About the Role:We are seeking a highly skilled and experienced Deputy Chief Information Security Officer (Deputy CISO) to join our dynamic cybersecurity team. This is an exciting opportunity for someone with a robust understanding of information security, policy development, and hands-on technical expertise. The Assistant CISO will play a key role in rewriting and implementing information security standards, collaborating with key stakeholders to ensure alignment with organisational risk management practices, and fostering a proactive security culture across the company.As a key partner to the CISO, this role involves both strategic thinking and practical, hands-on execution of information security activities. The Assistant CISO will contribute to the development, maintenance, and enforcement of security policies and standards, while also ensuring that security risks are actively managed through collaboration with the Joint Risk Committee (JRC) and other relevant teams.
Key Responsibilities:
Standards Development & Rewriting:
Oversee the review, rewriting, and continuous improvement of security standards to ensure they meet current industry best practices and align with legal, regulatory, and organisational requirements.
Develop and implement guidelines for adherence to these standards across the company.Policy Management:
Work closely with the CISO and other security leaders to create, update, and enforce information security policies.
Ensure that security policies are effectively communicated and understood across departments, with emphasis on practical applicability.
Provide guidance on policy exceptions, ensuring they are properly managed and documented.JRC Collaboration:
Act as a liaison between the Information Security team and the Joint Risk Committee (JRC), participating in risk assessments and discussions to identify, prioritise, and mitigate security risks.
Provide detailed technical insights on security threats and vulnerabilities, and support JRC members in decision-making processes.Hands-On Security Experience:
Take an active role in the day-to-day management of security operations, including incident response, threat hunting, vulnerability management, and other proactive measures.
Provide expertise in implementing technical security solutions and ensuring they align with organisational goals.
Assist with the management of security tools, systems, and processes to protect the organisation's assets and data.Cross-Departmental Collaboration:
Partner with IT, Legal, Compliance, and other business units to ensure that security policies and practices align with operational goals and
Legal/regulatory requirements.
Contribute to the development of training programs to raise awareness about information security within the organisation.Risk Assessment & Mitigation:
Conduct risk assessments of business processes and applications to identify security gaps and recommend solutions.
Track, manage, and mitigate risks identified through internal and external audits, vulnerability assessments, and other review processes.
Reporting & Documentation:
Prepare regular reports for the CISO and senior management, summarising security incidents, trends, and the effectiveness of security policies and controls.
Document all security policies, procedures, and standards, ensuring they are updated regularly to reflect evolving threats and changes in the business.
Key Requirements:
Technical Skills:
Deep understanding of security frameworks (e.g., NIST, ISO 27001, CIS Controls, etc.).
Practical experience with security tools such as SIEM, firewalls, IDS/IPS, endpoint protection, and vulnerability scanners.
Proficiency in risk management practices and tools.
Knowledge of cloud security, network security, and data protection technologies.Policy & Standards Expertise:
Extensive experience in writing, reviewing, and implementing information security policies, procedures, and standards.
Familiarity with legal and regulatory frameworks (e.g., GDPR, HIPAA, PCI-DSS) and their impact on security practices.Communication & Collaboration:
Excellent verbal and written communication skills, with the ability to translate complex technical issues into understandable language for business stakeholders.
Experience working with cross-functional teams, including IT, legal, compliance, and executive management.Certifications (Preferred):
Certified Information Systems Security Professional (CISSP) or equivalent.
Certified Information Security Manager (CISM) or Certified in Risk and Information Systems Control (CRISC) is a plus.
Any additional industry-specific certifications related to cloud, network, or infrastructure security would be advantageous.
What you need to do now
If you're interested in this role, click 'apply now' to forward an up-to-date copy of your CV, or call us now.
If this job isn't quite right for you, but you are looking for a new position, please contact us for a confidential discussion about your career.
Hays Specialist Recruitment Limited acts as an employment agency for permanent recruitment and employment business for the supply of temporary workers. By applying for this job you accept the T&C's, Privacy Policy and Disclaimers which can be found at (url removed)
