Rule Base Assessment & Security Policy Change

• Lead and deliver security configuration and rule base reviews and security policy assessments for Group and divisional environments; identify technical debt, overly permissive rules, obsolete entries, and configuration drift, and provide clear, prioritised remediation recommendations.
• Provide technical review and advisory support for security policy change requests from divisions, assessing proposed changes against Group standards and architectural principles, and providing a clear recommendation with appropriate justification.
• Develop and maintain a structured approach to rule base and policy review across the Group, including tooling, methodology, scheduling, and output standards, ensuring consistent and repeatable assessment quality across different divisional environments.

Non-Functional Security Requirements

• Provide security input to non-functional requirements (NFRs) for Group and divisional programmes and projects; define the security properties that technology solutions must meet – covering areas such as authentication, authorisation, encryption, logging, resilience, and data classification – in a form that is actionable by project and engineering teams.
• Maintain and evolve a Group-standard NFR library derived from the Group cyber technical standards, enabling consistent security requirements to be applied across the programme portfolio without reinventing them for each project; work with the Cyber Architecture Manager to ensure NFRs remain aligned to the enterprise architecture.
• Engage with divisional and Group programme teams at the point where security NFRs are being defined, ensuring security is embedded by design rather than added retrospectively; provide advisory support through the project lifecycle where security design decisions need to be revisited or refined.

Mergers, Acquisitions & Strategic Project Support

• Lead the GCS advisory contribution to mergers, acquisitions, and divestiture activity; scope and deliver the cyber workstream in M&A programmes, covering pre-deal due diligence support, integration planning, and the transition of acquired entities onto the Group cyber standard.
• Provide cyber advisory resource and expertise to other significant Group and divisional strategic programmes – including major technology transformations, ERP deployments, cloud migrations, and site openings or closures – ensuring security considerations are addressed at the right point in the programme lifecycle.
• Maintain a forward view of the M&A and strategic programme pipeline in collaboration with Group corporate development and divisional leadership, enabling advisory resource to be planned and mobilised proactively rather than reactively.

Divisional Resource Augmentation & Flexible Resourcing Pool

• Manage the GCS flexible resourcing pool as an advisory and consulting resource, deploying cyber consultants and specialist advisors into divisions that require temporary uplift in security capability – whether to support a programme, fill a capability gap, or accelerate compliance with Group standards.
• Work with divisional BISOs, CIOs, and IT security leads to understand their advisory and resource needs; define the scope and objectives of each deployment clearly, brief and onboard resources appropriately, and ensure that the output of each engagement meets the division’s needs and GCS quality standards.
• Manage the demand pipeline for advisory and flexible resource deployments; prioritise requests in line with Group risk priorities, balance supply against demand, and ensure that resourcing decisions are transparent and agreed with the Deputy CISO and relevant divisional stakeholders.
• Ensure that flexible resources deployed into divisions are competent, well-briefed on standards and culture, and set up to add genuine value from day one; maintain quality standards across the pool and build a pipeline of trusted specialists who understand the environment.

Divisional Engagement & GCS Intelligence Loop

• Build and sustain trusted relationships with divisional BISOs, security leads, CIOs, and IT directors across all 11 divisions; position the Cyber Advisory Services function as a valued, accessible, and practical source of cyber expertise – not a bureaucratic overhead.
• Use divisional advisory engagements as an active intelligence-gathering mechanism; identify common themes, recurring challenges, emerging risks, and capability gaps across the estate, and bring these insights back to the GCS Leadership Team to inform strategy, standards development, and investment priorities.
• Champion the GCS advisory model as a two-way relationship; ensure divisions feel heard and that their feedback genuinely influences how GCS operates, while maintaining the Group standards and non-negotiables that the advisory function exists to support.

Team Leadership, Quality & Continuous Improvement

• Lead and develop the permanent Cyber Advisory Services team; set clear standards of advisory quality, professional conduct, and output, and foster a culture where consultants take personal pride in the value they add to the divisions they support.
• Develop and maintain a service catalogue for the Cyber Advisory Services function that clearly articulates what the function offers, how to engage it, what divisions can expect, and how outcomes will be measured; make the function easy to access and straightforward to work with.
• Work in close partnership with the Cyber Architecture Manager, Head of Cyber Assurance, and Security Platform Engineering Manager to ensure advisory activity is consistent with the GCS strategy, avoids duplication of effort, and is integrated into the broader GCS operating model.

Experience

Experience, Knowledge, Skills & Attributes - Essential

• 10+ years in cyber security, with a significant portion in advisory, consulting, or technical leadership roles requiring breadth across multiple security domains.
• Demonstrable track record of delivering cyber security advisory services in a complex, multi-entity, or federated environment – either in-house within a large group organisation or as an external consultant serving large enterprise clients.
• Hands-on experience conducting security configuration rule base reviews and security policy assessments, including use of relevant tooling and production of structured, risk-prioritised findings reports.
• Experience defining and reviewing non-functional security requirements for enterprise technology programmes, and the ability to translate Group security standards into specific, measurable, project-level requirements.
• Experience providing cyber security input to mergers, acquisitions, or divestiture programmes, including due diligence support and post-acquisition integration planning.
• Experience managing or coordinating a flexible or contract resourcing model for a technical function, including defining briefs, onboarding specialists, and maintaining quality of output across a pool