Head of Cyber Strategy & Resilience

Head of Cyber Resilience & Strategy (Deputy CISO type role)

• Define and execute the organisation's cyber resilience strategy, ensuring the business is prepared to prevent, respond to, and recover from significant cyber incidents.
• Develop and maintain a multi-year cyber resilience roadmap aligned to business objectives and risk priorities.
• Own the cybersecurity investment portfolio, prioritising initiatives based on risk reduction, business value, and operational resilience outcomes.
• Ensure organisational resilience objectives are achieved, with a focus on response, recovery, and continuity following cyber events.
• Establish and track OKRs, KPIs, and performance metrics to measure strategic progress and programme effectiveness.
• Manage execution of the cyber resilience strategy, including financial governance, portfolio tracking, and benefits realisation.
• Lead the annual strategy review process and continuously evolve the resilience roadmap in response to emerging threats and business needs.
• Develop business cases, manage investment planning activities, and oversee OpEx/Cap Ex expenditure across the cyber resilience portfolio.
• Manage third-party security and supplier governance, including performance reviews and risk oversight.
• Provide regular executive reporting on resilience initiatives, programme status, risks, and strategic progress.
• Develop and maintain the cyber resilience framework, crisis management programme, and business continuity recovery strategy.
• Lead cyber crisis management exercises, tabletop simulations, recovery testing, and cyber recovery preparedness activities.
• Facilitate resilience testing and operational readiness activities to ensure effective response to enterprise-wide cyber threats.
• Collaborate with Business Continuity, Disaster Recovery, Technology, and Operational teams to conduct Business Impact Analysis (BIA) and criticality assessments.
• Lead third-party cyber risk management activities, including risk assessments, due diligence, remediation tracking, and ongoing governance.
• Govern enterprise-wide security remediation activities, ensuring risks are prioritised, tracked, and remediated within agreed timelines.
• Drive remediation governance processes, including escalation and oversight of overdue actions and SLA breaches.

• 7-10+ years' experience in Cyber Security, Cyber Resilience, Business Continuity, Technology Strategy, or Risk Management.
• Proven experience developing and executing multi-year cyber resilience strategies, roadmaps, and operating model improvements.
• Strong background in crisis management, cyber recovery, business continuity, disaster recovery, and resilience planning.
• Experience conducting and overseeing BIA, criticality assessments, resilience testing, and recovery exercises.
• Demonstrated experience managing cyber security investment portfolios, budgets, and business cases.
• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Business Administration, or a related discipline.
• Industry certifications such as CISSP, CISM, CBCP, CRISC
  , or equivalent.
• Strong understanding of cyber risk management, third-party risk management, and resilience frameworks.
• Strategic planning, programme management, or portfolio management qualifications are advantageous.
• Strong financial management, stakeholder engagement, and executive communication skills.