Chief Information Security Officer (CISO)

NHS University Hospitals of Liverpool Group; Liverpool City Region; On-site; GBP 140,000 - 180,000; Full time

Job summary

NHS University Hospitals of Liverpool Group (UHL Group) seeks a strategic Chief Information Security Officer to lead cyber security, governance and digital risk across its multi-site hospital network. The role shapes policy, drives assurance and aligns security with patient safety and clinical services.

You will translate national standards into practical controls, lead incident response and ensure DSPT, GDPR and Cyber Essentials Plus compliance across the group.

Qualifications

• Strategic leadership for cyber security, governance and digital risk management.
• Experience delivering cyber assurance within a large multi-site health organisation.
• Ability to translate national policy into practical security controls and operating models.

Responsibilities

• Lead incident response, forensic activity and breach investigations.
• Establish a group-wide cyber and information governance framework.
• Interface with boards to embed security, resilience and compliance across digital service delivery.

Skills

Strategic leadership

Cyber security

Security governance

Incident response

Risk management

Job description

The Chief Information Security Officer is a senior Group leadership role within Group Digital Services, accountable for leading a coherent, resilient and risk-based cyber security function across the UHL Group.

The postholder will provide strategic leadership for cyber security, digital assurance and security governance, ensuring that the Group’s digital estate, information assets and critical services are protected in a way that supports safe, effective and sustainable care delivery. The role will operate within the group-wide Digital TOM, where cyber security, information governance and digital risk management are brought together through a unified assurance framework to reduce variability, strengthen resilience and ensure compliance with national standards.

Working across the UHL Group’s multi-site environment, the postholder will translate national policy, strategic ambition and technical assurance requirements into practical controls, operating models and leadership behaviours that enable digitally enabled transformation. The role will support the UHL Group’s five-year ambition to make best use of digital and data, contribute to the analogue-to-digital shift described in the national 10-year plan, and ensure that innovation, interoperability, patient trust and clinical safety are underpinned by robust cyber resilience, secure digital design and proportionate assurance.

The CISO will establish a Group-wide cyber and information governance framework for the UHL Group. You will shape cyber strategy, define risk appetite, influence investments, and interface directly with boards to embed security, resilience, and compliance into all digital service delivery. This includes delivering comprehensive cyber assurance, information governance, and digital risk management while ensuring strict compliance with DSPT, GDPR, and Cyber Essentials Plus.

To succeed, you must translate these expectations into a robust operational capability. This involves leading incident response, forensic activity, privacy assessments, access controls, and breach investigations, ensuring clear accountability across all sites. Crucially, you will need to align with the UHL Group Target Operating Model by balancing Group-wide security standardisation with practical, locally responsive solutions tailored to individual hospitals and services.

Ultimately, success depends on building trusted relationships with clinical and operational leaders so that security is viewed as a core enabler of safe care rather than a barrier. By protecting patient confidentiality and fostering trust, the role directly supports the UHL Group’s five-year analogue‑to‑digital transformation, enabling the secure rollout of the single patient record, seamless data sharing, interoperability, and future AI adoption.

NHS University Hospitals of Liverpool Group (UHL Group) was formed on 1 November 2024, born from a shared aim to improve the care we provide our communities.

We are one of the largest employers in region, with over 18,900 colleagues who are dedicated to caring for our communities - from birth and beyond.

For the 630,000 people across Merseyside, we are their local NHS. We provide general and emergency hospital care, alongside highly specialised regional services that extend to more than two million people in the North West.

We operate from five hospital sites: Aintree University Hospital is the single receiving site for adult major trauma patients in Cheshire and Merseyside, and hosts a number of regional services including an award‑winning stroke facility. Broadgreen Hospital is home to several elective surgical, diagnostic and treatment services, together with specialist patient rehabilitation. Liverpool Heart and Chest Hospital provide specialist services in cardiothoracic surgery, cardiology and respiratory medicine, both in the hospital and out in the community. Liverpool Women’s Hospital specialises in the health of women and babies, delivering over 7,200 babies in the UK’s largest single site maternity hospital each year. The Royal Liverpool University Hospital is the largest hospital in the country to provide inpatients with 100% single en‑suite bedrooms and mainly focuses on complex planned care and specialist services.

For further details / informal visits contact: Name: Phil Welch Job title: Chief Technology Officer Email address: [e-mail] Telephone number: 0151 706 4666