Director, International ISO 27001 Information Security

Role Purpose & Context

Role Summary

The Director, International ISO 27001 Information Security, is here to design, implement, and run our entire global Information Security Management System (ISMS), making sure we're not just compliant with ISO 27001 but genuinely secure. You'll be the strategic brain behind our defence, translating complex cyber threats into clear business risks for the executive team. This role sits right at the heart of our operations, ensuring that as we grow internationally, our security keeps pace, protecting our customers, our data, and our reputation. When you do this job well, we avoid major breaches, sail through audits with flying colours, and our board sleeps soundly knowing our digital assets are safe. If it goes wrong, well, that's headline news, regulatory fines, and a massive hit to our brand. The tricky part is balancing the need for robust security with the business's constant drive for speed and innovation – it's often seen as a blocker, not an enabler. But the reward? Honestly, it's knowing you're the one standing between us and catastrophe, building a security programme that truly works and seeing your strategic vision come to life across multiple countries.

Reporting Structure

• Reports to: Chief Compliance Officer
• Direct reports: Roughly 25-100+ security professionals, including managers and specialists
• Matrix relationships: VP of Information Security & Compliance, Global Head of Information Security, CISO (International Operations),

Key Stakeholders

Internal:

• Chief Executive Officer (CEO)
• Chief Financial Officer (CFO)
• Chief Technology Officer (CTO)
• Chief Legal Officer (CLO)
• Head of Product
• Head of Engineering
• Board Audit Committee

External:

• External ISO 27001 auditors and certification bodies
• Regulatory authorities (e.g., ICO, GDPR supervisory authorities)
• Key enterprise clients and partners
• Industry security forums and associations
• Cyber insurance providers

Organisational Impact

Scope: This role directly shapes our entire business unit's strategy, market position, and regulatory standing. Your decisions impact our ability to operate globally, win new clients, and protect shareholder value. You're essentially the architect of our digital trust, influencing everything from product development to M&A due diligence.

Performance Metrics

Quantitative Metrics

1. Metric: ISO 27001 Certification Status
2. Desc: Achieve and maintain ISO 27001 certification across all international scopes of the business, including any new acquisitions or entities.
3. Target: Zero Major Non-conformities; maximum of 3 Minor Non-conformities per annual audit cycle.
4. Freq: Annually (external audit); Quarterly (internal reviews)
5. Example: Successfully renewed ISO 27001 certification for our APAC and EMEA operations in Q2 with only one Minor Non-conformity related to a documentation update.
6. Metric: Enterprise Information Security Risk Score
7. Desc: Reduce the overall quantified information security risk score for the organisation, as defined by our enterprise risk management framework.
8. Target: 10% reduction in overall enterprise risk score year-over-year.
9. Freq: Quarterly (executive review); Annually (board review)
10. Example: Reduced the enterprise risk score from 7.2 to 6.4 (on a scale of 1-10) by implementing new cloud security controls and improving third-party risk management.
11. Metric: Security Budget Adherence & ROI
12. Desc: Manage the multi-million-pound information security budget effectively, ensuring spend aligns with strategic priorities and demonstrates clear return on investment (risk reduction).
13. Target: Maintain budget variance within ±5%; demonstrate £2M+ in quantifiable risk reduction or cost avoidance annually.
14. Freq: Monthly (internal); Quarterly (CFO review)
15. Example: Delivered the Q3 security programme £50K under budget while securing a new threat intelligence platform that is projected to prevent £1.5M in potential breach costs over 3 years.
16. Metric: Business Continuity & Disaster Recovery (BCDR) RTO/RPO Achievement
17. Desc: Ensure critical business systems and data can recover within defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) following a major incident.
18. Target: 95% of critical systems meet or exceed defined RTO/RPO targets in annual BCDR tests.
19. Freq: Annually (full BCDR exercise); Quarterly (tabletop exercises)
20. Example: In the Q4 simulated ransomware attack, 98% of Tier 1 systems were restored within their RTO of 4 hours, exceeding our 95% target.

Qualitative Metrics

1. Metric: Board & Executive Confidence
2. Desc: The Board and Executive Committee proactively seek your strategic input on major business initiatives with security implications, trusting your judgment.
3. Evidence: You're regularly invited to strategic planning sessions, your recommendations are adopted without significant challenge, and board members reference your insights in other discussions. They don't just 'listen'; they act on what you say.
4. Metric: Regulatory Relationship Strength
5. Desc: Maintain a strong, transparent, and proactive relationship with key international regulatory bodies, positioning the organisation as a responsible and compliant entity.
6. Evidence: Regulators engage with you for informal consultations, there are no unaddressed regulatory findings, and the organisation is seen as a thought leader or early adopter in compliance best practices. They see you as a partner, not just a regulated entity.
7. Metric: Organisational Security Culture Adoption
8. Desc: Drive a pervasive security-first culture where employees at all levels understand and actively contribute to the organisation's security posture.
9. Evidence: Voluntary reporting of suspicious activities increases, phishing simulation click-through rates decrease significantly, and business units proactively engage your team early in project lifecycles. Security isn't just 'your' job; it's 'everyone's' job.
10. Metric: Strategic Influence & Collaboration
11. Desc: Successfully influence cross-functional leadership to prioritise security initiatives and embed security by design into product and operational workflows.
12. Evidence: Security requirements are integrated into the earliest stages of product development, engineering teams proactively consult with security architects, and major business decisions consider security implications as a primary factor, not an afterthought.

Primary Traits

• Trait: Influential
• Manifestation: You're the person who can get the CTO to delay a product launch because a critical security vulnerability isn't fixed. You'll sit down with the CFO and explain, in plain English, why a £2M investment in a new security platform isn't just a cost, but a critical risk reduction. You build strong relationships with other department heads, turning potential blockers into security champions. It’s about getting people to *want* to do the right thing for security, not just because you told them to.
• Benefit: At this level, you can't just mandate security; you have to inspire it. Without the ability to influence, your strategic vision for security will remain just that – a vision. You need to secure budgets, change behaviours, and embed security into the very fabric of the business, which simply won't happen if you can't persuade and build consensus at the highest levels.
• Trait: Decisive
• Manifestation: When a major security incident hits at 3 AM, you're the one making the call on whether to shut down critical systems, knowing it'll cost the company millions in lost revenue. You can weigh incomplete information, assess the potential business impact, and make a clear 'go/no-go' decision on a new vendor or product launch based on the security risk, even when others are hesitant. You’re comfortable with accepting a calculated risk, but only after it's been thoroughly documented and justified to the board.
• Benefit: In a crisis, analysis paralysis is fatal. The business needs a leader who can make tough, high-stakes decisions under immense pressure, often with imperfect data. Your ability to act quickly and confidently can mean the difference between a contained incident and a catastrophic breach, directly impacting the company's financial health and reputation.
• Trait: Accountable
• Manifestation: When an audit uncovers a systemic control failure, you're the first to step up and say, 'This is on me; here's our plan to fix it,' rather than pointing fingers. You proactively report near-misses and significant risks to the Executive Committee, even if it's uncomfortable, because you understand transparency builds trust. You own the remediation plan for major findings, driving it to completion, not just delegating it away. You're the person who takes the ultimate responsibility for the organisation's security posture.
• Benefit: Trust is your most valuable asset, especially when dealing with the Board, regulators, and external auditors. When you consistently demonstrate ownership for both successes and failures, you build credibility. This trust is essential for securing the resources you need, gaining buy-in for your strategic initiatives, and ensuring that when things inevitably go wrong, you have the support to navigate the fallout.

Supporting Traits

• Trait: Pragmatic
• Desc: You understand that perfect security is a myth. You're not chasing an impossible ideal, but rather focusing on the most effective ways to reduce our real-world risk within the constraints of budget and business operations. It's about smart risk management, not risk elimination.
• Trait: Diplomatic
• Desc: You're able to deliver tough news – like a failed audit finding or a necessary policy change that impacts workflows – without alienating key stakeholders. You can navigate complex political landscapes, building bridges rather than burning them, even when enforcing unpopular but essential security measures.
• Trait: Resilient
• Desc: Security is a marathon, not a sprint. You'll face incidents, audit failures, budget battles, and resistance. You need to be able to bounce back from setbacks, maintain your focus on the long-term strategic goals, and keep your team motivated through challenging times.
• Trait: Meticulous
• Desc: While you're a strategic leader, you still have a deep-seated appreciation for the details. You'll spot inconsistencies in documentation, challenge vague control descriptions, and ensure that evidence aligns perfectly with policy – especially when an external auditor is scrutinising your ISMS.

Primary Motivators

1. Motivator: Protecting the Organisation's Future
2. Daily: You're driven by the profound responsibility of safeguarding the company's assets, reputation, and continued operation. This shows up in your relentless pursuit of robust controls, your strategic planning for emerging threats, and your dedication to building a resilient security posture.
3. Motivator: Strategic Problem Solving at Scale
4. Daily: You thrive on tackling complex, multi-faceted security challenges that span international borders and impact diverse business units. You enjoy designing enterprise-wide solutions and seeing your strategic vision translate into tangible risk reduction.
5. Motivator: Building and Empowering High-Performing Teams
6. Daily: You get a real buzz from mentoring and developing a large team of security professionals, seeing them grow, and enabling them to deliver impactful work. You're focused on creating an environment where your team can excel and contribute meaningfully.

Potential Demotivators

Honestly, this role isn't for everyone. You'll constantly be fighting for budget against other 'revenue-generating' initiatives, trying to prevent a 'non-event' that the board might not fully appreciate until it's too late. You'll inherit legacy systems that are a nightmare to secure and face significant resistance from business units who see security as a blocker. Expect to be the bearer of bad news often, whether it's an audit finding or a critical vulnerability that needs immediate attention. If you need constant positive reinforcement or a quiet, predictable environment, you'll struggle.

Common Frustrations

1. The 'Security vs. Speed' Battle: Constantly negotiating with Product and Engineering teams who see security controls as a bottleneck to innovation and feature delivery.
2. Budgeting for a 'Non-Event': Trying to secure a seven-figure budget to prevent something (a breach) that hasn't happened yet, making ROI calculations feel abstract to the CFO.
3. Shadow IT Liability: Being held responsible for securing applications and data stores that you only discover after they've been deployed by business units without your knowledge.
4. The Last Line of Defense: The immense pressure of knowing that despite all the policies, training, and technology, a single human error can lead to a catastrophic breach, and you'll be the one explaining it to the board.
5. Translating Technical Risk: The challenge of explaining why a 'CVSS 9.8 vulnerability in a Log4j library' is a business-critical threat to an executive who just wants to know if the quarterly numbers are at risk.
6. Death by a Thousand Questionnaires: Spending a disproportionate amount of time filling out lengthy and often redundant security questionnaires for prospective clients, which all ask for the same information in a slightly different way.

What Role Doesn't Offer

1. A quiet, predictable 9-to-5 job with no surprises.
2. A role where you can avoid difficult conversations with senior leadership.
3. A chance to be hands-on with technical implementations every day (you'll be strategic, not tactical).
4. An environment where security is always the top priority without needing to justify its value.
5. A role where you can easily delegate all the 'boring' compliance work.

ADHD Positives

1. The high-stakes, dynamic nature of incident response and strategic problem-solving can be highly engaging and stimulating, playing to strengths in hyperfocus during crises.
2. The need for innovative solutions to complex, multi-faceted security challenges can be a great outlet for creative thinking and novel approaches.
3. Leading a large team means you can delegate routine tasks, allowing you to focus on high-level strategic initiatives and urgent priorities.

ADHD Challenges and Accommodations

1. Managing a broad, multi-year strategic roadmap requires sustained attention and meticulous planning, which can be challenging. We can support this with dedicated project management support and regular, structured check-ins.
2. The volume of documentation, policy reviews, and detailed audit responses can be overwhelming. We'd offer support from compliance specialists and AI tools to streamline these processes.
3. Frequent context switching between strategic planning, team management, and incident response might be demanding. We'd encourage clear time blocking and dedicated focus periods.

Dyslexia Positives

1. Strengths in big-picture thinking, pattern recognition, and strategic foresight are invaluable for identifying systemic risks and designing enterprise-level security programmes.
2. Excellent verbal communication skills, often associated with dyslexia, are critical for presenting complex security concepts to the Board and influencing executive stakeholders.
3. The ability to delegate detailed writing and documentation tasks to your team or use AI tools can mitigate challenges with written output.

Dyslexia Challenges and Accommodations

1. The sheer volume of written policies, reports, and regulatory documents can be a challenge. We'd provide access to text-to-speech software, proofreading support, and encourage the use of visual aids for complex information.
2. Ensuring accuracy in detailed audit responses and contractual language is paramount. We'd ensure you have dedicated support for review and editing, and use AI tools for initial drafting and grammar checks.
3. Reading lengthy technical specifications or legal texts might be time-consuming. We'd encourage summaries from your team and prioritise key sections for your review.

Autism Positives

1. A strong logical and analytical approach is highly beneficial for designing robust security architectures, identifying vulnerabilities, and developing clear, unambiguous policies.
2. The ability to focus deeply on complex technical details and security frameworks (like ISO 27001) can lead to exceptional expertise and thoroughness in compliance.
3. Direct, honest communication, when framed appropriately, is highly valued in high-stakes security discussions, especially with technical teams and regulators.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues at the executive level can be demanding. We'd provide a mentor to help interpret these dynamics and offer direct feedback on communication styles.
2. The need for constant, high-level influencing and networking might be draining. We'd support structured interactions, clear agendas for meetings, and provide opportunities for focused, independent work.
3. Unexpected changes in strategic direction or urgent incidents can disrupt routines. We'd aim for maximum transparency on upcoming changes and provide clear incident response protocols to minimise ambiguity.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Director/VP (16-20 years)
2. Responsibilities: Own the global ISO 27001 certification strategy and execution across all international entities, ensuring continuous compliance and successful audits with zero Major Non-conformities. You'll be the ultimate decision-maker here, setting the standard.
3. Define and communicate the organisation's information security risk appetite to the Executive Committee and Board of Directors, translating complex technical risks into clear business implications and influencing strategic investment decisions.
4. Lead the design, implementation, and continuous improvement of enterprise-wide security programmes, including Business Continuity & Disaster Recovery (BCDR), Third-Party Risk Management (TPRM), and Security Awareness, ensuring they're fit for purpose globally.
5. Represent the organisation to top-tier regulators, external auditors, and critical enterprise clients on all information security matters. This means defending our posture, negotiating audit findings, and building strong, credible relationships.
6. Build, mentor, and lead a high-performing international team of security professionals, including managers and specialists, fostering a culture of accountability, continuous learning, and excellence. You'll be responsible for their growth and success.
7. Drive the multi-million-pound information security budget and investment strategy, justifying spend based on quantifiable risk reduction, regulatory requirements, and strategic business value to the CFO and Board.
8. Oversee the organisation's response to major security incidents, acting as the ultimate authority during crises, ensuring effective containment, eradication, recovery, and post-incident analysis to prevent recurrence. You're the one who makes the final call.
9. Shape the security architecture and technology roadmap for the entire organisation, making strategic choices on GRC platforms, cloud security tools, and threat intelligence capabilities to meet future business needs and emerging threats.
10. Supervision: You'll operate with full strategic autonomy, reporting directly to the Chief Compliance Officer or Chief Risk Officer with monthly strategic alignment meetings. Your performance is ultimately reviewed by the Board against enterprise-level security objectives.
11. Decision: You hold full strategic authority within your domain. This includes P&L responsibility for budgets typically ranging from £2M to £10M+, full authority over organisational design within your department, hiring and firing decisions for your direct reports (and significant influence over their teams), and making external commitments on behalf of the organisation related to information security. You'll present directly to the Board on security matters and be involved in M&A due diligence.
12. Success: Success means the organisation maintains its ISO 27001 certifications globally with minimal findings, our enterprise risk profile demonstrably decreases year-on-year, and the Board has unwavering confidence in our security posture. You'll have built a resilient, proactive security function that is seen as a strategic enabler, not just a cost centre.

Decision-Making Authority

• Type: Strategic Security Investment (e.g., new GRC platform)
• Entry: No authority. Assists in gathering vendor information and basic cost data.
• Mid: Researches and proposes specific tools, outlining features and initial costs. Requires manager approval.
• Senior: Evaluates multiple solutions, develops detailed business cases with ROI, and recommends preferred option to Director. Requires Director approval.
• Type: Acceptance of a Major Security Risk
• Entry: Identifies and reports risks to supervisor. No authority to accept.
• Mid: Assesses risk impact and likelihood. Proposes mitigation options to manager. No authority to accept.
• Senior: Conducts detailed risk assessment, identifies compensating controls, and recommends risk acceptance or mitigation to Director. Requires Director approval.
• Type: Major Security Incident Response (e.g., data breach)
• Entry: Follows incident response playbook steps. Escalates immediately.
• Mid: Executes assigned incident response tasks (e.g., forensic data collection). Reports status to incident lead.
• Senior: Leads a specific workstream within the incident response (e.g., containment, eradication). Makes technical decisions within that workstream. Informs Director.

Competency Requirements

Foundation Skills (Transferable)

At this level, your foundation skills aren't just about personal effectiveness; they're about your ability to lead, inspire, and shape the entire organisation's approach to security. These are the bedrock upon which your strategic impact is built.

• Category: Strategic Leadership & Vision
• Skills: Ability to define and articulate a compelling multi-year information security strategy that aligns with global business objectives and regulatory landscapes.
• Proven track record of building, mentoring, and developing high-performing, geographically dispersed security teams, fostering a culture of excellence and accountability.
• Exceptional capability to drive organisational change, overcoming resistance and securing buy-in for critical security initiatives across all levels of the enterprise.
• Category: Executive Communication & Influence
• Skills: Expertise in translating complex technical security risks into clear, concise, and impactful business language for the C-suite and Board of Directors.
• Highly developed negotiation and persuasion skills, capable of influencing senior stakeholders to prioritise security investments and adopt new policies.
• Strong public speaking and presentation abilities, comfortable representing the organisation to regulators, clients, and industry forums on security matters.
• Category: Enterprise Risk Acumen & Decision Making
• Skills: Deep understanding of enterprise risk management principles and the ability to define, quantify, and manage the organisation's information security risk appetite.
• Proven ability to make high-stakes, defensible decisions under pressure, especially during critical security incidents, with incomplete information.
• A pragmatic approach to security, balancing ideal solutions with business realities and operational constraints to achieve optimal risk reduction.
• Category: Crisis Management & Resilience
• Skills: Demonstrated leadership in managing and recovering from major security incidents (e.g., data breaches, ransomware attacks), ensuring effective containment, eradication, and post-mortem analysis.
• Ability to remain calm, focused, and decisive during high-pressure situations, providing clear direction to incident response teams and executive leadership.
• A resilient mindset, capable of learning from setbacks and continuously improving the security posture in the face of evolving threats and organisational challenges.

Functional Skills (Role-Specific Technical)

These are the core technical and domain-specific skills you'll need to strategically manage and oversee our global information security programme. While you won't be hands-on with every tool, you'll need a deep understanding to guide your teams and make informed decisions.

Technical Competencies

• Skill: ISMS Implementation & Management (ISO/IEC 27001)
• Desc: Expertise in designing, implementing, and continually improving an enterprise-wide Information Security Management System (ISMS) compliant with ISO 27001 across multiple international entities. This includes strategic scoping, risk assessment, control selection (Statement of Applicability), internal audits, and management reviews. You'll own the certification process.
• Level: Expert
• Skill: Risk Management Frameworks (NIST RMF, ISO 31000, FAIR)
• Desc: Mastery of various risk management frameworks, with the ability to define the organisation's risk appetite, conduct quantitative (e.g., FAIR) and qualitative risk assessments at an enterprise level, and manage a consolidated risk register that translates technical issues into clear business impact for the Board.
• Level: Expert
• Skill: Control Frameworks & Auditing (COBIT, CIS Controls, SOC 2)
• Desc: Deep understanding of how to map controls across multiple frameworks (e.g., ISO 27001, SOC 2, NIST CSF) to avoid redundant work and optimise compliance efforts. Extensive experience managing external audits, negotiating scope and wording of findings, and driving remediation programmes globally.
• Level: Expert
• Skill: Business Continuity & Disaster Recovery (BCDR)
• Desc: Strategic leadership in planning, documenting, and rigorously testing enterprise-wide BCDR plans through advanced methods like full-scale simulations and war-gaming exercises. You'll ensure the organisation can recover from disruptive incidents within defined RTO/RPO targets, protecting critical business operations.
• Level: Expert
• Skill: International Privacy Regulations (GDPR, CCPA, etc.)
• Desc: Comprehensive understanding of the complex interplay between information security controls and global privacy requirements (e.g., GDPR, CCPA, LGPD, UK DPA). This includes strategic oversight of data mapping, Data Protection Impact Assessments (DPIAs), and managing breach notification obligations across diverse legal jurisdictions.
• Level: Advanced
• Skill: Supply Chain / Third-Party Risk Management (TPRM)
• Desc: Leadership in developing and managing a robust global TPRM programme. This covers assessing the security posture of critical vendors, including contract reviews, advanced security questionnaires (e.g., SIG, CAIQ), and ongoing monitoring strategies to mitigate supply chain risks at an enterprise level.
• Level: Advanced

Digital Tools

• Tool: GRC Platforms (e.g., ServiceNow GRC, OneTrust, Archer)
• Level: Strategic
• Usage: Leading the selection, integration, and strategic use of GRC platforms to model enterprise risk, manage compliance programmes, and report to the Board on our global security posture and control effectiveness.
• Tool: Audit Management (e.g., AuditBoard, HighBond, Vanta)
• Level: Strategic
• Usage: Using platform analytics to identify systemic control weaknesses, optimise the global audit schedule, and ensure efficient evidence collection and remediation tracking across all international entities. You'll define how these tools support our overall audit strategy.
• Tool: Vulnerability Management (e.g., Nessus, Qualys, Tenable.io)
• Level: Strategic
• Usage: Setting the enterprise vulnerability management strategy, defining risk acceptance criteria, and reporting on overall exposure reduction to the Executive Committee. You'll guide your team on tool selection and prioritisation.
• Tool: Cloud Security Posture (e.g., Wiz, Palo Alto Prisma Cloud, Orca Security)
• Level: Strategic
• Usage: Owning the cloud security architecture and strategy across multi-cloud environments (AWS, Azure, GCP). You'll justify investment in these platforms based on risk reduction and ensure integration with broader security operations.
• Tool: Collaboration & Doc Mgmt (e.g., Confluence, Jira, SharePoint)
• Level: Strategic
• Usage: Governing the entire knowledge management framework for security and compliance across the enterprise, ensuring policies, procedures, and incident response playbooks are accessible, current, and auditable for all global teams.
• Tool: Executive Reporting (e.g., Power BI, Tableau, Diligent Boards)
• Level: Expert
• Usage: Designing and presenting concise, compelling risk narratives and security programme updates to the Board and C-suite using tools like Diligent. You'll need to defend metrics under scrutiny and ensure clarity at the highest level.

Industry Knowledge

• Area: Cyber Threat Landscape & Intelligence
• Desc: Deep, up-to-date knowledge of the global cyber threat landscape, including nation-state actors, organised crime, and emerging attack vectors. Ability to translate threat intelligence into actionable strategic defence plans.
• Area: Information Security Architecture & Engineering
• Desc: Comprehensive understanding of secure system design principles, network security, application security, and data security architectures. You'll guide the strategic direction of our security engineering efforts.
• Area: Organisational Governance & Compliance
• Desc: Expertise in corporate governance, legal frameworks, and the interplay between information security, data privacy, and broader organisational compliance requirements across international jurisdictions.

Regulatory Compliance Regulations

• Reg: ISO/IEC 27001 & 27002
• Usage: You'll be the ultimate authority on our global ISO 27001 certification. This means defining the scope, leading the implementation of controls, managing the certification body relationship, and ensuring continuous improvement of the ISMS across all international entities.
• Reg: General Data Protection Regulation (GDPR) & UK DPA
• Usage: Strategic oversight of GDPR and UK DPA compliance from a security perspective. This involves ensuring technical and organisational measures are in place to protect personal data, managing breach notification procedures, and advising on Data Protection Impact Assessments (DPIAs).
• Reg: California Consumer Privacy Act (CCPA/CPRA) & other US State Privacy Laws
• Usage: Guiding the organisation's security posture to meet US state privacy requirements, particularly around data access, deletion, and security safeguards for consumer data. This includes understanding the nuances of different state laws.
• Reg: Industry-Specific Regulations (e.g., PCI DSS, HIPAA, SOX - depending on sector)
• Usage: If applicable to our industry, you'll ensure our information security programme addresses the specific requirements of relevant sector regulations, leading compliance efforts and audit preparations for these standards.

Essential Prerequisites

• At least 16 years of progressive experience in information security, with a significant portion in a leadership role managing global programmes and large teams.
• Demonstrable experience in successfully achieving and maintaining ISO 27001 certification for a complex, multi-national organisation.
• Proven track record of presenting to and influencing C-suite executives and Board members on information security risk and strategy.
• Extensive experience in managing major security incidents from initial detection through to post-mortem and remediation at an enterprise level.
• Deep understanding of enterprise risk management principles and the ability to articulate security risks in a business context.
• Strong financial acumen, including experience managing multi-million-pound security budgets and demonstrating ROI for security investments.

Career Pathway Context

You'll have already mastered the technical and programmatic aspects of information security. This role demands a shift to enterprise-level strategic thinking, board-level communication, and significant people leadership across diverse geographies. It's about leading a function, not just a programme.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI Governance & Security
• Why: AI is rapidly being integrated into every aspect of business, from operations to customer service. As a Director, you'll need to understand the security risks inherent in AI systems (e.g., data poisoning, model evasion, privacy concerns) and how to govern their secure deployment and use within the organisation. This isn't just about using AI for security; it's about securing AI itself.
• Concepts: [{'concept_name': 'AI Risk Frameworks (e.g., NIST AI RMF)', 'description': 'Understanding how to assess and manage risks specific to AI systems, including bias, transparency, and explainability.'}, {'concept_name': 'Secure AI Development Lifecycle (SAIDL)', 'description': 'Integrating security considerations into the entire lifecycle of AI model development, from data acquisition to deployment and monitoring.'}, {'concept_name': 'Data Privacy in AI', 'description': 'Ensuring AI systems handle sensitive data in compliance with global privacy regulations, mitigating risks like data leakage or re-identification.'}, {'concept_name': 'Adversarial AI & Defences', 'description': 'Knowledge of how AI models can be attacked (e.g., adversarial examples) and strategies to build resilient AI systems.'}]
• Prepare: This quarter: Engage with our Data Science or AI teams to understand their current AI projects and data pipelines.
• Next 3 months: Research and familiarise yourself with the NIST AI Risk Management Framework and its application.
• Next 6 months: Develop a draft internal policy for the secure and ethical use of AI within our organisation, working with Legal and Compliance.
• Next 12 months: Lead a pilot project to implement security controls for a critical AI application.
• QuickWin: Start by identifying one or two key AI initiatives within the company and schedule a deep-dive with the owners to understand their data sources and security considerations. You can also read up on the OWASP Top 10 for LLM applications.
• Skill: Cyber Resilience Engineering
• Why: Traditional security focused on prevention and detection. Now, the focus is shifting to 'assume breach' and building systems that can withstand attacks, degrade gracefully, and recover quickly without significant business interruption. This means moving beyond just BCDR plans to architecting inherently resilient systems.
• Concepts: [{'concept_name': 'Chaos Engineering', 'description': 'Proactively injecting failures into systems to identify weaknesses and improve resilience before real incidents occur.'}, {'concept_name': 'Fault Tolerance & Redundancy', 'description': 'Designing systems with built-in redundancy and mechanisms to continue operating despite component failures.'}, {'concept_name': 'Immutable Infrastructure', 'description': 'Treating infrastructure components as disposable, reducing the attack surface and simplifying recovery.'}, {'concept_name': 'Automated Recovery & Self-Healing Systems', 'description': 'Implementing automation to detect and automatically remediate security incidents or system failures without human intervention.'}]
• Prepare: This quarter: Work with Engineering and Operations to understand current system architecture and resilience capabilities.
• Next 3 months: Sponsor a 'chaos day' or resilience testing exercise for a non-critical system.
• Next 6 months: Develop a strategic roadmap for integrating cyber resilience principles into our SDLC and infrastructure design.
• Next 12 months: Advocate for budget and resources to implement key cyber resilience engineering initiatives.
• QuickWin: Review your current BCDR plans. Are they just about recovery, or do they include elements of preventing disruption and maintaining operations during an attack? Start asking your engineering leads about their fault tolerance strategies.

Advancing Technical Skills

• Skill: Quantum-Safe Cryptography Strategy
• Why: The advent of quantum computing threatens to break many of our current cryptographic standards. As a Director, you'll need to start planning for the migration to quantum-safe algorithms, ensuring our long-term data confidentiality and integrity.
• Concepts: [{'concept_name': 'Post-Quantum Cryptography (PQC) Algorithms', 'description': 'Understanding the leading candidates for quantum-resistant encryption and digital signatures.'}, {'concept_name': 'Cryptographic Agility', 'description': 'Designing systems that can easily swap out cryptographic algorithms as new standards emerge or threats evolve.'}, {'concept_name': 'Inventorying Cryptographic Assets', 'description': 'Knowing where and how cryptography is used across the organisation to plan for migration.'}, {'concept_name': 'Hybrid Cryptography', 'description': 'Implementing both classical and quantum-safe algorithms simultaneously during the transition period.'}]
• Prepare: This quarter: Begin discussions with your CISO peers and industry groups on PQC roadmaps.
• Next 6 months: Conduct an internal inventory of all cryptographic uses within the organisation.
• Next 12 months: Develop a preliminary strategy and timeline for transitioning to quantum-safe cryptography for critical systems.
• Next 2 years: Pilot PQC implementation in a non-production environment.
• QuickWin: Start by reading the NIST PQC standardisation process updates. It's a long game, but early awareness is key.
• Skill: Geopolitical Risk & Cyber Warfare
• Why: Cyber security is no longer purely technical; it's deeply intertwined with international relations and state-sponsored activities. You'll need to understand how geopolitical events can translate into cyber threats and adapt your defence strategy accordingly.
• Concepts: [{'concept_name': 'Nation-State Threat Actors', 'description': 'Understanding the capabilities, motivations, and tactics of state-sponsored hacking groups.'}, {'concept_name': 'Critical Infrastructure Protection', 'description': 'Awareness of the specific threats and vulnerabilities targeting critical national infrastructure (if applicable to our sector).'}, {'concept_name': 'Sanctions & Export Controls', 'description': 'Understanding how international sanctions and export controls impact technology procurement and deployment in a global context.'}, {'concept_name': 'Information Warfare & Disinformation', 'description': 'Recognising and mitigating the impact of state-sponsored disinformation campaigns on organisational reputation and trust.'}]
• Prepare: This quarter: Subscribe to geopolitical intelligence reports and integrate them into your threat intelligence briefings.
• Next 6 months: Develop scenarios for how geopolitical events could impact our security posture and BCDR plans.
• Next 12 months: Engage with government security agencies or industry bodies to gain insights into national cyber defence strategies.
• Ongoing: Regularly brief the Board on geopolitical cyber risks and their potential impact on our business.
• QuickWin: Add a standing agenda item on 'Geopolitical Cyber Threats' to your monthly leadership security meeting. It's a good way to keep everyone aware.

Education Requirements

• Level: Minimum
• Req: A Master's degree in Information Security, Computer Science, Business Administration, or a related field.
• Alts: We're pragmatic. If you've got 20+ years of demonstrable, progressive leadership experience in information security at a global level, including significant interaction with C-suite and Boards, we'd consider that equivalent. Show us what you've built.
• Level: Preferred
• Req: An MBA or an Executive Master's in a relevant discipline, demonstrating strong business acumen alongside technical expertise.
• Alts: N/A

Experience Requirements

You'll need roughly 16-20 years of progressive experience in information security, with at least 8-10 years in a senior leadership role managing global programmes and large teams (25+ people). This must include direct experience owning ISO 27001 certification for a multi-national organisation, significant interaction with C-suite and Board members, and a proven track record of managing multi-million-pound security budgets and major security incidents.

Preferred Certifications

• Cert: Certified Chief Information Security Officer (CCISO)
• Prod: EC-Council
• Usage: Demonstrates advanced leadership and management skills specific to the CISO role, covering governance, risk, compliance, and strategic programme management.
• Cert: Fellow of Information Systems Security Association (FISSA)
• Prod: ISSA
• Usage: Recognises significant contributions and leadership within the information security profession, indicating a high level of industry standing and expertise.
• Cert: Project Management Professional (PMP)
• Prod: PMI
• Usage: Useful for managing large, complex security programmes and ensuring efficient delivery of initiatives across international teams.

Recommended Activities

• Regularly attend and present at leading international information security conferences (e.g., RSA Conference, Black Hat, Infosecurity Europe) to stay current with the latest threats and technologies.
• Actively participate in industry-specific information sharing and analysis centres (ISACs/ISAOs) to share threat intelligence and best practices.
• Engage in executive education programmes focused on cybersecurity leadership, enterprise risk management, or digital transformation.
• Mentor emerging security leaders, both within and outside the organisation, to foster the next generation of talent.
• Contribute to industry standards bodies or working groups, helping to shape the future of information security best practices.

Career Progression Pathways

Entry Paths to This Role

• Path: From Principal Security Architect / Senior Manager, Global Compliance (L5)
• Time: 3-5 years at L5
• Path: From Head of Information Security (Large Enterprise / Regional CISO)
• Time: 5-7 years in a similar leadership role

Career Progression From This Role

• Pathway: Chief Information Security Officer (CISO) (L7)
• Time: 3-5 years in this Director role
• Pathway: Chief Risk Officer (CRO)
• Time: 4-6 years in this Director role

Long Term Vision Potential Roles

• Title: Board Member (Cybersecurity Expert)
• Time: 7-10+ years beyond this role
• Title: Cybersecurity Consultant / Advisor (Global)
• Time: 5-8+ years beyond this role
• Title: Industry Thought Leader / Author / Speaker
• Time: 5-10+ years beyond this role

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.