UK

United Kingdom · Technology and data · C-Suite (20+ years)

Chief Offensive Security Officer (COSO)

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

Start my free Automation Fluency module

As a Chief Offensive Security Officer (COSO), a good place to start on AI Governance & Ethical Hacking is Planning Automation Across a Department, a free Future Fluency module at Level 5. You'd practise working out what in your department's work could be automated, what should not be, and what to recommend.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandC-Suite (20+ years)
  • Reports toChief Executive Officer (CEO) and Board of Directors
  • UK framework levelUsually an executive or board-level role

Also advertised as Chief Information Security Officer (CISO) - Offensive Lead · VP, Enterprise Security Strategy · Global Head of Cyber Assurance

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

OCN NI Entry Level Certificate in Personal Success and Well-Being (Entry 3) Open College Network Northern Ireland · Entry Level · covers 1 of 8 standards
ATHE Level 6 Award in Security Risk Management Consultancy ATHE Ltd · Level 6 · covers 3 of 8 standards
Qualifi Level 7 Diploma in Cyber Security Qualifi Ltd · Level 7 · covers 2 of 8 standards
SFJ Awards Level 4 Certificate for Protective Security Advisers SFJ Awards · Level 4 · covers 2 of 8 standards
Transcend Level 5 Diploma in Risk Management of Security Operations Transcend Awards · Level 5 · covers 2 of 8 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Managing Risk OCN NI Entry Level Certificate in Personal Success and Well-Being (Entry 3)
Information and Cyber Security ATHE Level 6 Award in Security Risk Management Consultancy
Security Management and Governance Qualifi Level 7 Diploma in Cyber Security
Incident response and disaster recovery NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Incident Response and Management SFJ Awards Level 4 Certificate for Protective Security Advisers
Security operations solutions and service management Transcend Level 5 Diploma in Risk Management of Security Operations

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Frontier Fluency the next wave, beyond mainstream AI
Trust Fluency keeping the digital world safe
Your Plan Illustration

Built for Chief Offensive Security Officer (COSO)

6 units that map to this job, from the qualifications that cover it.

  1. Managing Risk Open College Network Northern Ireland · covers 1 of 8 standards Entry Level
  2. Information and Cyber Security ATHE Ltd · covers 3 of 8 standards Level 6
  3. Security Management and Governance Qualifi Ltd · covers 2 of 8 standards Level 7
  4. Incident response and disaster recovery NCFE · covers 5 of 8 standards Level 3
  5. Incident Response and Management SFJ Awards · covers 2 of 8 standards Level 4
  6. Security operations solutions and service management Transcend Awards · covers 2 of 8 standards Level 5
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Chief Offensive Security Officer (COSO)?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI Governance & Ethical Hacking
  • Quantum-Resistant Cryptography Strategy
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Chief Offensive Security Officer (COSO) plan as you set up, starting with the free Automation Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Ready to pay? Subscribe for £70 a month

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

A Chief Offensive Security Officer sets the strategy for how an organisation defends itself against cyber threats.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Enterprise GRC Platforms (e.g., ServiceNow GRC, Archer) Expert

Overseeing the integration and use of GRC platforms for enterprise risk management, compliance reporting, and security programme governance. Making strategic decisions on platform capabilities and data insights.

Strategic Threat Intelligence Platforms (e.g., Mandiant Advantage, Recorded Future) Advanced

Directing the use of threat intelligence to inform strategic planning, anticipate emerging threats, and brief the Board on the evolving cyber landscape. Not hands-on analysis, but strategic interpretation.

Executive Reporting & Dashboarding Tools (e.g., Tableau, Power BI, custom executive dashboards) Advanced

Reviewing and approving executive-level security dashboards and reports, ensuring they provide clear, actionable insights for the Board and leadership team. Guiding the development of new reporting capabilities.

Collaboration & Communication Suites (e.g., Microsoft 365, Slack, Zoom) Expert

Leading large virtual and in-person meetings, managing executive communications, and overseeing distributed security teams. You'll be using these constantly for strategic discussions and decision-making.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Enterprise Security Strategy & Vision N/A N/A COSO defines and drives the 3-5 year enterprise offensive security strategy, with Board review and approval for major directional shifts.
Budget Allocation & Investment N/A N/A COSO owns the multi-million-pound security budget (£10M+), making final decisions on resource allocation, tooling, and programme funding. Significant capital expenditure requires Board approval.
Organisational Design & Leadership Hiring N/A N/A COSO defines the structure of the offensive security function and has final hiring authority for all direct reports (Directors/VPs). Consults with HR and CEO on critical executive hires.
Major Incident Response N/A N/A COSO leads the executive response to major cyber incidents, making critical decisions on containment, eradication, recovery, and external communications (e.g., regulatory notifications, public statements). Informs CEO and Board immediately.
Regulatory & Compliance Stance N/A N/A COSO defines the organisation's approach to meeting and exceeding cyber security regulatory requirements. Represents the company in discussions with key regulators and external auditors.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Enterprise Critical Vulnerability Remediation Rate
The percentage of critical vulnerabilities identified across the entire organisation that are remediated within agreed-upon SLAs (Service Level Agreements).
Target · 95% of critical vulnerabilities remediated within 30 days; 100% within 60 days.

If 100 critical vulnerabilities were found in Q1, 97 of them were closed within 30 days, and all 100 within 60 days. That's a 97% 30-day rate and 100% 60-day rate.

Return on Security Investment (ROSI)
A calculated measure of the financial benefit derived from security investments (e.g., avoided breach costs, reduced insurance premiums) versus the cost of those investments.
Target · Demonstrate a positive ROSI for major security initiatives (e.g., >1.5x for new tooling or programme launches).

A £2M investment in a new threat intelligence platform led to a 10% reduction in detected advanced persistent threats, saving an estimated £3M in potential incident response and reputational damage, yielding a 1.5x ROSI.

Red Team Success Rate (Attack Simulation)
The percentage of red team engagements where the team successfully achieved its primary objective (e.g., exfiltrated sensitive data, gained domain admin) without detection by blue team controls.
Target · Maintain a 'successful initial compromise' rate of <20% for red team operations, indicating strong preventative controls.

Out of 4 red team exercises, only 1 managed to achieve its full objective undetected, meaning a 25% success rate for the red team (which is a good outcome for the defence).

Regulatory Compliance Audit Score
Scores from external regulatory audits related to cyber security controls and data protection.
Target · Achieve 'satisfactory' or 'excellent' ratings in all relevant regulatory audits, with zero critical findings.

The annual GDPR audit resulted in a 'Strong' rating with only minor recommendations, and no fines were issued in the past year related to data breaches.

Board and Executive Confidence
How confident the Board and Executive Leadership Team feel about the organisation's cyber security posture and your leadership.
  • Regularly sought for strategic advice on business initiatives with security implications
  • proactive engagement from Board members during security updates
  • positive feedback from CEO/Board Chair on clarity and completeness of reports
  • security discussions are integrated into broader business risk discussions, not just an afterthought.
Security Culture & Awareness
The overall understanding and proactive behaviour of employees regarding security best practices.
  • Employee phishing click-through rates consistently below industry average
  • high engagement in security training programmes
  • employees proactively reporting suspicious activities
  • positive feedback from internal surveys about security being seen as an enabler, not a blocker
  • security champions programme thriving across departments.
Industry Standing & Thought Leadership
Your and the organisation's reputation within the broader cyber security community and with regulators.
  • Invited to speak at major industry conferences
  • active participation in industry working groups
  • positive mentions in security publications or analyst reports
  • recognised as a leader in specific security domains (e.g., cloud security, incident response)
  • strong relationships with regulatory bodies.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Protecting the Enterprise

You're driven by the profound responsibility of safeguarding the entire organisation from sophisticated cyber threats. This manifests in rigorous strategic planning, constant evaluation of our security posture, and ensuring our teams have the resources they need to do their best work. You get a deep satisfaction from knowing you're the last line of defence.

Spending late nights reviewing the threat landscape report, not because you have to, but because you genuinely want to understand every potential angle an attacker might take against the company.

Strategic Impact & Influence

You thrive on shaping the overarching security direction of a large organisation, influencing critical business decisions, and seeing your vision come to life. This means engaging frequently with the Board and executive team, presenting compelling arguments for investment, and driving cultural change across the enterprise.

Successfully securing a multi-million-pound budget increase for a new security programme after presenting a clear, data-backed case to the CEO and Board, knowing this will fundamentally improve our defence.

Building High-Performing Teams & Capabilities

You're passionate about nurturing talent, building world-class security capabilities, and seeing your direct reports grow into future leaders. This involves mentoring, strategic hiring, and creating an environment where security professionals can excel and innovate.

Taking pride in seeing one of your Directors successfully lead a complex incident response, knowing you've built the team and processes that enabled that success.

What frustrates people
  • The constant tension between security requirements and business agility, often feeling like you're the 'department of no'.
  • Explaining the same foundational security concepts to new Board members or executives, feeling like you're starting from scratch every few years.
  • Dealing with legacy systems that are inherently insecure but too costly or complex to replace immediately.
  • The relentless pace of new threats and regulatory changes, meaning your 'finished' strategy is always a work in progress.
  • The emotional toll of a major security incident, even when managed perfectly, knowing the potential impact on individuals and the business.
What this role does not give you
  • Daily technical deep-dives or hands-on penetration testing.
  • A quiet, predictable work environment with minimal political navigation.
  • The ability to make unilateral security decisions without significant stakeholder buy-in.
  • A role where you're not ultimately accountable for enterprise-level security failures.

8Who you work with

This role has enterprise-wide impact, directly influencing our overall risk posture, regulatory standing, and market perception. Your decisions shape how we invest in security, how we respond to incidents, and ultimately, our ability to operate securely and maintain customer trust. You're the ultimate guardian against cyber threats, making sure the business can grow without undue risk.

Inside the business
  • CEO and Executive Leadership Team
  • Board Audit and Risk Committee
  • Chief Technology Officer (CTO)
  • Chief Information Officer (CIO)
  • Chief Legal Officer (CLO)
  • Head of Compliance and Risk Management
  • Heads of Business Units (e.g., Retail, Commercial)
Outside the business
  • Key Regulators (e.g., FCA, ICO, NCSC)
  • External Auditors and Security Consultants
  • Industry Peers and Information Sharing Groups
  • Cyber Insurance Providers
  • Key Technology Vendors

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • 20+ years of progressive experience in cyber security, with at least 10 years in leadership roles and 5 years at a Director or VP level, specifically overseeing offensive security or a broad security programme.
  • Demonstrated experience managing multi-million-pound budgets and leading large, geographically dispersed security teams (100+ people, including managers).
  • Proven track record of successfully engaging with and presenting to Boards of Directors, C-suite executives, and regulatory bodies.
  • Extensive experience in developing and implementing enterprise-wide security strategies that have demonstrably reduced risk.
  • Deep understanding of the financial services industry (or similar highly regulated sector) and its unique security challenges, or equivalent experience.

10What to practise next

Where the job is going, and what to do about it starting this week.

Advanced Cloud Native Security Governance

Cloud-native architectures (containers, serverless, microservices) are constantly evolving, presenting new security challenges and opportunities. You'll need to ensure our offensive security strategy effectively addresses these dynamic environments.

Container security (e.g., Kubernetes, Docker) · Serverless function security (e.g., AWS Lambda, Az · Infrastructure as Code (IaC) security scanning and · Cloud security posture management (CSPM) and cloud · Zero Trust principles in cloud environments

  • This quarter: Review the latest cloud security breach reports and understand their root causes.
  • Next 6 months: Ensure your cloud security leadership team is actively participating in relevant industry groups and certifications.
  • Next 12 months: Drive the adoption of advanced cloud security governance frameworks and automation within our engineering teams.
  • Ongoing: Regularly challenge the assumptions and effectiveness of our cloud security controls.

Quick win: Ask your Head of Cloud Security to present a deep-dive on our current cloud-native security posture and any identified gaps.

Human-Centric Security Design

Technical controls are only as strong as the weakest human link. Future security strategy must increasingly integrate behavioural science and user experience design to build more resilient human defences.

Security awareness programme effectiveness metrics · Behavioural economics in security decision-making · User-friendly security tools and processes · Psychological safety and incident reporting cultur · Measuring the impact of security culture on overal

  • This quarter: Partner with HR and internal communications to review our current security awareness programme.
  • Next 6 months: Research leading practices in human-centric security design and behavioural science.
  • Next 12 months: Pilot new approaches to security training and communication that focus on user behaviour and positive reinforcement.
  • Ongoing: Integrate human factors into our incident post-mortems and threat modelling.

Quick win: Read 'Security Culture' by Kai Roer or 'Human Hacking' by Christopher Hadnagy to get a different perspective on human risk.

11Staying current once you are in

What people here do to keep up
  • Active participation in industry CISO forums and information-sharing groups (e.g., FS-ISAC, NCSC Industry 100).
  • Regular attendance at executive-level cyber security conferences (e.g., RSA Conference, Black Hat CISO Summit).
  • Engagement with academic institutions on cyber security research and talent development.
  • Mentoring aspiring security leaders within and outside the organisation.
  • Publishing thought leadership articles or speaking at industry events to shape the broader security dialogue.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

AI Governance & Ethical Hacking

AI is becoming embedded in every aspect of business, creating new attack surfaces and ethical dilemmas. As COSO, you'll need to guide the responsible and secure adoption of AI, ensuring it doesn't introduce unacceptable risks.

  • AI model security (e.g., prompt injection, data po
  • Ethical considerations for AI in offensive securit
  • Regulatory frameworks for AI (e.g., EU AI Act, UK
  • AI-driven threat detection and response capabiliti
  • Securing AI supply chains and third-party AI servi

Quantum-Resistant Cryptography Strategy

While still some years away, the advent of quantum computing poses an existential threat to current cryptographic standards. As COSO, you'll need to start planning the long-term transition to quantum-resistant algorithms to protect our data for decades to come.

  • Shor's algorithm and its impact on current encrypt
  • NIST Post-Quantum Cryptography (PQC) standardisati
  • Cryptographic agility and hybrid approaches
  • Inventorying critical data and systems requiring P
  • Budgeting and resource planning for cryptographic

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Offensive Security Programme Design
  • Enterprise Threat Modelling
  • Security Architecture & Engineering Principles
  • Incident Response & Crisis Management
  • Cyber Legal & Regulatory Frameworks

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    Director of Offensive Security / Head of Red Team

    5-8 years at this level before COSO

    Skills to master

    • Leading large, complex red team operations, building and managing a diverse offensive security team, developing strategic threat emulation programmes, and presenting technical risks to executive audiences.

    You're ready to move on when

    • Successfully built and scaled an offensive security function within a large enterprise.
    • Consistently delivered high-impact findings that led to significant risk reduction.
    • Proven ability to manage multi-million-pound budgets and influence senior stakeholders.
    • Demonstrated leadership in crisis situations, particularly during incident response.
  2. 2

    Chief Information Security Officer (CISO) - Mid-sized Enterprise

    3-6 years at this level before COSO (larger enterprise)

    Skills to master

    • End-to-end ownership of an entire security programme (offensive and defensive), managing all aspects of cyber risk, regulatory compliance, and security operations. Board engagement and executive leadership.

    You're ready to move on when

    • Successfully built and matured an entire security programme in a complex environment.
    • Navigated significant regulatory audits without major findings.
    • Proven ability to recruit, retain, and develop a comprehensive security team.
    • Strong track record of positive engagement with the Board and external regulators.
  3. 3

    VP, Security Architecture / Head of Security Engineering

    6-10 years at this level before COSO

    Skills to master

    • Designing and implementing secure enterprise architectures, driving secure development lifecycles, evaluating and integrating advanced security technologies, and building strong relationships with engineering and product teams.

    You're ready to move on when

    • Architected and secured major enterprise platforms (e.g., cloud migrations, new product launches).
    • Led a significant transformation in the organisation's security engineering practices.
    • Demonstrated ability to balance security requirements with business innovation and speed.
    • Strong understanding of offensive security principles from a defensive perspective.

15Where this role leads

The long view: Experience at this level can lead to chief executive roles, board positions, or advisory work on cyber security strategy.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Chief Offensive Security Officer (COSO) is actually changing.

Where it leads

Roles this leads to

The record names a next step, but the catalogue has no page for it yet:

  • Chief Executive Officer (CEO)
  • Board Member / Non-Executive Director (NED)

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Managing Risk, worked against Chief Offensive Security Officer (COSO).

Managing Risk Entry Level

Applied to your work in Chief Offensive Security Officer (COSO)

The objective of this unit is to enable learners to recognise potential risks to themselves and others, identifying hazards and vulnerabilities in various situations. Learners will understand and implement strategies to effectively manage risk, minimise harm, and promote safety.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
Chief Offensive Security Officer (COSO)
  • Offensive Security Programme Design
  • Enterprise Threat Modelling
  • Security Architecture & Engineering Principles
  • Incident Response & Crisis Management
  • Cyber Legal & Regulatory Frameworks
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Chief Offensive Security Officer (COSO) is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Chief Executive Officer (CEO)

    5-10 years

    Enterprise Leadership

    • Deep understanding of all business functions (Sales, Marketing, Product, Operations)
    • Macroeconomic analysis and market forecasting
    • Global regulatory and geopolitical landscape navigation
    • Stakeholder management at the highest level (shareholders, board, government)

  2. Board Member / Non-Executive Director (NED)

    Immediately or within 2-3 years

    Governance & Oversight

    • Fiduciary duties and legal obligations of a director
    • Evaluating executive performance and succession planning
    • Risk management at a portfolio level across multiple companies
    • Providing independent strategic guidance
Working with AI on the job

Working with AI

Where AI is starting to help

Even at the C-suite, AI isn't just a buzzword; it's a strategic enabler. As the Chief Offensive Security Officer, you'll use AI not for hands-on hacking, but to gain deeper insights, automate governance, and communicate complex risks more effectively to the Board and executive team. This isn't about replacing your strategic mind, but augmenting it.

Imagine having a constant, intelligent assistant that sifts through mountains of threat intelligence, summarises complex regulatory changes, and even drafts the first pass of your board reports. That's the power AI brings to this executive role. It frees you up to focus on the truly strategic, high-impact decisions that only a human leader can make.

Threat Landscape Analysis & Foresight

Use AI platforms to aggregate and analyse global threat intelligence, identifying emerging attack vectors and predicting potential impacts on our specific industry and infrastructure. This gives you a proactive edge in strategic planning, saving countless hours of manual research.

Automated Risk Reporting & Dashboards

Integrate AI-powered tools with GRC (Governance, Risk, and Compliance) platforms to automatically generate executive-level risk dashboards and reports. The AI can highlight key trends, flag critical vulnerabilities, and even suggest language for board presentations, making your reporting much more efficient and impactful.

Regulatory Impact Assessment

Feed new or updated regulatory texts (e.g., NCSC guidelines, GDPR amendments) into an AI model that summarises key changes and assesses their direct impact on our existing security policies and controls. This helps you quickly understand compliance gaps and prioritise strategic responses.

Strategic Communication Drafting

Use generative AI to draft initial versions of internal communications, policy updates, or even sections of your board presentations. Provide the key points, and the AI can help structure the message, ensuring clarity and impact for diverse audiences, from technical teams to non-technical executives.

Common questions

Common questions

How do you become a Chief Offensive Security Officer (COSO)?

Common routes in include Director of Offensive Security / Head of Red Team (5-8 years at this level before COSO), Chief Information Security Officer (CISO) - Mid-sized Enterprise (3-6 years at this level before COSO (larger enterprise)) and VP, Security Architecture / Head of Security Engineering (6-10 years at this level before COSO). Times vary with prior experience.

Where can a Chief Offensive Security Officer (COSO) progress to?

This role can lead on to Chief Executive Officer (CEO) (5-10 years) and Board Member / Non-Executive Director (NED) (Immediately or within 2-3 years), depending on the skills you build.

What new skills matter most for a Chief Offensive Security Officer (COSO)?

Increasingly, AI Governance & Ethical Hacking and Quantum-Resistant Cryptography Strategy. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 8

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills transfer across any industry that faces cyber risk, including financial services, critical infrastructure, defence, technology and healthcare.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free Automation Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.