Director of Cybersecurity

Role Purpose & Context

Role Summary

As our Director of Cybersecurity, you'll be the architect and commander of our entire cyber defence programme. This means defining the overarching strategy, building and leading multiple teams, and making sure our security posture is robust enough to handle whatever the digital world throws at us. You're not just managing a team; you're driving a critical business function that protects our assets, our customers, and our reputation. You'll sit right at the intersection of technology, risk management, and business operations, translating complex cyber threats into understandable business risks for the C-suite and the Board. Your work directly impacts our ability to operate, innovate, and maintain trust with our clients and partners. Get this right, and we avoid costly breaches, regulatory fines, and reputational damage that could cripple the business. Get it wrong, and well, the consequences don't bear thinking about. The challenge here is immense: the threat landscape is constantly evolving, and you'll always be fighting a sophisticated, well-resourced adversary. You'll also need to balance security with business agility, making sure our defences don't slow us down. The reward, though? You'll be the person standing between our company and existential threats, building a security culture and capability that truly makes a difference. That's a pretty big deal, if you ask me.

Reporting Structure

• Reports to: Chief Information Officer (CIO)
• Direct reports: Roughly 3-8, including Security Managers and Lead Architects
• Matrix relationships: Head of Cyber Security, VP, Information Security, Cybersecurity Programme Lead,

Key Stakeholders

Internal:

• CIO and Technology Leadership Team
• Chief Risk Officer (CRO)
• Legal and Compliance Teams
• Product and Engineering Leadership
• Internal Audit
• Board Audit Committee

External:

• External Auditors (e.g., for SOC 2, ISO 27001)
• Regulatory Bodies (e.g., ICO, FCA)
• Cyber Insurance Providers
• Third-Party Security Vendors
• Industry Peers and Information Sharing Groups

Organisational Impact

Scope: This role is absolutely critical. You're directly responsible for the overall security posture of the entire organisation. Your decisions impact everything from our operational resilience and data privacy to our regulatory compliance and market reputation. A strong cybersecurity programme, driven by you, means we can innovate safely, maintain customer trust, and protect our financial stability. Without robust leadership here, the business faces significant financial, legal, and reputational risks.

Performance Metrics

Quantitative Metrics

1. Metric: NIST CSF Maturity Score Improvement
2. Desc: Progress in our overall cybersecurity programme's maturity, measured against the NIST Cybersecurity Framework.
3. Target: Improve NIST CSF maturity from Tier 2 to Tier 3 within 24 months, with a clear roadmap for Tier 4.
4. Freq: Annually, via external assessment and internal self-assessment.
5. Example: Moving from a 'Partial' (Tier 2) to an 'Adaptive' (Tier 3) rating in the 'Detect' function means our incident response capabilities are not just defined but regularly tested and improved, showing real resilience.
6. Metric: Material Audit Findings
7. Desc: The number of significant non-conformities or critical weaknesses identified during external security audits (e.g., SOC 2, ISO 27001).
8. Target: Maintain zero material findings on all external audits.
9. Freq: Per audit cycle (typically annual).
10. Example: Successfully completing our annual SOC 2 Type 2 audit with no 'material findings' for the third year running demonstrates consistent control effectiveness and compliance.
11. Metric: Annualised Loss Expectancy (ALE) Reduction
12. Desc: Quantifying the financial risk of cyber incidents and demonstrating a reduction in that exposure over time.
13. Target: Reduce the calculated Annualised Loss Expectancy (ALE) by 20% year-over-year.
14. Freq: Annually, based on FAIR model or similar quantitative risk analysis.
15. Example: After implementing a new endpoint detection and response (EDR) solution, our calculated ALE for ransomware incidents dropped from £1.5M to £1.2M, showing a 20% reduction in potential financial impact.
16. Metric: Security Team Attrition Rate
17. Desc: The rate at which skilled cybersecurity professionals leave your direct and indirect teams.
18. Target: Keep employee attrition on the security team below 10% annually.
19. Freq: Quarterly, reviewed with HR.
20. Example: Our security team maintained an 8% attrition rate this year, well below the industry average of 15-20%, indicating a healthy team culture and effective talent retention strategies.

Qualitative Metrics

1. Metric: Board and Executive Confidence
2. Desc: How well you communicate cyber risk and strategy to the Board and executive team, leading to informed decision-making and support.
3. Evidence: Achieve >90% satisfaction score on board satisfaction surveys for risk communication. Executives proactively seek your input on new business initiatives. Board members demonstrate a clear understanding of our top cyber risks and the rationale behind security investments. You're seen as a trusted advisor, not just a technical expert.
4. Metric: Cross-Functional Collaboration & Influence
5. Desc: Your ability to build strong relationships and influence security-positive behaviours across departments, particularly with Product, Engineering, and Legal.
6. Evidence: Security requirements are embedded early in the product development lifecycle (shift-left). Engineering teams consistently meet patching SLAs. You're regularly invited to strategic planning sessions for non-security initiatives. Other department heads praise your pragmatic approach to security challenges, rather than seeing you as a blocker.
7. Metric: Proactive Threat Posture
8. Desc: Moving beyond reactive incident response to actively anticipate and mitigate threats before they materialise.
9. Evidence: Regular threat hunting exercises identify dormant threats. Successful purple team engagements lead to measurable improvements in detection and response. Our threat intelligence is actively used to inform strategic defence investments. We're consistently 'left of boom' in our security planning, not just cleaning up after 'the boom'.
10. Metric: Talent Development & Mentorship
11. Desc: Your commitment to growing the skills and careers of your team members, fostering a high-performing security organisation.
12. Evidence: Clear career pathways are defined for all roles within your department. At least two senior team members are promoted or take on significantly expanded responsibilities annually. Your team members consistently report high levels of job satisfaction and opportunities for growth in internal surveys. You're actively coaching and sponsoring individuals.

Primary Traits

• Trait: Decisive Under Ambiguity
• Manifestation: When a major incident hits, the data is always messy and incomplete. You're the one who can cut through the noise, make a defensible call to, say, shut down a critical system or isolate a network segment, even with only 60% of the information. You'll provide clear, direct instructions to your team during high-pressure situations, knowing that hesitation is often more damaging than a swift, calculated risk. It's about committing to a path, even when multiple options exist, each with its own messy trade-offs.
• Benefit: In cybersecurity, waiting for 100% certainty means you've already lost. A Director needs to make tough, high-stakes decisions based on available evidence to contain a threat and minimise damage. The cost of inaction—or slow action—is often far greater than the cost of a wrong but reversible action. Your ability to make a call and own it is paramount to limiting 'blast radius' during a crisis.
• Trait: Pragmatic Influencer
• Manifestation: You won't just tell engineering they *must* patch a critical vulnerability; you'll explain *why* it matters to customer trust and platform stability, framing it in terms of business impact. You'll translate complex cyber risk into a simple, compelling 'cost of inaction' argument for a board budget request, showing them the £ implications. Sometimes, you'll negotiate a 'compensating control' with a business unit that genuinely can't meet a strict security policy, finding a secure-enough middle ground instead of just saying 'no'.
• Benefit: Cybersecurity isn't just a technical problem; it's a business risk that requires organisational buy-in. As Director, you must influence and persuade stakeholders across the entire organisation—from developers to the C-suite—to invest in and adopt secure practices. You can't be seen as the 'Department of No'; you need to be the 'Department of Smart Risk Management' that helps the business achieve its goals securely.
• Trait: Unflappable Accountability
• Manifestation: When (not if) a security incident occurs, you'll stand before the executive team and the Board, clearly stating what happened, what your teams are doing about it, and what will be done to prevent it from happening again. You'll own the outcome, without deflecting blame or making excuses. This also means taking full ownership of a failed audit finding and presenting a clear, credible remediation plan, rather than pointing fingers. You're the one who instils confidence that the situation is under control and that critical lessons will be learned.
• Benefit: Trust is everything in cybersecurity. When things go wrong, the organisation, its customers, and its investors need a leader who takes full accountability, communicates transparently, and inspires confidence that the situation is being managed effectively. Your ability to own the good, the bad, and the ugly builds credibility and ensures the business learns and adapts, rather than repeating mistakes.

Supporting Traits

• Trait: Healthy Skepticism
• Desc: You naturally question assumptions and defaults, always operating with an 'assume breach' mindset. You'll constantly ask 'what if?' and 'how could this fail?' to uncover potential weaknesses before attackers do. It's about 'trust, but verify' in practice.
• Trait: Calm Under Pressure
• Desc: During a chaotic incident response scenario, you maintain a methodical and composed demeanour. You're the steady hand that guides the team, prioritises actions, and makes rational decisions when others might panic. You can absorb the pressure from above and shield your team from it, allowing them to focus.
• Trait: Intellectual Curiosity
• Desc: The threat landscape never stands still. You're driven to constantly learn about new attack vectors, defensive technologies, regulatory changes, and sophisticated threat actors. This isn't just about staying current; it's about anticipating the next big challenge and adapting our defences proactively.
• Trait: Strategic Vision
• Desc: You're not just thinking about today's threats but anticipating tomorrow's. You can develop a multi-year roadmap for the cybersecurity programme, aligning it with the overall business strategy and ensuring we're building future-proof defences, not just patching holes.

Primary Motivators

1. Motivator: Protecting the Business from Real Threats
2. Daily: You get a genuine kick out of knowing your work directly prevents financial losses, reputational damage, and operational disruption. Every successful defence, every averted incident, is a win that energises you.
3. Motivator: Building and Mentoring High-Performing Teams
4. Daily: You thrive on seeing your team members grow, develop new skills, and take on bigger challenges. You're invested in creating a culture where security professionals can excel and feel supported.
5. Motivator: Strategic Impact and Influence
6. Daily: You enjoy shaping the long-term direction of the company's security posture, influencing executive decisions, and seeing your vision for cyber resilience come to life across the organisation.

Potential Demotivators

Honestly, this role isn't for everyone. You'll constantly be battling 'the Sisyphean task of patching,' trying to get system owners to fix critical vulnerabilities before they're exploited, often fighting against uptime requirements or change freezes. You'll face 'budget justification battles,' having to quantify the ROI of *preventing* something that hasn't happened yet, competing for funds against departments that directly generate revenue. You might find yourself drowning in 'alert fatigue,' trying to find the signal in the noise from dozens of security tools. And let's be real, the 'Shadow IT' tsunami is constant; you'll discover business units spun up new SaaS apps or cloud servers, bypassing all your careful security reviews. If you need to see every piece of work make it to production without compromise, or if you struggle with the political aspects of getting things done, you'll probably find this role incredibly frustrating.

Common Frustrations

1. The constant struggle to balance security requirements with business agility and speed.
2. Explaining complex technical risks to non-technical executives and getting them to truly understand the 'why'.
3. The 'scapegoat position' – knowing that despite a 99.9% success rate, the one major incident that gets through will define your tenure.
4. The immense difficulty and expense of hiring and retaining skilled cybersecurity professionals.
5. Legacy systems that are impossible to secure properly, but can't be decommissioned easily.

What Role Doesn't Offer

1. A quiet, predictable environment where you can focus solely on technical problem-solving.
2. The luxury of 100% certainty or complete data before making critical decisions.
3. A role where you're always popular; sometimes you'll be the 'Department of No' for good reason.
4. An easy ride; this is a high-pressure, high-stakes leadership position.

ADHD Positives

1. The fast-paced, constantly evolving nature of cybersecurity incident response can be highly engaging for those with ADHD, offering novel challenges and rapid problem-solving.
2. The need for quick, decisive action during a crisis can tap into hyperfocus, allowing for intense concentration when it matters most.
3. The role involves a broad range of activities—strategic planning, team management, incident response, board presentations—which can prevent boredom and keep things fresh.

ADHD Challenges and Accommodations

1. The sheer volume of information, alerts, and competing priorities can be overwhelming; we can help by providing clear prioritisation frameworks and dedicated focus time.
2. Maintaining long-term strategic focus amidst daily crises might be tough; we use visual roadmaps and regular check-ins to keep the bigger picture in view.
3. Managing detailed documentation and compliance tasks can be tedious; we encourage the use of AI tools for first drafts and provide administrative support where possible.

Dyslexia Positives

1. Often excel in big-picture strategic thinking, pattern recognition, and connecting disparate pieces of information—all crucial for understanding complex threat landscapes and designing robust security programmes.
2. Strong verbal communication and storytelling skills can be invaluable for presenting complex cyber risks to non-technical executives and the Board.
3. Creative problem-solving abilities can lead to innovative security solutions and approaches that others might miss.

Dyslexia Challenges and Accommodations

1. Reading and writing extensive reports, policies, and technical documentation can be time-consuming; we encourage the use of text-to-speech, speech-to-text, and AI-powered summarisation tools.
2. Proofreading for grammatical errors or typos in high-stakes communications (e.g., board reports) can be a challenge; we have peer review processes and offer access to advanced grammar checking software.
3. Complex forms or compliance checklists might be difficult; we can provide templates, clear examples, and support from GRC specialists.

Autism Positives

1. A deep, analytical focus on systems, logic, and patterns is highly valuable for understanding complex security architectures and identifying vulnerabilities.
2. Strong attention to detail can be critical for meticulously reviewing security controls, audit findings, and incident reports.
3. A preference for direct, clear communication can cut through corporate ambiguity, which is often beneficial in high-stakes security situations.
4. Exceptional ability to identify inconsistencies or anomalies, which is core to threat detection and risk assessment.

Autism Challenges and Accommodations

1. Navigating complex organisational politics and unspoken social cues can be challenging; we provide clear expectations for stakeholder engagement and offer coaching on navigating corporate dynamics.
2. Unexpected changes or urgent incidents can be disruptive; we aim for clear communication about shifting priorities and provide structured support during crises.
3. Sensory overload in open-plan offices or during intense incident war rooms can be difficult; we offer options for quieter workspaces, noise-cancelling headphones, and remote work flexibility during critical periods.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Director of Cybersecurity (L6)
2. Responsibilities: Define and champion the overarching cybersecurity strategy and roadmap for the entire organisation, aligning it directly with business objectives and risk appetite. (This means presenting to the Board, not just your direct reports.)
3. Own the enterprise-wide security budget (£2M-£10M+) and resource allocation, making tough calls on where to invest our precious funds for maximum impact and risk reduction.
4. Build, lead, and mentor a high-performing team of security professionals, including managers and lead architects. This isn't just about hiring; it's about developing talent, fostering a strong security culture, and making sure your team is equipped for the fight.
5. Drive transformation initiatives across the business to improve our security posture, like implementing a Zero Trust Architecture or a new enterprise-wide data loss prevention (DLP) programme. (Expect resistance; your job is to overcome it.)
6. Represent the organisation on all critical security matters to the C-suite, Board, external auditors, and key partners. You'll be the primary voice of cyber risk, translating technical jargon into clear, actionable business insights.
7. Oversee and continuously improve our incident response capabilities, ensuring we can effectively prepare for, detect, contain, eradicate, and recover from major cyber incidents. (This includes running realistic tabletop exercises with the executive team.)
8. Establish and maintain a robust governance, risk, and compliance (GRC) framework, ensuring we meet all regulatory obligations (e.g., GDPR, NIS2, DORA) and internal policies. You'll be accountable for audit outcomes.
9. Supervision: You'll operate with full strategic autonomy within your business unit, reporting directly to the CIO with regular alignment on multi-year objectives. Day-to-day, you're self-directed, but you'll present to the Board quarterly and engage with the executive team regularly on critical risk matters.
10. Decision: You have full strategic authority within your domain, including budget allocation up to £10M+, hiring and firing decisions for your department, and defining the overall security architecture. Decisions impacting major business units or significant P&L above £10M require C-suite alignment. You're empowered to make critical incident response decisions (e.g., system shutdowns, external communication) in consultation with the CIO and Legal.
11. Success: Your success will be measured by a demonstrably improved security posture (e.g., higher NIST CSF maturity), zero material audit findings, a measurable reduction in our Annualised Loss Expectancy, strong executive and Board confidence in our cyber resilience, and a high-performing, engaged security team with low attrition.

Decision-Making Authority

• Type: Cybersecurity Strategy & Roadmap
• Entry: N/A
• Mid: N/A
• Senior: As Director, you define the multi-year cybersecurity strategy and roadmap for the entire business. This requires C-suite and Board approval, but the vision and detailed plan are yours to create and own.
• Type: Security Budget Allocation
• Entry: N/A
• Mid: N/A
• Senior: You own the cybersecurity budget, typically ranging from £2M-£10M+. You have full authority to allocate funds within this budget across teams, tools, and projects. Major deviations or requests exceeding this range require CIO and CFO approval.
• Type: Incident Response Actions (Crisis Level)
• Entry: N/A
• Mid: N/A
• Senior: During a critical incident, you have the authority to make real-time decisions, including system isolation, data exfiltration prevention, and engaging external forensics, in consultation with the CIO and Legal. You'll also decide on the initial external communication strategy with PR and Legal.
• Type: Team Structure & Hiring
• Entry: N/A
• Mid: N/A
• Senior: You have full authority over the organisational design of the cybersecurity department and all hiring, promotion, and termination decisions within your teams, in alignment with HR policies and approved headcount.
• Type: Vendor Selection & Contracts
• Entry: N/A
• Mid: N/A
• Senior: You approve all major security vendor selections and contract renewals, typically up to £500K per vendor. Contracts exceeding this threshold require CIO or C-suite approval.

Competency Requirements

Foundation Skills (Transferable)

Beyond the technical wizardry, a Director of Cybersecurity needs a rock-solid foundation in leadership, communication, and strategic thinking. These are the human skills that truly make the difference when you're steering a critical function.

• Category: Leadership & Influence
• Skills: Executive Presence: The ability to command respect and convey authority when presenting to the C-suite and Board, articulating complex security risks in a clear, concise, and business-relevant manner.
• Strategic Visioning: Developing a multi-year cybersecurity roadmap that aligns with business goals, anticipates future threats, and drives continuous improvement across the organisation.
• Team Leadership & Development: Building, mentoring, and inspiring high-performing security teams, fostering a culture of continuous learning, accountability, and resilience.
• Organisational Change Management: Leading and driving significant security-related changes across the business, often overcoming resistance and securing buy-in from diverse stakeholders.
• Category: Communication & Stakeholder Engagement
• Skills: Board-Level Communication: Translating highly technical cybersecurity concepts and risks into clear, actionable insights for non-technical Board members and executives.
• Cross-Functional Negotiation: Effectively negotiating security requirements and trade-offs with business unit leaders, product teams, and engineering, finding pragmatic solutions that balance risk and business objectives.
• Crisis Communication: Managing internal and external communications during a major security incident, ensuring transparency, accuracy, and maintaining trust.
• Active Listening: Genuinely understanding the concerns and priorities of business stakeholders to tailor security solutions that meet their needs, rather than just dictating policy.
• Category: Problem-Solving & Decision Making
• Skills: Complex Problem Decomposition: Breaking down large, ambiguous cybersecurity challenges (e.g., ransomware defence, cloud security strategy) into manageable, actionable components.
• Risk-Based Decision Making: Making high-stakes decisions under pressure with incomplete information, always prioritising actions based on their potential impact on the business and its risk appetite.
• Root Cause Analysis: Leading investigations into security incidents or control failures to identify underlying causes and implement preventative measures, not just quick fixes.
• Strategic Trade-off Analysis: Evaluating the costs, benefits, and risks of various security investments and architectural choices, recommending the optimal path for the organisation.

Functional Skills (Role-Specific Technical)

This role demands a deep understanding of core cybersecurity principles, frameworks, and how they apply to a complex enterprise environment. You'll need to know your stuff, but more importantly, know how to apply it strategically.

Technical Competencies

• Skill: NIST Cybersecurity Framework (CSF)
• Desc: You'll be applying the Identify, Protect, Detect, Respond, and Recover functions to build, measure, and continuously improve our comprehensive security programme. This isn't just theory; it's the backbone of our operational strategy.
• Level: Expert
• Skill: MITRE ATT&CK Framework
• Desc: You'll use this to move beyond basic indicators, understanding and directing your teams to defend against specific adversary Tactics, Techniques, and Procedures (TTPs). It's crucial for shaping our threat hunting, detection engineering, and purple teaming strategies.
• Level: Advanced
• Skill: Zero Trust Architecture (ZTA)
• Desc: You'll be responsible for designing and overseeing the implementation of security models based on 'never trust, always verify,' focusing on identity, device, and access controls regardless of network location. This is a foundational shift in how we secure our estate.
• Level: Expert
• Skill: Incident Response (IR) Lifecycle (PICERL)
• Desc: You'll own the entire IR lifecycle: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. This means not just managing incidents, but ensuring our entire organisation is ready for them, and we learn from every event.
• Level: Expert
• Skill: Quantitative Risk Analysis (e.g., FAIR model)
• Desc: You need to translate technical vulnerabilities and threats into financial terms (e.g., Annualised Loss Expectancy) to enable truly business-driven security decisions and justify your budget requests to the CFO and Board.
• Level: Advanced
• Skill: Cloud Security Architecture & Strategy
• Desc: You'll define the enterprise cloud security posture standard, negotiate risk acceptance with business units for cloud workloads, and own the vendor relationships for CSPM/CWPP tools. This is a huge area of focus for us.
• Level: Expert

Digital Tools

• Tool: Splunk Enterprise Security / Cortex XSOAR (SIEM/SOAR)
• Level: Strategic
• Usage: Approving budget for platform expansion, evaluating vendor landscape, and using dashboard outputs for executive risk reporting and strategic decision-making.
• Tool: CrowdStrike Falcon / SentinelOne (EDR/XDR)
• Level: Strategic
• Usage: Defining the enterprise endpoint security strategy (e.g., containment vs. eradication), assessing platform efficacy against emerging threats (e.g., MITRE evaluations), and ensuring integration with broader security operations.
• Tool: Wiz / Palo Alto Prisma Cloud (CSPM/CWPP)
• Level: Strategic
• Usage: Setting the enterprise cloud security posture standard, negotiating with business units on risk acceptance for cloud workloads, and owning the vendor relationship to ensure our cloud environments are secure.
• Tool: Tenable.io / Qualys (Vulnerability Management)
• Level: Strategic
• Usage: Defining the enterprise vulnerability management policy, including remediation SLAs, and reporting on overall risk posture and remediation trends to leadership and the Board.
• Tool: Recorded Future / Mandiant (Threat Intelligence Platform)
• Level: Strategic
• Usage: Determining intelligence requirements (PIRs) for the business, using threat intelligence to inform security investment and strategy, and briefing the board on the evolving threat landscape.
• Tool: ServiceNow GRC / OneTrust (GRC Platform)
• Level: Strategic
• Usage: Owning the GRC platform roadmap, designing the enterprise-wide control framework, and presenting consolidated risk and compliance posture to executives and external auditors.
• Tool: Diligent / Nasdaq Boardvantage (Board Reporting)
• Level: Architect
• Usage: Preparing and uploading all board materials related to cybersecurity risk, ensuring secure communication with board members, and managing meeting artifacts.

Industry Knowledge

• Area: Global Cybersecurity Regulations & Compliance
• Desc: A deep understanding of major global and regional cybersecurity regulations (e.g., GDPR, CCPA, NIS2, DORA, PCI DSS) and how to build a programme that ensures continuous compliance and successful audits.
• Area: Enterprise IT & Cloud Architecture
• Desc: A solid grasp of complex enterprise IT environments, including hybrid cloud architectures (AWS, Azure, GCP), network segmentation, identity and access management (IAM), and modern application development lifecycles (DevSecOps).
• Area: Current Threat Landscape & Attack Vectors
• Desc: Up-to-date knowledge of the latest cyber threats, attack techniques (e.g., ransomware, supply chain attacks, nation-state APTs), and defensive strategies. You need to know what the adversaries are doing and how to stop them.
• Area: Cyber Insurance & Risk Transfer
• Desc: Understanding the role of cyber insurance, how to assess our coverage, and how our security posture impacts premiums and claims. This is a critical part of our overall risk management strategy.

Regulatory Compliance Regulations

• Reg: General Data Protection Regulation (GDPR)
• Usage: Ensuring our data processing activities, security controls, and incident response procedures fully comply with GDPR requirements, particularly regarding data breaches and data subject rights. You'll be accountable for our GDPR posture.
• Reg: Network and Information Systems (NIS2) Directive
• Usage: Overseeing our compliance with NIS2 for critical infrastructure and essential services, ensuring robust security measures, incident reporting, and supply chain security are in place across the organisation.
• Reg: Digital Operational Resilience Act (DORA)
• Usage: For financial services or related entities, you'll be responsible for ensuring our ICT risk management, incident reporting, digital operational resilience testing, and third-party risk management align with DORA's stringent requirements.
• Reg: ISO 27001 (Information Security Management)
• Usage: Maintaining and continuously improving our ISO 27001 certified Information Security Management System (ISMS), including leading external audits and ensuring control effectiveness across the organisation.

Essential Prerequisites

• A minimum of 16 years of progressive experience in cybersecurity roles, with at least 5-7 years in a senior leadership or management position overseeing multiple security functions.
• Demonstrable experience building and scaling cybersecurity programmes from the ground up or significantly transforming existing ones within a complex enterprise.
• Proven track record of successfully managing multi-million-pound security budgets and making strategic investment decisions.
• Extensive experience presenting to and influencing C-suite executives and Board members on cybersecurity risk and strategy.
• Deep expertise in at least two major cybersecurity domains (e.g., Security Operations, GRC, Cloud Security, Application Security) and a broad understanding of all others.
• Experience leading and managing diverse teams of security professionals, including other managers and technical leads.

Career Pathway Context

Think of these as the foundational building blocks you absolutely need before stepping into this level of responsibility. You've likely honed these skills over many years in senior security engineering, architecture, or management roles. Without this deep, hands-on experience and leadership, you simply won't have the credibility or the strategic perspective required to succeed here.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: AI-Powered Cyber Defence Strategy
• Why: AI is rapidly becoming both the attacker's and defender's most powerful tool. As attackers use AI to craft more sophisticated threats, our defences must also evolve. This isn't just about using AI tools; it's about strategically integrating AI into every layer of our defence, from threat detection to incident response, to gain a significant advantage.
• Concepts: [{'concept_name': 'Generative AI for Threat Simulation', 'description': "Using LLMs to generate realistic attack scenarios and test defensive controls, improving our 'left of boom' capabilities."}, {'concept_name': 'AI for Anomaly Detection & Predictive Analytics', 'description': 'Moving beyond rule-based detection to AI-driven systems that predict potential attacks based on subtle behavioural shifts.'}, {'concept_name': 'AI-Enhanced Incident Response Playbooks', 'description': "Integrating AI into SOAR platforms to automate and accelerate incident triage, containment, and recovery, reducing 'dwell time'."}, {'concept_name': 'Ethical AI & Bias in Security', 'description': 'Understanding the ethical implications of using AI in security and guarding against algorithmic bias in detection or access control systems.'}, {'concept_name': 'Defending Against AI-Powered Attacks', 'description': 'Developing strategies to counter AI-generated phishing, deepfakes for social engineering, and autonomous malware.'}]
• Prepare: This quarter: Engage with leading AI security vendors to understand their roadmaps and capabilities.
• Next 6 months: Sponsor a pilot project for an AI-powered detection or response tool within your SecOps team.
• Within 12 months: Develop a strategic framework for AI integration across our cybersecurity programme, identifying key use cases and necessary investments.
• Ongoing: Attend executive-level webinars and conferences focused on AI in cybersecurity, staying ahead of the curve.
• QuickWin: Start experimenting with generative AI to draft security policies, incident reports, and executive summaries—it'll save your team hours and give you a feel for the tech.

Advancing Technical Skills

• Skill: Advanced Supply Chain & Third-Party Risk Management (TPRM)
• Why: Supply chain attacks (like SolarWinds) are now a primary vector for sophisticated adversaries. As our reliance on third-party vendors and cloud services grows, managing their security posture becomes as critical as managing our own. This isn't just about contracts; it's about deep technical and operational oversight.
• Concepts: [{'concept_name': 'Software Bill of Materials (SBOMs)', 'description': 'Understanding how SBOMs provide transparency into software components and their vulnerabilities, and how to mandate their use from vendors.'}, {'concept_name': 'Continuous Vendor Monitoring', 'description': 'Implementing automated tools and processes for real-time security posture monitoring of critical third parties, moving beyond annual questionnaires.'}, {'concept_name': 'Fourth-Party Risk', 'description': "Assessing the security risks introduced by our vendors' vendors—a complex but growing area of exposure."}, {'concept_name': 'Secure Software Development Lifecycle (SSDLC) for Vendors', 'description': 'Requiring and validating that our critical software vendors follow robust SSDLC practices.'}]
• Prepare: This quarter: Review our current TPRM programme; identify the top 10 critical third-party vendors.
• Next 6 months: Implement a continuous monitoring solution for these critical vendors.
• Within 12 months: Develop a strategy to mandate SBOMs from new software vendors and integrate them into our vulnerability management programme.
• Ongoing: Collaborate closely with Procurement and Legal to embed advanced security clauses into all vendor contracts.
• QuickWin: Identify your top 3 riskiest third-party vendors and schedule a deep-dive security review with their CISO or security lead.
• Skill: Quantum-Resistant Cryptography (QRC) Strategy
• Why: While it feels futuristic, the threat of quantum computers breaking current encryption algorithms is real and approaching. As Director, you need to start planning for this 'cryptographic apocalypse' now, especially for long-lived data that needs protection for decades. This is a multi-year endeavour.
• Concepts: [{'concept_name': 'Harvest Now, Decrypt Later', 'description': 'Understanding how adversaries are already collecting encrypted data today, intending to decrypt it once quantum computers are available.'}, {'concept_name': 'NIST Post-Quantum Cryptography Standardisation', 'description': 'Tracking the development and standardisation of new quantum-resistant algorithms.'}, {'concept_name': 'Cryptographic Inventory & Agility', 'description': 'Knowing where all our encryption is used and building the capability to rapidly switch to new algorithms when they become available.'}, {'concept_name': 'Quantum Key Distribution (QKD)', 'description': 'Understanding the potential and limitations of quantum physics-based key exchange mechanisms.'}]
• Prepare: This quarter: Start an inventory of all cryptographic assets and algorithms used across the organisation.
• Next 6 months: Develop a 'crypto-agility' strategy outlining how we can migrate to new algorithms.
• Within 12 months: Commission a white paper or external consultancy engagement to assess our specific quantum risk profile.
• Ongoing: Educate the C-suite and Board on the long-term implications of quantum computing for our data security.
• QuickWin: Identify your most sensitive, long-lived data (e.g., intellectual property, customer PII) and assess its current cryptographic protection and lifespan.

Education Requirements

• Level: Minimum
• Req: A Bachelor's degree (or equivalent OFQUAL Level 6 qualification) in Computer Science, Information Security, Engineering, or a related technical field.
• Alts: Extensive, demonstrable industry experience (18+ years) in senior cybersecurity leadership roles, coupled with relevant professional certifications, can be considered in lieu of a degree.
• Level: Preferred
• Req: A Master's degree (or equivalent OFQUAL Level 7 qualification) in Cybersecurity, Business Administration (MBA), or a related strategic discipline.
• Alts: Advanced certifications and a proven track record of thought leadership in the cybersecurity community.

Experience Requirements

You'll need at least 16-20 years of progressive experience in cybersecurity, with a minimum of 7-10 years in senior leadership positions (e.g., Head of Security, Senior Manager, Lead Architect) where you've owned strategic programmes and managed multiple teams. This isn't a role for someone who's only managed a small team or focused on a single technical domain. We're looking for someone who has genuinely shaped an organisation's security posture at an enterprise level, managed significant budgets, and regularly presented to executive leadership and the Board.

Preferred Certifications

• Cert: CRISC (Certified in Risk and Information Systems Control)
• Prod: ISACA
• Usage: Highly relevant for demonstrating expertise in identifying, assessing, and managing enterprise IT risk, which is central to this Director role.
• Cert: CCSP (Certified Cloud Security Professional)
• Prod: (ISC)²
• Usage: Given our significant cloud footprint, this certification shows a deep understanding of cloud security architecture, operations, and regulatory frameworks.
• Cert: GIAC GCIH (GIAC Certified Incident Handler)
• Prod: SANS Institute
• Usage: While a leadership role, a strong background in incident handling is invaluable for overseeing and directing effective incident response programmes.

Recommended Activities

• Regularly attend and speak at leading industry conferences (e.g., RSA Conference, Black Hat, Infosecurity Europe) to stay abreast of emerging threats and network with peers.
• Participate in executive-level cybersecurity forums or peer groups to share best practices and challenges.
• Engage in continuous learning through online courses, certifications, and reading industry publications to keep your knowledge current.
• Mentor junior security professionals, contributing to the broader cybersecurity community and developing future leaders.

Career Progression Pathways

Entry Paths to This Role

• Path: From Senior Security Management
• Time: 3-5 years as a Security Manager or Head of Security
• Path: From Lead Security Architect / Principal Engineer
• Time: 5-7 years as a Lead Architect or Principal Engineer
• Path: From Consulting / Advisory (Cybersecurity Focus)
• Time: 5-8 years in a Senior Manager or Director role at a leading cybersecurity consulting firm

Career Progression From This Role

• Pathway: Chief Information Security Officer (CISO)
• Time: 3-5 years as Director of Cybersecurity
• Pathway: Chief Risk Officer (CRO)
• Time: 5-7 years as Director of Cybersecurity

Long Term Vision Potential Roles

• Title: Chief Information Security Officer (CISO)
• Time: 3-5 years post-Director
• Title: Chief Risk Officer (CRO)
• Time: 5-7 years post-Director
• Title: Chief Technology Officer (CTO) / Chief Information Officer (CIO)
• Time: 7-10 years post-Director
• Title: Cybersecurity Board Advisor / Non-Executive Director (NED)
• Time: 10+ years post-Director (often after CISO)

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.