VP Information Security

GXO Logistics, Inc; Greater London; Hybrid; GBP 100,000 - 130,000; Full time

Job summary

GXO Logistics, Inc is seeking a Deputy CISO to lead day-to-day execution of its global cybersecurity program, ensuring strategic alignment and robust operations within a complex logistics environment. The position requires over 15 years in information security, with a focus on security strategy, risk management, and team leadership. Candidates should possess a Bachelor's degree and relevant security certifications. This role offers a pivotal opportunity to shape cybersecurity practices and influence enterprise risk posture, accommodating up to 20% travel.

Qualifications

• 15+ years in information security with progressive leadership.
• 8+ years leading multi-disciplinary teams across SecOps/IR, GRC, Engineering/Architecture.
• Demonstrated success in interfacing with executive boards.

Responsibilities

• Support the CISO in translating enterprise risk appetite into a security strategy.
• Oversee Security Architecture and Engineering.
• Accountable for SOC performance and incident response.

Skills

Leadership

Cybersecurity strategy

Incident response

Governance, risk & compliance

Continuous improvement

Education

Bachelor's degree in computer science, engineering, or related field

CISSP or CISM certification

Job description

The Deputy CISO is the CISO’s principal delegate and second‑in‑command, accountable for day‑to‑day execution of the global cyber security program, team leadership and for elevating security influence across the enterprise. The role ensures cohesive strategy, robust operations, and clear business alignment in a complex logistics environment, including WMS/TMS platforms and warehouse robotics, IoT, and OT. The Deputy CISO strengthens succession planning, executive decision‑making, and senior business partnering across the organisation.

Operates in a global role, based at either of our UK corporate HQs (London or Northampton).

Key Responsibilities

• Support the CISO in translating the enterprise risk appetite into an actionable, outcome‑driven security strategy; and support the multi‑year roadmap and quarterly OKRs.
• Chair the executive security governance forums and drive enterprise security governance mechanisms.

Architecture & Engineering

• Oversee Security Architecture and Engineering; ensure “secure‑by‑default” across cloud, application, data, identity, and infrastructure landscapes.
• Establish IDAM function with clear RACI and coherent operating model.
• Govern the security tooling strategy and operating model (build vs. buy vs. MSSP); maximize value from SIEM, SOAR, IAM, PAM, EDR, DLP, DSPM, and CTI platforms.

Security Operations & Incident Response

• Accountable for SOC performance (24×7 detection, response, threat hunting), DFIR, purple‑team/assurance, ransomware preparedness, and crisis playbooks.
• Maintain executive incident communications, regulator notifications, and post‑incident improvements.
• Act as escalation point for any security related service failures or major incidents.

Threat and Vulnerability Management

• Support the TVM team in continuously reducing vulnerability levels in the organisation.
• Recommend procedural improvements and reporting to drive constant improvement.
• Drive secure‑by‑design into applications and ensure all applications and the wider estate are sufficiently tested for signs of vulnerability.

Governance, Risk & Compliance (GRC)

• Ensure audit readiness, control effectiveness (key SOX/ITGC, NIST/ISO mappings), and remediation governance; lead policy lifecycle and attestations.
• Oversee the enterprise risk process (RCSA, KRIs), executive reporting, and board risk briefings.
• Improve third‑party risk management (carriers, 4PL/3PL partners, SaaS/IaaS providers) and regulatory alignment.

Business Partnering & PMO

• Ensure the Business Partnering function embeds security in product/platform roadmaps and regional operations (Americas/EMEA/APAC).
• Oversee the InfoSec PMO: portfolio selection, prioritization, benefits tracking, and transparent delivery reporting to business and technology leaders.
• Provide day‑to‑day management of InfoSec senior leaders (four directors/senior directors) and their teams; build succession paths, mentorship, and leadership development.
• Sponsor Security Awareness & Culture programs and executive engagement; promote inclusive, high‑performance behaviors.

The role has enterprise‑wide accountability for the execution of the global cyber security program, ensuring effective risk management, operational resilience, and alignment with business strategy. It influences executive decision‑making, enterprise risk posture, and regulatory outcomes across a complex global logistics environment.

You will operate in a complex and evolving threat landscape, requiring continuous improvement of security processes, tooling, and operating models. You will address ambiguous and high‑impact challenges across technology, risk, and business domains with enterprise‑wide implications.

The role engages extensively with the CISO, regulators, and senior business and technology leaders. It is responsible for executive‑level incident communications, regulatory engagement, and influencing security outcomes across regions and functions.

You will provide leadership to senior InfoSec leaders and their teams, supporting performance, development, and succession planning across the global security organisation.

Experience and Qualifications Required

• 15+ years in information security with progressive leadership; 8+ years leading multi‑disciplinary teams across SecOps/IR, GRC, Engineering/Architecture and Business Partnering.
• Demonstrated success interfacing with boards/executive committees; executive incident leadership and public/regulatory communications.
• Deep experience in either GRC or technical cyber security.
• Experience in managing and leading global cross‑functional and cross‑regional tech teams.
• Experience in Continuous improvement, Six Sigma or other improvement tools to drive business performance and create value.
• Strong understanding and maturing of IT operating models in matrixed, global environments.
• Demonstrated success in driving technology standardization and transformation programs.
• Bachelor's degree in computer science, engineering, or a related field; advanced degree preferred.
• CISSP (or CISM).
• Other security certifications.
• Travel requirement - up to 20%.

GXO is an equal opportunity employer. We celebrate, support and thrive on diversity and are committed to creating an inclusive environment for all employees. We believe that diversity and inclusion in our business is critical to our success as a global company, and we seek to recruit, develop and retain the most talented people from a diverse candidate pool. We are an Armed Forces friendly organisation and Disability Confident Leader as part of the Disability Confident Scheme (GIS) and actively welcome applications from people with disabilities.