Head of Information Security - Part Time

Sanderson; West of England; On-site; GBP 129,000 - 148,000; Part time

Job summary

Sanderson is looking for a Head of Information Security on a part-time basis to define and deliver an integrated security strategy across IT, OT and Digital. The role is based in Bristol with on-site presence once a week and a 3-day working week, reporting to the CTIO and executive leadership.

The candidate will lead security operations, risk and assurance, architecture, and governance, embedding security into delivery and aligning with regulatory requirements across multiple standards.

Qualifications

• Proven track record developing and leading security operations and incident response teams.
• Experience leading integrated security functions rather than fragmented teams.
• Strong understanding of security architecture, threat modelling, and security tools and techniques.
• Experience in highly regulated, politically exposed environments.
• Ability to balance risk, cost and business agility at executive level.
• Demonstrated influence on Board and executive decisions on cyber risk.
• Understanding of emerging threats, geopolitical risk and regulatory trends.

Responsibilities

• Define and deliver a security strategy aligned to the technology operating model.
• Own the enterprise security risk model with forward-looking insights to the Board.
• Establish a central security architecture capability with standardised patterns.
• Strengthen detection, response and recovery across IT and OT.
• Lead supplier security and segmentation between business, IT and OT.
• Build a security-aware culture through education that changes behaviour.
• Act as senior security advisor to the CTIO and executive leadership.

Skills

Security operations

Incident response

Security architecture

Threat modelling

Security tools and techniques

Regulated environments

Executive risk reporting

Board engagement

NIS Regulations

CAF

GDPR

ISO 27001

ISO 27005

ISO 31000

PCI DSS

NIST 800-30/53

CIS Top 18

OWASP Top 10

Job description

Head of Information Security - Part Time

Location: Bristol - once a week on site
Working week: 3 day working week

Salary: £700 - £800 Inside IR35 via Umbrella

The opportunity

A major client of ours is undertaking one of the most ambitious cyber resilience and security transformation programmes in its sector.

They are looking for an exceptional Head of Information Security to define and deliver an integrated security strategy across IT, OT and Digital environments, covering security architecture, risk and assurance, cyber defence, incident response and supply chain security. You will build a modern, outcome-driven function that improves resilience, enables safe transformation and gives the executive team and Board clear, data-driven insight.

What you'll do

• Strategy and operating model: Define and deliver a security strategy aligned to the technology operating model, moving the function from siloed activity to cohesive, outcome-driven services.
• Risk and assurance: Own the enterprise security risk model, shifting from retrospective assurance to forward-looking risk insight, with clear reporting to senior leaders and the Board.
• Architecture and engineering: Establish a strong central security architecture capability, embedding standardised patterns and reusable controls into programmes, design and procurement.
• Security operations and incident management: Strengthen detection, response and recovery across IT and OT, aligned to regulatory reporting and crisis management processes.
• Supply chain and segmentation: Lead a risk-appetite-based approach to supplier security, and drive segmentation between business, IT and OT environments.
• Culture and awareness: Build a security-aware culture through education that changes behaviour, not just compliance.
• Governance and leadership: Simplify governance and accountability, and act as senior security advisor to the CTIO and executive leadership.

About you

Essential experience

• Proven track record developing and leading security operations and incident response teams
• Experience leading integrated security functions rather than fragmented teams
• Success embedding security into business and technology delivery
• Strong understanding of security architecture, threat modelling, and security tools and techniques
• Experience in highly regulated, politically exposed environments
• Ability to balance risk, cost and business agility at executive level
• Demonstrated influence on Board and executive decisions on cyber risk
• Understanding of emerging threats, geopolitical risk and regulatory trends

Knowledge of relevant standards and regulation

• NIS Regulations and the Cyber Assessment Framework (CAF)
• GDPR and the Data Protection Act
• ISO 27001:2022, ISO 27005 and ISO 31000
• PCI DSS
• NIST 800-30 / 53
• CIS Top 18 and OWASP Top 10

Reasonable Adjustments:

Respect and equality are core values to us. We are proud of the diverse and inclusive community we have built, and we welcome applications from people of all backgrounds and perspectives. Our success is driven by our people, united by the spirit of partnership to deliver the best resourcing solutions for our clients.