spencer Scott Ltd is an equal opportunity Recruitment Agency, which means we do not discriminate on the basis of race, colour, religion, marital status, age, national origin, ancestry, physical or mental disability, medical condition, pregnancy, genetic information, gender, sexual orientation, gender identity or expression. We celebrate diversity and are committed to create inclusive working environments for all our clients.