Chief Information Security Officer (CISO) - SCS 1- up to £117,000 + benefits & highly-flexible working (London, Glasgow or Cardiff)

Ofgem works on behalf of energy consumers to ensure that every household and business in the UK can rely on a safe, affordable and environmentally sustainable energy supply. We are playing a vital part in accelerating the transition to Net Zero and a carbon neutral energy system. You will be playing your part in creating new energy solutions that are vital for customers, and vital for the environment.

This CISO sits at the heart of Ofgem’s Security, Privacy and Resilience function within DDSS, with responsibility for leading the organisation’s cyber and information security strategy, strengthening resilience, and ensuring security enables rather than inhibits delivery. It is a high-impact leadership role requiring clear judgement, pragmatism and the ability to build trusted relationships across the organisation and with external partners.

Team context

The CISO is a strategic leadership role at the heart of Ofgem’s security, privacy and resilience agenda. Reporting into the CDIO, you will lead the organisation’s cyber and information security capability, setting the direction for a function that enables the business to operate safely, securely and with confidence.

Overview of the role

As Chief Information Security Officer, you will create the environment and culture that ensures Ofgem can deliver services in a safe and secure way. You will lead the development and delivery of the information and cyber security strategy, shape the organisation’s security maturity, and ensure risk is managed in a balanced and proportionate way.

You will be accountable for building trust with colleagues and stakeholders, re-establishing confidence in the security function and helping create a positive cultural shift across the organisation. This is an opportunity to lead with influence, bring people with you, and be a true enabler for Ofgem.

You will be responsible for:

• Leading and driving change. You will go beyond traditional governance and assurance to take ownership from strategy through to delivery, turning priorities into action and driving change through to successful implementation and measurable impact.
• Bringing pragmatism, clarity and energy to complex security challenges, you will work closely with senior stakeholders to understand business priorities, find practical routes to “yes”, and position security as an enabler of delivery, innovation and great user experience.
• Developing and maintaining Ofgem’s Cyber strategy, associated risk register and forward work plan, addressing risks to business operations and corporate functions.
• Enabling leaders and all staff to be routinely briefed on strategic and tactical threats to Ofgem’s security, privacy and resilience, and develop mitigating actions consistent with Ofgem’s risk appetite.
• Managing Cyber assurance, data protection, security operations and response capabilities, including Incident Management on Data, leak investigations and independent investigation activity with Cabinet Office.
• Acting as a security and privacy professional, championing best practice and embedding Ofgem’s security, privacy and resilience culture within Ofgem, third parties and business partners; publish associated guidance, practices, tools, standards and templates.
• Overseeing delivery of the Cyber Assessment Framework (CAF) and Departmental Security Health Check (DSHC), working with Cabinet Office and DESNZ.
• Contributing to Directorate and Ofgem strategic programmes; partner with senior leadership to prioritise work and resources, and represent Ofgem across Government and the Energy Sector.
• Setting the strategic direction of the function and provide intellectual leadership, including strategic workforce planning; act as the SME and deputise for the Head of Cyber Security Profession, including Professional Development Lead duties.
• Detecting and analyse relevant trends; advise on implications of new technologies and uses of data; support innovation; determine security investment priorities and create a security roadmap that enables Ofgem to achieve its objectives.