Chief Information Security Officer

Salary: £100, per year

• Senior security leader (CISO, deputy CISO or head of security) with a track record in complex, fast-moving organisations, including standing up or substantially rebuilding a security function.
• Executive-level ownership of security strategy, risk and assurance, including presenting risk clearly to boards and audit committees.
• Operational accountability for detection, response and incident management, including selecting and directing an in-house, managed service or hybrid delivery model.
• Strong knowledge of security standards and compliance, including the NCSC Cyber Assessment Framework, government security standards or comparable regulated regimes, and experience translating them into practical, proportionate controls.
• Demonstrable expertise in strategic cyber security planning, governance, risk management, security architecture and incident management.
• Experience securing major technology transitions, including cloud adoption, separation from shared or outsourced services, and programmes delivered through multiple partners.
• Accountability for personal data security under UK GDPR, including breach response.
• Ability to communicate security clearly and credibly to executives, boards and non-specialists.
• Comfort working where structures and processes are still being established, making sound decisions at pace with imperfect information.
• Willingness to govern and personally deliver key parts of our security capability.
• Commitment to keeping abreast of changes in the security and regulatory landscape and our business.
• Desirable: experience in energy, utilities or critical national infrastructure, including understanding operational technology and energy-system resilience.
• Desirable: experience in government, arms-length bodies or other high-assurance settings, including working with the NCSC.
• Desirable: experience exiting shared or outsourced services and establishing independently owned security operations.
• Desirable: recognised security qualifications such as CISSP or CISM, or an equivalent demonstrable record.
• Personal qualities: ownership, confidence in decision-making, constructive challenge, outcome focus, collaboration, inclusive relationship-building, adaptability, curiosity, resilience and resourcefulness.

• Review the recorded security decision log from our establishment phase, confirm or adjust recommendations against the evidence, and carry decisions through to delivery.
• Establish our security operating model and minimum security requirements, applying best practice and selecting which established ℐCS security foundations within DESNZ we carry forward.
• Decide and implement our model for detecting and responding to attacks, with accountability documented at every stage of separation from shared services.
• Confirm the standards we must meet, close priority gaps and establish an assurance regime reporting through the Digital Investment Governance Committee to the Audit, Assurance and Enterprise Risk Committee.
• Secure our cloud, collaboration, staff identity and access environments as they are established, ensuring new services launch on secure foundations.
• Establish practical incident-response plans, roles, on-call arrangements and exercises.
• Baseline our security maturity, agree a target state and publish a prioritised improvement roadmap with clear ownership and progress measures.
• Embed security requirements in our procurements and strategic partner framework, and assure our first major deliveries against them.
• Develop the case and plan for our permanent security function, growing capability alongside the estate it protects.

• Cloud
• Incident Management
• Support
• Security
• ARM
• Architect
• Exposed

We are Great British Energy (GBE), a national public…