FractionalQuestAsk about this roleSign inBook a call

Permanent CISO · hiring brief

CISO for Hire

CISO for Hire: name the security outcome the CISO owns (a baseline, a certification, a customer requirement or recovery after an incident), arrange operational cover between their days, then choose the engagement.

Brief us on this role →See CISO roles

Reviewed by Fractional Quest · updated 1 November 2026 · 5 sources linked below

  • 3–5on every shortlist
  • 5stages of vetting
  • IR35set out on every brief
CISO for Hire: a technology leader sketching a system architecture on a whiteboard (illustration)

On the board · last 90 days

Which roles are on the board now?

Permanent CISO roles first, then the seat in any engagement and the wider function when the board runs short.

Roles

See every role on the board →

Every fractional role in the UK is on the fractional jobs board.

In the press

The brief

CISO for Hire: what must the role own?

Name the security outcome and its date, such as a certification or a customer security review.

  • 01OutcomeName the security outcome and its date, such as a certification or a customer security review.
  • 02RiskSet how the CISO reports cyber risk to the board and against what appetite.
  • 03CoverName who runs security operations and incident response between the CISO’s days.
  • 04AuthorityWrite which tooling, supplier and policy decisions the CISO may take.

Role reference: Government Digital and Data: CISO capability framework. The government CISO capability framework lists security strategy, cyber risk advice, governance, incident readiness and security culture as parts of the remit a CISO for hire takes on.

For hire

CISO for hire: which engagement fits?

The security outcome decides the route into the seat.

Fractional: a CISO on agreed days for a recurring remit, which suits a company that needs a security owner but not a security team. Interim: full-time for a defined period, often after an incident or before an audit.

Permanent: the full seat, for a company whose security work needs an owner and a team every day. The NCSC asks boards to see clear ownership and escalation of cyber risk; a brief to a CISO for hire should say who owns what.

The working pattern

What changes when the CISO is permanent?

A CISO for hire owns security strategy, cyber risk advice to the board and incident readiness. A part-week CISO works only when someone handles security operations on the days they are not there.

The illustrative brief: a SaaS company facing enterprise security reviews. Larger customers are sending security questionnaires the team cannot answer with confidence, and deals are stalling.

The appointment owns: A fractional CISO for hire sets the security baseline, answers the reviews and leads the company towards certification, two days a week.

Another owner retains: The CTO keeps architecture; an engineer on rota handles alerts between the CISO’s days; the board sets risk appetite.

The case is illustrative; it does not describe a Fractional Quest placement.

From brief to start

How do you hire a CISO for hire, step by step?

CISO for Hire, in practice: the first three steps are ours; the last four are what has to be true before the first day. We don’t promise a shortlist by a date.

  1. Day 0
    01
    The 15-minute call
    What the CISO must own, the working pattern, the start date and the budget.
    You and us
  2. Week 1
    02
    Scope agreed in writing
    The outcome the seat exists for, the days, and how the engagement will run for IR35.
    Us
  3. Weeks 1–3
    03
    Search, references, shortlist
    We approach people who aren’t looking, verify tenure, take references ourselves and return three to five.
    Us
  4. Week 4
    04
    Mandate
    Write the outcome, the date, the days and the authority.
    You
  5. Before day one · 2
    05
    Access
    Provide the risk register, past incidents, supplier list and customer requirements.
    You
  6. Before day one · 3
    06
    Cover
    Confirm the operational rota between days.
    You
  7. Before day one · 4
    07
    Board
    Agree when the CISO first reports to the board.
    You

Your figures

What does part of a senior week cost?

Rate × days × weeks, against a loaded full-time package. Move the sliders; the numbers redraw.

  • CISO band £1,200–£2,000 (Optima Europe)
Year-one cost, fractional
£147,200
2 days a week · 46 weeks · day fees, before tax · our arithmetic
Fractional executive£147,200
Full-time CISO, loaded£154,788£704 a day over 220 days · our arithmetic
Fractional costs less in year one by£7,588

Our arithmetic. £135,250 Robert Half 2026 median salary + employer NI at 15% above £5,000 (HMRC) = £154,788. Excludes pension, bonus and any search fee.

Assessment

How should you assess each candidate?

CISO for Hire on evidence: put the same work in front of each candidate before comparing answers.

  1. Comparable decision
    Ask for a certification or customer review they led, and what they did themselves.
  2. Authority
    Test how they would report a risk the board might not want to hear.
  3. Team
    Ask how they built security habits in an engineering team without a large security function.
  4. Handover
    Ask what runs, and who runs it, when their engagement ends.

Acas recommends a consistent, fair selection process: choosing who to interview.

Vetting

What happens before anyone reaches your shortlist?

Five stages before a candidate reaches a shortlist of three to five.

  1. Pedigree screen
    Tenure
    We verify prior tenure in the seat, at the scale and stage you need. No consultant presenting as an executive.
  2. Mandate fit
    Fit
    Fit to your stage, sector and the problem the seat exists to solve, not a CV keyword.
  3. Reference deep-dive
    Verify
    We take references ourselves, from recent clients and boards: what they delivered, not what they titled it.
  4. Shortlist
    Shortlist
    Three to five candidates, each with day rate, availability and IR35 position set out.
  5. Kick-off
    Start
    Scope, first-month outcomes and the contract agreed before day one.

The full process is on how we vet.

The right pattern

Does this hiring pattern fit the work?

Test the amount of the week, the expected end and the continuity needed before writing the contract.

Questions

CISO for Hire: questions, answered

Often. “Virtual CISO” usually describes the same part-week engagement as a fractional CISO. What matters is the outcome, the authority and the cover between days.

Read next

Related hiring and role pages

Sources

Where does every reference on this page come from?

  • ddat-capability-framework.service.gov.uk
  • HMRC
  • legislation.gov.uk
  1. 1
    Government Digital and Data: CISO capability framework ddat-capability-framework.service.gov.uk
  2. 2
    Rates and thresholds for employers 2026 to 2027 HMRC
    Employer National Insurance at 15% above £5,000 a year.
  3. 3
    Understanding off-payroll working (IR35) HMRC
    Status depends on how the engagement runs; medium and large clients make the determination.
  4. 4
    Check employment status for tax (CEST) HMRC
    HMRC’s own status check for each engagement.
  5. 5
    Employment Agencies Act 1973 legislation.gov.uk
    The law a recruitment agency works under; no fee to a work-seeker.

For hiring managers

Bring the brief. We bring the shortlist.

Sign up now →Book a call

  1. A shortlist of 3–5, each with day rate, availability and IR35 position
  2. Fractional, interim, part-time, temporary or permanent — and non-executive directors
  3. Every candidate through our five-stage vetting
  4. Your briefs and their candidates, in one room