The Carlyle GroupSyndicatedPortfolio
Portfolio Chief Technology OfficerCISO Consultants · CISO consultant · fractional, interim and permanent
CISO Consultants · hire a CISO consultant, or find the work
CISO consultants at leadership level are senior cyber security people who hold the brief: a fractional or interim CISO, working fractionally, on an interim mandate or permanently. Fractional Quest recruits them for companies; we do not employ them.
Reviewed by Fractional Quest · updated 23 October 2026 · 5 sources linked below
- 3–5our shortlist
Fractional seats our founder has held
Climatise
One Up Productions
CK Delta
In the press
- Financial TimesThe executives going ‘fractional’, not freelance
- International FinanceRenting the C-suite, and why the fractional executive era has arrived
The agency
What CISO consultants do
Hiring? Brief us and we come back with a shortlist of 3–5, each with rate, availability and IR35 position set out. Looking for the work? The board below shows current security leadership roles.
A CISO consultant owns cyber risk: the strategy, the risk register, the policies and controls, incident readiness and the board’s understanding of where the business stands. The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.
Companies searching for a cyber security consultant at board level want a fractional CISO consultant — often called a virtual CISO services — who owns security risk a few days a week. For certification work see ISO 27001 consultant.
CISO consultants are not a firm’s junior team: each is one senior person who contracts with the company directly. Fractional Quest is the recruitment agency that finds them; the service side is on cyber security consultancy.
On the board · last 90 days
Current security leadership roles on the board
From our jobs feed. Where a posting states no rate, “est” is our estimate from the seat’s published band; ◆ marks days a week the posting states.
6 of 6 roles
Function
Engagement
- Reg Advantage LtdSyndicatedFractionalProduction Lead and Fractional CTO
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI (FTC)
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI
- Green Orbit LtdSyndicatedFractionalFractional CTO Wanted | Green Orbit | Initially Equity Only | UK-Based
- Maxima Opus Ltd | Cloud, Cyber & CTO ConsultingSyndicatedFractionalFractional CTO
Every fractional role in the UK is on the fractional jobs board.
Three seats
What does a fractional seat look like in practice?
Three fractional seats our founder has held. Real companies, named with their permission; we state only what the seat covered.
Fractional seats our founder has held
ClimatiseFractional · go-to-marketA carbon-reporting software company that needed go-to-market leadership before a full-time hire.
- Seat
- Fractional go-to-market lead
- Days
- Two days a week
- Scope
- Go-to-market
One Up ProductionsFractional · go-to-marketA production company that needed both the go-to-market strategy and its execution.
- Seat
- Fractional go-to-market: strategy and execution
- Days
- Two days a week
- Scope
- Go-to-market
CK DeltaFractional · technologyTechnology work: tech stack implementation.
- Seat
- Fractional technology lead
These are seats our founder has held, not placements.
The scope
What a CISO consultant owns
The scope. The information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.
Out of scope. Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.
The neighbouring seats. The CISO owns security risk; the CIO owns systems. Keeping them separate gives the board an independent view of risk.
The process
How does a brief become a shortlist?
Six steps, one accountable person at each. We don’t promise a shortlist by a date; the weeks below are what a well-scoped brief usually takes.
- Day 001The 15-minute callThe seat, the engagement shape, the days or hours, the start date and the budget. No account needed; a call or a written brief.You and us
- Week 102Scope agreed in writingThe outcome the seat exists for, which days, and how the engagement will run for IR35. A brief that describes a person rather than a job, we rewrite with you.Us
- Weeks 1–203Search and approachWe approach people who aren’t looking and verify prior tenure in the seat at your scale and stage.Us
- Weeks 2–304References, taken by usFrom recent clients and boards: what they delivered, not what they titled it.Us
- Week 305Shortlist of three to fiveEach with day rate or salary, availability and IR35 position set out. You interview and decide.You
- Week 406Kick-offScope, first-month outcomes and the contract agreed before day one.You, them and us
What it costs
CISO rates what the published benchmarks say
Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate.
| Benchmark | Published figure | Source |
|---|---|---|
| Fractional CISO day rate | £1,200–£2,000 | Optima Europe |
| Interim CISO day rate | £1,000–£1,500 | Barclay Simpson |
| Permanent CISO salary (25th–75th percentile) | £96,250–£161,750 | Robert Half 2026 |
Your figures
What does part of a CISO’s week cost?
Rate × days × weeks, against a loaded full-time package. Move the sliders; the numbers redraw.
- CISO band £1,200–£2,000 (Optima Europe)
Year-one cost, fractional
£147,200
Fractional costs less in year one by£7,588
Our arithmetic. £135,250 Robert Half 2026 median salary + employer NI at 15% above £5,000 (HMRC) = £154,788. Excludes pension, bonus and any search fee.
Against the alternatives
Four ways to buy cyber security expertise fractional, project, interim or permanent
The same cyber security problem can be bought four ways. The difference is who does the work, for how long, and who is accountable afterwards.
| Fractional cyber security leader | Project consultancy firm | Interim executive | Permanent hire | |
|---|---|---|---|---|
| What you buy | A fractional or interim CISO, days a week | A defined deliverable | A leader full-time for a fixed term | A full-time leader for years |
| Who does the work | One named senior person | A team, often with a partner who sold it | One named senior person | Your employee |
| Accountable after | Yes — they stay | No — the project ends | Until the hand-over | Yes |
| Best when | You need senior judgement every week, not every day | The work is a one-off with a clear output | You need full-time cover or a change led now | The seat is full-time work for years |
| Usual contract | Contract for services, often via the leader’s company | Statement of work | Day-rate contract for the mandate | Employment contract |
The decision
Which CISO consultant to hire
Match the shape to the work, not the title.
- Weekly judgementA fractional CISO consultantA fractional CISO, often called a virtual CISO, gives a business a named security leader on a standing weekly commitment: the strategy, the policies and the board conversation, with operations delivered by the team or a provider.
- Now, full-timeAn interim cyber security leadAn incident has happened or nearly happened. An interim CISO leads the response, the remediation and the regulator and customer conversations.
- For yearsA permanent hireA permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.
Vetting
How do we vet a CISO consultant?
Five stages before anyone reaches a shortlist of three to five.
- Pedigree screenTenureWe verify prior tenure in the seat, at the scale and stage you need. No consultant presenting as an executive.
- Mandate fitFitFit to your stage, sector and the problem the seat exists to solve, not a CV keyword.
- Reference deep-diveVerifyWe take references ourselves, from recent clients and boards: what they delivered, not what they titled it.
- ShortlistShortlistThree to five candidates, each with day rate, availability and IR35 position set out.
- Kick-offStartScope, first-month outcomes and the contract agreed before day one.
The full process is on how we vet.
how to hire
How to hire a CISO consultant four steps
Write down the decisions. List the three decisions the CISO consultant will own in the first ninety days. That list decides the shape: weekly decisions point to fractional, a time-bound change to interim, a full-time load to permanent.
Brief us. Scope, days, start date and what success looks like. We search for your brief and assess through our five-stage vetting.
Compare a shortlist. 3–5 CISO consultants, each with day rate or salary, availability and IR35 position set out, so you compare like with like.
Contract directly. The CISO consultant contracts with you, usually through their own company for fractional and interim work. Write the contract to match how it will actually run.
what to check
What to check in CISO consultants before you sign
Evidence, not titles. Ask for programmes they led to certification and incidents they managed. The NCSC’s Cyber Security Toolkit for Boards sets out what a board should expect from its security lead.
Professional bodies. the NCSC Cyber Security Toolkit for Boards — what a board should expect from the person who owns cyber risk; the NCSC’s Cyber Essentials scheme — the minimum standard of cyber security the Government recommends for organisations of all sizes.
Status. It depends on how the engagement runs in practice — control, substitution and whether the CISO consultant is part and parcel of your organisation, not on the label "consultant". For medium and large private-sector clients the client makes the status determination. Every candidate on our shortlist states their IR35 position.
Capacity. A fractional CISO consultant holds other clients. Ask how many, which days are yours, and how urgent issues are handled between them.
for consultants
Work as a fractional CISO consultant what the work looks like
Fractional CISO work suits security leaders who have run a programme and spoken to a board, and want a portfolio of clients.
Briefs arrive as fractional (days a week, ongoing), interim (full-time, fixed term) or permanent roles. The board on this page shows current security leadership roles, labelled by engagement; every fractional role is on the fractional jobs board.
Companies hire the leader, not the label: set out the decisions you have owned, the outcomes, and the days you can commit. Your IR35 position and rate go on the shortlist as you state them.
The right route
Agency, recruiter, interim or permanent?
Three taps. Say how much senior work there is, for how long, and whether it is one leader or a run of hires; the tool names the route.
The route · Fractional recruiter
An embedded fractional recruiter.
A hiring plan to work through below the leadership team is a talent-acquisition job: a recruiter inside your business for part of the week, paid for their time. We don’t supply them; the page below explains the role.
The route · Non-executive director
A non-executive director.
Independent oversight and constructive challenge, not executive direction. We recruit NEDs through the same brief process.
The route · Advisor
An advisor, not yet a seat.
Less than a day a week of senior input is advisory. Buy it as a scoped engagement; when it grows into a day or more, brief us for a fractional executive.
The route · Interim
An interim executive.
Four or five days for a fixed period is interim: cover for a departure, a turnaround or a transaction. The IIM puts the UK average at £907 a day and ten months.
The route · Permanent
A permanent search.
Four or five days of work, ongoing, is a full-time seat. We recruit permanent executives through the same brief process.
The route · Fractional executive
Brief a fractional recruitment agency.
Senior judgement for part of the week: a fractional CFO, CTO, CMO or COO on one to three days. We come back with a shortlist of three to five, each with day rate, availability and IR35 position set out.
We recruit executives. We don’t supply embedded fractional recruiters; where that is the right route, the tool says so.
Clients
What do companies say about our fractional work?
From a company where our founder has held a fractional seat. Name and logo given with the client’s permission.
“Excellent fractional support for building both our go-to-market strategy and our execution.”
Charlie AndersonDirector, One Up ProductionsWhere we are
Where is Fractional Quest?
Where we are
71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Fractional Quest Ltd, registered in England and Wales, no. 17322105. This is our registered office; meetings are by appointment, and most briefs start on a 15-minute call.
Questions
CISO Consultants questions, answered
A CISO consultant owns cyber risk: the strategy, the risk register, the policies and controls, incident readiness and the board’s understanding of where the business stands. The seat’s scope: the information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises.
Brief us on the scope, the shape and the start date. We come back with a shortlist of 3–5 CISO consultants, each with rate, availability and IR35 position set out, assessed through our five-stage vetting. You contract with the CISO consultant directly.
Ask for programmes they led to certification and incidents they managed. The NCSC’s Cyber Security Toolkit for Boards sets out what a board should expect from its security lead.
It depends on the shape and the days. Published bands for the seat: Fractional CISO day rate £1,200–£2,000 (Optima Europe); Interim CISO day rate £1,000–£1,500 (Barclay Simpson); Permanent CISO salary (25th–75th percentile) £96,250–£161,750 (Robert Half 2026). Fractional Quest publishes no fees; each candidate on a shortlist states their own rate, so the cost of CISO consultants is the rate times the days you agree.
It depends on how the engagement runs in practice — control, substitution and whether the CISO consultant is part and parcel of your organisation, not on the label "consultant". For medium and large private-sector clients the client makes the status determination. Every candidate on our shortlist states their IR35 position.
The board on this page lists current security leadership roles, labelled fractional, interim or permanent, and every fractional role is on the fractional jobs board. Your rate and IR35 position go on the shortlist as you state them.
A chief information security officer working a set number of days a week on a standing commitment, often called a virtual CISO: the strategy, the policies and the board conversation, with operations delivered by the team or a provider.
No. A penetration tester tests systems; a CISO consultant owns the risk and decides what to fix. Most businesses need the owner first and buy testing under their direction.
Sources
Where does every figure on this page come from?
The primary publisher for each number, linked. Where a figure is our own arithmetic, the page says so where it appears.
- Optima Europe
- HMRC
- legislation.gov.uk
- 1
- 2Understanding off-payroll working (IR35) HMRCStatus depends on how the engagement runs; medium and large clients make the determination.
- 3Rates and thresholds for employers 2026 to 2027 HMRCEmployer National Insurance at 15% above £5,000 a year.
- 4
- 5Employment Agencies Act 1973 legislation.gov.ukThe law a recruitment agency works under; no fee to a work-seeker.
