Security Architecture and Design Authority

• Provide strategic security architecture oversight across the account, ensuring security requirements are reflected within technology strategy, solution design and service evolution.
• Act as the security authority for the review and challenge of significant architectural, technology and service changes.
• Ensure security-by-design principles are embedded throughout the service lifecycle and considered within all material design decisions.
• Assess the impact of architectural decisions on security risk, operational resilience, compliance obligations and business objectives.
• Provide independent security challenge to proposed solutions, identifying opportunities to improve security, resilience and risk management outcomes.
• Work collaboratively with client architects, service architects and delivery teams to ensure security architecture principles are consistently applied.
• Support transformation initiatives by providing strategic security guidance and architecture oversight.
• Ensure security architecture considerations are integrated into service roadmaps and future-state planning.
• Maintain awareness of emerging technologies, threats and industry practices to ensure security architecture remains effective, proportionate and aligned with business objectives.

Regulatory, Contractual and Compliance Oversight

• Maintain a strong understanding of applicable regulatory requirements, industry standards and evolving security expectations relevant to the client environment.
• Develop and maintain effective working relationships with client Risk, Compliance, Legal, Audit and Operational Resilience stakeholders.
• Provide trusted advice and guidance on the interpretation and application of regulatory, contractual and security requirements.
• Ensure regulatory, contractual and policy obligations are understood and appropriately reflected within security governance, assurance and service delivery activities.
• Work collaboratively with stakeholders to support the achievement and maintenance of compliance objectives.
• Support organisational readiness for internal audit, external audit, assurance reviews and regulatory engagement activities.
• Assess the impact of changes in regulatory, legal and industry requirements on the account and advise on appropriate actions.
• Promote a proactive approach to compliance, ensuring security controls, processes and governance arrangements continue to support regulatory expectations.
• Provide oversight and challenge to ensure identified compliance risks, findings and remediation activities are effectively managed through to completion.
• Support the development of a strong control environment through effective governance, assurance and continuous improvement activities.
• Ensure security governance and assurance arrangements evolve in line with changes in regulation, business strategy, technology and risk.

Continuous Improvement

• Drive continual improvement in security governance, assurance and risk management practices.
• Ensure lessons identified from incidents, audits, assessments and reviews are translated into measurable improvement activities.
• Promote adoption of security best practice across account teams.
• Encourage innovation and effective use of security capabilities to improve security outcomes.
• Support the ongoing development of security maturity, operational resilience and assurance effectiveness across the account.

What you'll bring;

Experience

• Minimum 7 years' experience in a senior information security leadership, Security Director, CISO or virtual CISO role.
• Proven experience providing strategic security leadership within large, complex and regulated organisations.
• Experience acting as a trusted advisor to executive leadership, client security teams and senior business stakeholders.
• Experience developing and leading security governance, risk management and assurance programmes.
• Experience owning and maintaining Security Management Plans and associated governance and reporting frameworks.
• Experience leading security assurance activities, managing audit engagements and driving remediation activities through to completion.
• Significant experience in enterprise security architecture, security design assurance and security-by-design principles.
• Experience reviewing and challenging technology, cloud, infrastructure and transformation initiatives from a security, resilience and risk perspective.
• Experience operating within outsourced, managed service and multi-supplier delivery environments.
• Proven ability to influence senior stakeholders and drive security outcomes without direct management authority.

Knowledge and Skills

• Security governance, risk management and assurance, including the design and operation of effective governance and reporting frameworks.
• Enterprise security architecture and the application of security-by-design principles across technology and business change initiatives.
• Security oversight of technology strategy, cloud adoption, infrastructure modernisation and digital transformation programmes.
• Risk-based decision making, balancing business objectives, regulatory obligations and security requirements.
• Regulatory compliance and the practical application of security, resilience, outsourcing and third-party risk management requirements.
• Translation of complex security, technical and regulatory issues into clear business, risk and assurance outcomes.
• Development of meaningful security metrics, reporting and management information to support executive decision making.
• Audit, assurance and control effectiveness assessment, including evidence-based assurance practices.
• Commercial awareness and an understanding of how security supports business objectives, operational resilience and customer confidence.
• Excellent stakeholder management, negotiation, communication and influencing skills.
• Strong judgement and decision-making capability in complex business, technology and risk environments.

Qualifications and Professional Membership

• CISSP, CISM, CRISC, CCISO or equivalent recognised senior cyber security qualification.
• UK Cyber Security Council Professional or equivalent recognised accreditation.
• Member of a professional industry body.
• Evidence of continuing professional development and industry engagement.