Group Head of Information Security & Cyber Operations

<p class="text-muted mb-3">Group Head of Information Security & Cyber Operations</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Commutable from: Oxford, Beaconsfield, London, Uxbridge, Wycombe, Watford, Aylesbury, Windsor, Maidenhead, Reading, Hemel Hempstead.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Package: £115,000 - c.£125,000 p.a. + benefits</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">There are cyber security roles where you're brought in to maintain what already exists.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">There are others where everything is on fire and you're expected to put it out.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">This is neither.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">The foundations are there.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">There's an established function, existing capability and a business that takes information security seriously.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">But there's also a recognition that it can be better.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Much better.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And that's where you come in.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">We're looking for a Group Head of Information Security & Cyber Operations to take ownership of the function, understand exactly where it is today and then lead its next stage of maturity.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">This isn't about arriving with a pre-written playbook.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Your first job will be to get curious.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Understand the tools. The processes. The procedures. The people.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">What's working. What isn't. Where the vulnerabilities are. Where capability needs strengthening. And, importantly, what good needs to look like for this organisation.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Then you'll build the roadmap to get there.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And deliver it.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You've probably got a few scars.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Because we're not looking for somebody whose experience of transformation has predominantly been advising other people how to do it.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">We want somebody who's actually lived it.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Someone who has built or matured security operations and understands the reality of taking a function from where it is to where it needs to be.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll be comfortable navigating the competing demands of security, compliance, operations and the wider business.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Your background will be from within a complex and regulated environment.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">The sector matters.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">But the experience behind it matters more.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll know what it's like to create a strategy at 30,000 feet and then find yourself considerably closer to the ground when something needs sorting.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Because</p>

<p class="text-muted mb-3">this is a leadership position.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">But it isn't a position from which you'll simply lead at a distance.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll need to be able to strategise and execute. To challenge and support. To think long term and act today.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And, when required, roll your sleeves up and get involved.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">So, what are you actually taking ownership of?</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll lead the Group Information Security and Cyber Operations function, owning the development and delivery of the cyber security strategy and roadmap.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">That spans cyber operations and incident management; security risk, governance and compliance; cyber resilience and business continuity; security assurance; tooling and operational capability; and the continued development of the team.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll oversee areas including MDR/XDR, security monitoring, threat detection and vulnerability management, whilst operating across regulatory and contractual security</p>

<h5 class="fw-bold text-success mt-4 mb-3">requirements, including Cyber Essentials Plus.</h5>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And when significant cyber incidents occur, you'll be expected to lead.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Calmly.</p>

<p class="text-muted mb-3">Credibly.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And with the judgement to know what matters most.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">This isn't happening in isolation.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll sit on the IT Senior Leadership Team, alongside the Group Heads responsible for Architecture, Service Delivery, Software and End User.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Your influence will extend beyond your own function.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll contribute to the direction of the wider IT organisation, working with Compliance, Risk and other stakeholders whilst translating complex security matters into language that business and technology leaders can actually use to make decisions.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Because great cyber security can't exist in its own little kingdom.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">It has to work for the business it's protecting.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And here's perhaps the most interesting part.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You're not inheriting a finished product.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Think of the current function as somewhere around 6 out of 10.</p>

<p class="text-muted mb-3">Not broken. Not dysfunctional. Not requiring somebody to ride in and rescue it.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">But equally, not yet where the organisation wants it to be.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And that creates quite an unusual opportunity.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">The broad expectation looks something like this:</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">First 3 months: Discover. Get underneath the function. Understand the people, processes, technology, risks, capability and current maturity.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">3-6 months: Define. Establish the appropriate team structure and create the roadmap for the function.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">6-12 months: Build. Progress the function towards Maturity Level 2.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">12-24 months: Transform.</p>

<p class="text-muted mb-3">Drive towards Maturity Level 4 and a genuinely high-performing Information Security and Cyber Operations capability.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">How you get there is part of why we're hiring someone like you.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Who will this suit?</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Probably somebody who looks at a function that's already a 10/10 and thinks:</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">"What am I actually here to do now?"</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Someone who enjoys understanding why things are the way they are.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Who asks questions before prescribing answers.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Who can see the destination but isn't naïve about what it takes to get there.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll bring significant leadership experience.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll have influenced senior stakeholders.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Managed difficult incidents.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Made decisions when the information available wasn't perfect.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And you'll have experienced enough transformation to know that a PowerPoint roadmap is the easy bit.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Making it happen is what counts.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Relevant professional certifications such as CISSP, CISM or CRISC would be advantageous, alongside experience of areas such as outsourced SOC/MDR/XDR environments, cloud security, Zero Trust, security architecture or international/multi-site operations.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">But this appointment won't be made by counting acronyms.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">It'll be made by understanding what you've actually done with them.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">The opportunity.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">You'll have ownership. You'll have influence. You'll have a seat at the table.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And you'll have enough work ahead of you to make the role genuinely interesting.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">So, if you've already lived through security transformation...</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">If you know what good looks like because you've actually had to build it...</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">And if the idea of being handed a blank canvas rather than somebody else's finished picture</p>

<p class="text-muted mb-3">appeals to you...</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">We should probably talk.</p>

<p class="text-muted mb-3"> </p>

<p class="text-muted mb-3">Send a copy of your profile and we'll get it arranged</p>