Chief Security Officer

Belfast, Birmingham, Cardiff, Edinburgh, Glasgow, Leeds, Liverpool, London, Manchester, Newcastle-upon-Tyne, Nottingham, Portsmouth, Telford, Worthing

Job Summary

Reporting to the Chief Digital and Information Officer (CDIO), the Chief Security Officer is a core member of the CDIO Senior Leadership Team, with overarching responsibility for safeguarding HMRC's information assets, managing security and data protection risks, and setting enterprise-wide security policies and standards across cyber, information, personnel and physical security. This role offers a unique opportunity to influence HMRC’s security agenda across wider government.

Job Description

Security Operations & Risk Management

• Deliver a range of technical security services across HMRC in an agile and risk-informed way, enabling the organisation to operate securely and effectively at scale.
• Ensure security and privacy is by design and implementation and that appropriate controls exist throughout CDIO and the wider HMRC business.
• Strengthen HMRC’s personnel security position by designing and implementing an appropriate personnel security framework.
• Establishes enterprise-level physical security policy, standards, and assurance frameworks; day-to-day operations are managed by HMRC’s Estates function.
• Drive the implementation and monitoring of compliance to relevant regulatory and government requirements (e.g., NCSC, ISO 27001).
• Oversee the identification, evaluation, and reporting of legal and regulatory, IT, and cyber security risk to information assets.
• Liaise with other functions (Finance, HR, Legal, Ethics) and third parties to ensure security and data protection risks are understood, considered, and satisfactorily mitigated.

Threat Response & Innovation

• Strategic leadership to identify, understand and effectively address emerging threats such as AI attacks, ransomware, and supply chain vulnerabilities.
• Ensure appropriate response to security incidents and drive continuous improvements by learning from them.
• Drive innovation in security technologies such as Zero Trust architecture and secure AI adoption.

Governance, Architecture, and Influence

• Facilitate an appropriate security governance structure; provide regular reporting on the status of the security and data protection programme to senior leaders, including the Executive Committee and Audit and Risk Committee.
• Work with the Head of Architecture and Innovation to build alignment between the security and enterprise architectures.
• Implement and drive policy changes across HMRC and the wider government. Represent HMRC on relevant cross-government boards and engage with the Government Security Group to influence and help deliver the cyber, physical and personnel security policy agenda across government.
• Liaise with external agencies, such as law enforcement and other advisory bodies, including National Technical Authorities.
• Build and nurture external networks consisting of peers in government and industry to address common trends, findings, incidents, and cybersecurity risks.

Accountability & Public Trust

• Define and report on security performance metrics to demonstrate accountability and effectiveness.
• Promote public trust through transparent security practices and effective communication.

Person specification

Essential Criteria

• Professional Expertise & Standards - demonstrates a deep and current understanding of information security principles, technologies, and control frameworks. This is evidenced by relevant security qualifications and practical experience, alongside professional certifications such as CISSP, CISM, or equivalent. Shows a strong commitment to delivering against recognised industry standards and best practices.
• Executive Security Leadership - proven strategic leadership in managing security, risk and compliance across large, complex organisations and technology environments. Brings an outstanding track record of shaping and delivering enterprise-wide security programmes that support organisational resilience and regulatory compliance.
• Technical Authority & Innovation - extensive technical expertise across multiple domains of security and compliance, with the ability to exercise independent judgment and make high-impact decisions. Demonstrates a forward-looking approach to emerging threats, including experience in researching and implementing innovative solutions such as Zero Trust architectures, secure AI, and other cutting-edge security models.
• Strategic Influence & Stakeholder Management - exceptional influencing, negotiation, and relationship-building skills, with a proven ability to engage and maintain trust with senior stakeholders across government, industry, and third-party providers. Able to align security strategy with broader organisational goals through effective cross-functional collaboration.
• Organisational Change & Vision - demonstrable experience in anticipating and preparing for major organisational or technological shifts, including emerging cyber threats. Confidently leads through uncertainty, ensuring the organisation remains agile and informed.
• Team Leadership & Development - proven ability to build, lead, and develop high-performing teams across multiple locations. Skilled in empowering senior managers and specialists within the security and compliance disciplines, fostering a culture of excellence, accountability, and continuous improvement.