UK

United Kingdom · Technology and data · Director/VP (16-20 years)

Director of Security

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

Start my Director of Security plan, free

Free to start: a plan built for this role, and a Future Fluency module to try first. No card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Upskilling a team in this role? Talk to us

  • Experience bandDirector/VP (16-20 years)
  • Direct reports3-8 reports
  • Reports toChief Information Security Officer (CISO)
  • UK framework levelUsually a director, accountable for a division and its numbers

Also advertised as Head of Information Security · VP Security Operations · Senior Security Director

Built on 43,079 real UK job descriptions we analysed · grounded in qualifications employers recognise

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

Qualifi Level 5 Extended Diploma in Cyber Security Qualifi Ltd · Level 5 · covers 4 of 8 standards
Qualifi Level 4 Diploma in Cyber Security Qualifi Ltd · Level 4 · covers 2 of 8 standards
SFJ Awards Level 4 Certificate for Protective Security Advisers SFJ Awards · Level 4 · covers 2 of 8 standards
ATHE Level 7 Extended Diploma in Computing ATHE Ltd · Level 7 · covers 2 of 8 standards
Qualifi Level 7 Diploma in Cyber Security Qualifi Ltd · Level 7 · covers 1 of 8 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Incident Response, Investigations and Forensics Qualifi Level 5 Extended Diploma in Cyber Security
Incident response and disaster recovery NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)
Incident Response and Management SFJ Awards Level 4 Certificate for Protective Security Advisers
Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Level 7 Extended Diploma in Computing
Security Management and Governance Qualifi Level 7 Diploma in Cyber Security

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Automation Fluency building AI into how work runs
Trust Fluency keeping the digital world safe
Start my Director of Security plan, free
Your Plan Illustration

Built for Director of Security

5 units that map to this job, from the qualifications that cover it.

  1. Incident Response, Investigations and Forensics Qualifi Ltd · covers 4 of 8 standards Level 5
  2. Incident response and disaster recovery NCFE · covers 3 of 8 standards Level 3
  3. Incident Response and Management SFJ Awards · covers 2 of 8 standards Level 4
  4. Cyber Security Operations: Threat Analysis, Testing, and Incident Response ATHE Ltd · covers 2 of 8 standards Level 7
  5. Security Management and Governance Qualifi Ltd · covers 1 of 8 standards Level 7
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as a Director of Security?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • AI-Driven Security Operations (SecOps)
  • Supply Chain Risk Management (SCRM) Leadership
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Director of Security plan as you set up, starting with a Future Fluency module on using AI in your job. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Start my Director of Security plan, free Ready to pay? Subscribe for £70 a month

3What this role really is

A Director of Security leads a major part of an organisation's defence against threats, setting the security posture for a business unit and linking technical security work to business strategy.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Splunk or Elastic Stack (ELK) Advanced

You'll use these to understand overall threat trends, review high-level security dashboards, and validate the effectiveness of detection rules. You won't be writing complex queries daily, but you need to understand the data and its strategic implications.

CrowdStrike Falcon or SentinelOne (EDR/XDR) Advanced

You'll be reviewing high-level reports on endpoint threat posture, understanding the effectiveness of our EDR/XDR controls, and using the data to inform strategic decisions about endpoint defence. You'll also be briefed on critical incidents detected by these platforms.

Tenable.sc (Nessus) or Qualys VMDR (Vulnerability Management) Advanced

You'll review executive-level vulnerability reports, track remediation progress against SLAs, and use this data to assess the overall risk exposure of your business unit. You'll also use this to justify investment in patching programmes or new security tools.

AWS Security Hub & GuardDuty or Microsoft Defender for Cloud Advanced

You'll oversee the cloud security posture of your business unit, reviewing compliance scores, understanding major misconfigurations, and ensuring automated remediation efforts are effective. You'll use these tools to report on cloud risk to business leadership.

ServiceNow GRC & Jira Advanced

You'll use ServiceNow GRC to manage the overall risk register for your business unit, track policy exceptions, and report on compliance status to internal audit and leadership. Jira will be used to track the progress of major security initiatives and team workload.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Security Strategy & Roadmap No input, follows defined tasks. Contributes ideas for specific system improvements. Leads definition of strategy for a specific domain (e.g., Cloud Security).
Budget Allocation & Vendor Selection No authority. Recommends tools for specific tasks. Recommends vendors for projects up to £5K, with manager approval.
Major Incident Response Executes specific tasks from a playbook. Leads containment for routine incidents, escalates complex issues. Acts as technical lead for major incidents, coordinates response efforts.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Business Unit Risk Score Reduction
The overall reduction in the calculated risk score for your assigned business unit, based on identified vulnerabilities, threats, and control effectiveness.
Target · Achieve a 15-20% reduction in the overall risk score year-on-year

If the Q1 risk score was 3.5 (out of 5), the target for Q1 next year would be 2.8-3.0, showing tangible improvements in our defence.

Major Incident Containment Time (MTTC)
The average time it takes for your security operations teams to contain a critical security incident within your business unit, from detection to full containment.
Target · Maintain MTTC for critical incidents below 60 minutes, with a stretch goal of 45 minutes

Following a ransomware attempt, the team managed to isolate affected systems and stop lateral movement within 55 minutes, preventing wider impact.

Security Programme Budget Adherence
How closely your business unit's security spending aligns with the approved annual budget, including both operational expenditure (OpEx) and capital expenditure (CapEx).
Target · Maintain spending within ±5% of the approved annual budget

Year-end spend was £2.85M against a £3M budget, a 5% underspend due to successful vendor negotiations and optimised cloud security costs.

Audit and Compliance Pass Rate
The percentage of internal and external security audits (e.g., ISO 27001, SOC 2, GDPR) where your business unit achieves a 'no major findings' or 'fully compliant' status.
Target · Achieve a 95%+ pass rate on all external audits, with zero critical findings

The annual ISO 27001 audit for the product division resulted in zero non-conformities, a direct result of strong control implementation and continuous monitoring.

Strategic Influence & Collaboration
Your ability to influence senior business leaders to prioritise security initiatives, integrate security early into new projects, and foster a strong security culture within your business unit.
  • You're regularly invited to business unit leadership meetings, your input is sought on strategic decisions, and other departments proactively engage your team for security advice. You'll see security considerations embedded in project charters from the start, not as an afterthought. Feedback from peer Directors will often highlight your collaborative approach and ability to get things done without being seen as 'the department of no'.
Team Leadership & Talent Development
How effectively you build, mentor, and retain a high-performing security team, ensuring they have the skills and support needed to meet current and future challenges.
  • Your direct reports consistently meet their objectives and show clear career progression. Retention rates within your team are above average for the industry. You'll be known for developing future security leaders, and your team members will often cite your mentorship as a key reason for their success and satisfaction. Positive feedback from skip-level reports during annual reviews is a good sign.
Proactive Threat Posture
Your business unit's shift from a reactive security stance to a more proactive one, anticipating threats and implementing preventative measures before incidents occur.
  • You'll see a measurable increase in threat hunting activities and successful pre-emptive mitigations. Your teams are regularly identifying and addressing vulnerabilities before they're exploited. External threat intelligence is actively integrated into your security controls, and you're often ahead of industry trends in your defence strategies, rather than playing catch-up.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Protecting the Business

You'll feel a deep sense of responsibility for safeguarding our company's assets, data, and reputation. This shows up in your relentless pursuit of better defences, your meticulous review of incident reports, and your drive to build a truly resilient security posture for your business unit.

Successfully leading the response to a sophisticated phishing campaign that targeted your business unit, preventing any data exfiltration or financial loss, and then implementing new preventative controls.

Building a High-Performing Team

You'll get a real kick out of coaching your managers, seeing your teams grow their skills, and fostering a culture of excellence and collaboration. You'll spend time mentoring, removing roadblocks, and celebrating their successes, knowing that a strong team is the best defence.

Seeing one of your managers successfully lead a complex security project from inception to completion, earning recognition from senior leadership, and knowing you played a part in their development.

Strategic Impact & Influence

You're driven by the opportunity to shape the security direction of a major business unit, making decisions that have a tangible, long-term impact on our resilience. You enjoy the challenge of convincing senior leaders to invest in security and seeing those investments pay off.

Successfully advocating for a multi-million pound investment in a new cloud security platform, then overseeing its implementation and seeing a significant reduction in cloud-related incidents.

What frustrates people
  • Dealing with 'management risk acceptance' where a known, significant risk is accepted by the business unit because the fix is deemed too expensive or disruptive.
  • The constant battle against 'shadow IT' where business teams spin up new services without security review, creating blind spots.
  • The slow pace of change in large organisations, especially when trying to deprecate old, insecure systems or enforce new policies.
  • Having to justify security spend repeatedly, even after demonstrating clear ROI or risk reduction.
  • The emotional toll of managing a major security incident, knowing the company's reputation and finances are on the line.
What this role does not give you
  • A purely technical, hands-on coding or penetration testing role.
  • An environment where security is always the top priority without needing to justify its value.
  • A quiet, predictable work schedule; incidents don't care about your plans.
  • The ability to make unilateral decisions without needing to build consensus or gain buy-in from other senior leaders.

8Who you work with

This role directly shapes the security posture and risk tolerance of a multi-million pound business unit. Your decisions impact everything from product development timelines and customer trust to our regulatory standing and financial stability. You're essentially the guardian of a significant portion of our digital assets and reputation.

Inside the business
  • CISO and other Security Directors
  • Business Unit Managing Directors/VPs
  • Heads of Product and Engineering
  • Legal and Compliance teams
  • Internal Audit Committee
Outside the business
  • External auditors and regulators (e.g., ICO, FCA)
  • Key technology vendors and security partners
  • Industry peers and security forums
  • Customers and clients (in specific contexts)

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • Proven track record of leading and managing large security teams (20+ individuals, including managers) for at least 5 years.
  • Demonstrable experience in defining and executing security strategies for a significant business unit or domain.
  • Extensive experience in managing security budgets of at least £1M annually.
  • Deep expertise in at least two major security domains (e.g., Cloud Security, Incident Response, GRC) at an architectural and programme management level.
  • Experience presenting complex security topics and risks to C-suite executives and/or Board members.
  • Demonstrated ability to drive significant security transformation initiatives in a complex organisational environment.
  • Strong understanding of enterprise risk management principles and their application to information security.

10What to practise next

Where the job is going, and what to do about it starting this week.

Quantum Computing Security Implications

Quantum computing, while still nascent, poses a long-term existential threat to current cryptographic standards. As a Director, you need to start understanding these implications now to plan for post-quantum cryptography (PQC) migration strategies. This is important within 2-3 years.

Shor's algorithm and its impact on asymmetric encr · Grover's algorithm and its impact on symmetric enc · Post-Quantum Cryptography (PQC) standards and algo · Crypto-agility and inventory of cryptographic asse · Quantum-resistant algorithms for data at rest and

  • This quarter: Read introductory papers on quantum computing and its security implications.
  • Next quarter: Attend a webinar or workshop on post-quantum cryptography.
  • Month 6: Begin an inventory of your business unit's cryptographic assets and their current algorithms.
  • Month 12: Develop a preliminary strategy for crypto-agility and PQC migration, even if it's just a 'watching brief'.

Quick win: Start a conversation with your technical leads about our current cryptographic inventory and how we might adapt to future changes. It's about raising awareness now.

Advanced Threat Intelligence (ATI) Integration

Threat intelligence is only useful if it's actionable. As threats become more sophisticated, you need to ensure your teams are not just consuming ATI, but effectively integrating it into detection rules, vulnerability prioritisation, and strategic defence planning. This is critical within 12 months.

Operationalising MITRE ATT&CK for proactive defenc · Automated ingestion and correlation of ATI with in · Measuring the effectiveness of ATI feeds · Human intelligence (HUMINT) vs. technical intellig · Sharing and consuming intelligence within industry

  • This quarter: Review your business unit's current ATI sources and how they're used.
  • Next quarter: Challenge your SecOps leads to demonstrate how ATI directly informs detection rule creation.
  • Month 6: Explore new ATI platforms or services that offer more actionable intelligence for your specific threats.
  • Month 9: Develop metrics to measure the ROI and effectiveness of your ATI programme.

Quick win: Ensure your teams are regularly reviewing and discussing high-priority threat reports, and that the key takeaways are being translated into immediate actions (e.g., new firewall rules, EDR detections).

11Staying current once you are in

What people here do to keep up
  • Regularly attend industry conferences (e.g., RSA, Black Hat, Infosecurity Europe) to stay abreast of emerging threats and technologies.
  • Participate in security leadership forums or peer groups to share insights and best practices with other Directors of Security.
  • Engage in executive education programmes focused on leadership, business strategy, or advanced risk management.
  • Contribute to industry whitepapers, articles, or speaking engagements to establish thought leadership and represent the organisation.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

AI-Driven Security Operations (SecOps)

AI is rapidly transforming how we detect, respond to, and prevent threats. Leaders who understand how to strategically deploy and manage AI in SecOps will significantly improve efficiency and effectiveness, reducing dwell time and analyst fatigue. This is critical within 12 months.

  • AI/ML for anomaly detection and behavioural analyt
  • Automated incident response with AI-powered SOAR p
  • Generative AI for threat intelligence synthesis an
  • Ethical considerations and bias in AI security too
  • Data governance for AI models in security

Supply Chain Risk Management (SCRM) Leadership

Recent high-profile attacks (e.g., SolarWinds, Log4j) have highlighted the critical vulnerability of the supply chain. As a Director, you'll be accountable for managing the security risks introduced by our vendors and third-party partners. This is becoming critical within 6-12 months.

  • Third-party risk assessment methodologies (e.g., S
  • Software Bill of Materials (SBOM) and its implicat
  • Contractual security requirements for vendors
  • Continuous monitoring of third-party security post
  • Incident response coordination with supply chain p

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Enterprise Security Architecture
  • Security Governance, Risk & Compliance (GRC)
  • Incident Response & Crisis Management
  • Cloud Security Strategy
  • Application Security (AppSec) Programme Management

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    From Security Engineering Manager / Principal Security Engineer

    5-8 years in a management or principal-level role

    Skills to master

    • Moving from managing a team or specific domain to owning a broader business unit's security. This means developing stronger executive communication, budget management, and organisational design skills. You'll need to think more about business outcomes than pure technical excellence.

    You're ready to move on when

    • Successfully led a major security programme from end-to-end, with measurable business impact.
    • Consistently delivered on budget and resource allocation for your functional area.
    • Mentored and developed multiple senior engineers or junior managers.
    • Regularly presented to and influenced senior (non-security) leadership on technical risk.
  2. 2

    From another Director-level role (e.g., Director of IT Operations, Director of Infrastructure)

    3-5 years in a related Director role

    Skills to master

    • While you'd have strong leadership and operational skills, you'd need to deepen your specific security expertise across all domains (network, cloud, data, identity) and develop a strategic understanding of the threat landscape. You'd also need to get up to speed on security governance and compliance frameworks.

    You're ready to move on when

    • Managed a large technical department with significant budget and P&L responsibility.
    • Proven ability to build and lead high-performing technical teams.
    • Demonstrated strategic planning and execution capabilities.
    • A strong personal interest and foundational knowledge in information security principles.

15Where this role leads

The long view: From here, the path can lead to a CISO role, a broader executive position such as Chief Risk Officer, or independent security advisory work.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Director of Security is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Incident Response, Investigations and Forensics, worked against Director of Security.

Incident Response, Investigations and Forensics Level 5

Applied to your work in Director of Security

This unit aims to equip learners with an understanding of incident response as a business function, including the operation of Computer Emergency Response Teams (CERTs) and aligned task forces for business continuity, disaster recovery, and crisis management. Learners will also understand how major computer incidents are formally investigated, including evidence gathering and analysis, and the relevant legal and ethical considerations.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

Start my Director of Security plan, free
See Your Progress Grow Illustration
Director of Security
  • Enterprise Security Architecture
  • Security Governance, Risk & Compliance (GRC)
  • Incident Response & Crisis Management
  • Cloud Security Strategy
  • Application Security (AppSec) Programme Management
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Director of Security is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Chief Information Security Officer (CISO)

    3-5 years as a Director of Security

    From business unit ownership to enterprise-wide security and risk posture. Board-level accountability and external representation.

    • Security programme maturity modelling (e.g., CMMI for security)
    • Advanced security metrics and KPIs for executive reporting
    • Crisis communication and media relations during major incidents
    • Strategic vendor management for enterprise security solutions
Working with AI on the job

Working with AI

Where AI is starting to help

As a Director of Security, your time is gold. You're juggling strategic planning, team leadership, stakeholder management, and crisis response. The good news? AI isn't just for the technical teams anymore; it's a powerful ally for senior leaders, helping you cut through the noise and focus on what truly matters: protecting the business.

Imagine having a highly intelligent assistant that can summarise complex threat intelligence, draft executive reports, and even help you model risk scenarios in minutes. That's the reality with AI. We're not talking about replacing your strategic thinking, but augmenting it, giving you more time to lead, innovate, and drive critical security outcomes for your business unit.

Strategic Risk Modelling & Scenario Planning

Use AI to rapidly build and test 'what if' scenarios for potential security incidents or new threat vectors. Feed it data on your assets, controls, and past incidents, and ask it to predict the impact of a ransomware attack or a supply chain compromise. This helps you make more informed, data-driven strategic decisions and present compelling cases for investment to the C-suite.

Executive Reporting & Board Presentation Prep

Cut down hours spent drafting board papers, executive summaries, and compliance reports. Provide AI with raw data, incident logs, or technical reports, and ask it to generate clear, concise, and impactful narratives tailored for a non-technical audience. It's like having a dedicated comms team at your fingertips, ensuring your message lands perfectly every time.

Advanced Threat Landscape Analysis

Leverage AI to synthesise vast amounts of global threat intelligence, regulatory updates, and industry trends. Ask it to identify emerging threats relevant to your specific business unit, summarise the latest attack techniques, or even predict future regulatory changes. This keeps you ahead of the curve, allowing you to proactively adjust your strategy and brief your teams effectively.

Policy & Governance Document Generation

Accelerate the creation and review of security policies, standards, and governance frameworks. AI can help draft initial versions of new policies based on best practices (e.g., NIST, ISO 27001) or identify gaps in existing documents against new regulations. This ensures your business unit's security posture is always up-to-date and compliant, without the manual grind.

Common questions

Common questions

How do you become a Director of Security?

Common routes in include From Security Engineering Manager / Principal Security Engineer (5-8 years in a management or principal-level role) and From another Director-level role (e.g., Director of IT Operations, Director of Infrastructure) (3-5 years in a related Director role). Times vary with prior experience.

Where can a Director of Security progress to?

This role can lead on to Chief Information Security Officer (CISO) (3-5 years as a Director of Security), depending on the skills you build.

What new skills matter most for a Director of Security?

Increasingly, AI-Driven Security Operations (SecOps) and Supply Chain Risk Management (SCRM) Leadership. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 7

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built as a Director of Security carry across most industries, including finance, healthcare, retail and manufacturing. Every organisation needs security leadership, so the options are broad. Risk management, team leadership and strategic defence stay much the same, even when the threats or regulations differ.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my Director of Security plan, free What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.