Chief Security Officer

About the job

Job summary

Interested in helping to shape HMRC's digital future by developing and delivering a world-class security function? Hear from Daljit Rehal, Director General and Chief Digital and Information Officer, about why you should apply for the role:

Reporting to the Chief Digital and Information Officer (CDIO), the Chief Security Officer is a core member of the CDIO Senior Leadership Team, with overarching responsibility for safeguarding HMRC's information assets, managing security and data protection risks, and setting enterprise-wide security policies and standards across cyber, information, personnel and physical security.

This role offers a unique opportunity to influence HMRC's security agenda across wider government.

Job description

Security Operations & Risk Management

• Deliver a range of technical security services across HMRC in an agile and risk-informed way, enabling the organisation to operate securely and effectively at scale.
• Ensure security and privacy is by design and implementation and that appropriate controls exist throughout CDIO and the wider HMRC business.
• Strengthen HMRC's personnel security position by designing and implementing an appropriate personnel security framework.
• Establishes enterprise-level physical security policy, standards, and assurance frameworks; day-to-day operations are managed by HMRC's Estates function.
• Drive the implementation and monitoring of compliance to relevant regulatory and government requirements (e.g., NCSC, ISO 27001).
• Oversee the identification, evaluation, and reporting of legal and regulatory, IT, and cyber security risk to information assets.
• Liaise with other functions (Finance, HR, Legal, Ethics) and third parties to ensure security and data protection risks are understood, considered, and satisfactorily mitigated.

Threat Response & Innovation

• Strategic leadership to identify, understand and effectively address emerging threats such as AI attacks, ransomware, and supply chain vulnerabilities.
• Ensure appropriate response to security incidents and drive continuous improvements by learning from them.
• Drive innovation in security technologies such as Zero Trust architecture and secure AI adoption.

Governance, Architecture, and Influence

• Facilitate an appropriate security governance structure; provide regular reporting on the status of the security and data protection programme to senior leaders, including the Executive Committee and Audit and Risk Committee.
• Work with the Head of Architecture and Innovation to build alignment between the security and enterprise architectures.
• Implement and drive policy changes across HMRC and the wider government. Represent HMRC on relevant cross-government boards and engage with the Government Security Group to influence and help deliver the cyber, physical and personnel security policy agenda across government.
• Liaise with external agencies, such as law enforcement and other advisory bodies, including National Technical Authorities.
• Build and nurture external networks consisting of peers in government and industry to address common trends, findings, incidents, and cybersecurity risks.

Accountability & Public Trust

• Define and report on security performance metrics to demonstrate accountability and effectiveness.
• Promote public trust through transparent security practices and effective communication.

Person specification

Essential Criteria:

• Professional Expertise & Standards - demonstrates a deep and current understanding of information security principles, technologies, and control frameworks. This is evidenced by relevant security qualifications and practical experience, alongside professional certifications such as CISSP, CISM, or equivalent. Shows a strong commitment to delivering against recognised industry standards and best practices.
• Executive Security Leadership - proven strategic leadership in managing security, risk and compliance across large, complex organisations and technology environments. Brings an outstanding track record of shaping and delivering enterprise-wide security programmes that support organisational resilience and regulatory compliance.
• Technical Authority & Innovation - extensive…