Cyber Security Lead

We are looking for an experienced Cyber Security Lead to take ownership of cyber security strategy, governance, risk and resilience across a complex, safety-critical and highly regulated organisation.

This is a senior leadership position responsible for developing and delivering the organisation's cyber security strategy, protecting critical information, technology, operational systems and digital assets from current and emerging threats.

You will act as the organisation's senior cyber security subject matter expert, providing clear advice and assurance to senior management and the Board while embedding a proportionate, risk-based security culture throughout the business.

The role will have particular responsibility for both corporate IT and Operational Technology (OT) environments, making this an excellent opportunity for someone who understands the additional challenges involved in securing industrial systems and critical operational infrastructure.

• Develop and deliver the organisation's cyber security and information security strategy.
• Establish a multi-year cyber security roadmap aligned with business objectives and risk appetite.
• Lead cyber security risk management, governance and assurance across the organisation.
• Maintain the cyber security risk register and oversee appropriate mitigation plans.
• Provide cyber security advice and assurance to senior leadership and the Board.
• Ensure alignment with relevant legislation, UK GDPR and recognised security frameworks including ISO 27001, Cyber Essentials Plus and NCSC principles.
• Oversee vulnerability management, penetration testing, security monitoring and incident response.
• Lead the organisational response to significant cyber security incidents.
• Develop and maintain cyber incident response, business continuity and disaster recovery arrangements.
• Provide oversight of cyber security across Operational Technology, industrial control systems and critical operational infrastructure.
• Manage third-party and supply-chain cyber security risks.
• Develop organisation-wide cyber security awareness and training programmes.
• Lead and develop internal cyber security capability and specialist external resources.
• Manage cyber security budgets, suppliers, consultants and managed security providers.
• Develop meaningful cyber security KPIs and KRIs and provide regular reporting to senior management and the Board.

We're looking for a senior cyber security professional with significant experience leading cyber security, information security or technology risk within a complex organisation.

You will ideally have:

• A degree or equivalent professional experience in Cyber Security, Information Security, Computer Science, IT or a related discipline.
• Significant senior-level cyber security or information security experience.
• Proven experience developing and implementing organisational cyber security strategies.
• Strong knowledge of cyber security governance, risk management and control frameworks.
• Practical knowledge of ISO/IEC 27001 and NIST principles.
• Strong experience in cyber incident management and organisational resilience.
• Experience managing third-party and supply-chain cyber risk.
• Experience communicating complex cyber risks to senior and non-technical stakeholders.
• Experience managing budgets, suppliers and specialist cyber security providers.
• Strong understanding of UK data protection and information security requirements.

Experience in one or more of the following would be highly advantageous:

• CISSP, CISM, CRISC or CCSP
• ISO/IEC 27001 Lead Implementer or Lead Auditor
• Cyber Essentials Plus
• NCSC Cyber Assessment Framework
• Operational Technology (OT) and Industrial Control Systems (ICS)
• Manufacturing, engineering, energy, chemical, defence or another highly regulated environment
• High-hazard or safety-critical industries
• Leading major cyber incident response exercises.

We're looking for someone who can operate at both strategic and operational level.

You'll need to be confident influencing senior executives, operational leaders and technical specialists, while being able to translate complex cyber security issues into clear business risks and commercial consequences.

Strong communication, leadership, decision-making and stakeholder management skills are essential, alongside the ability to remain calm and structured during significant cyber incidents.