The Carlyle GroupSyndicatedPortfolio
Portfolio Chief Technology OfficerChief information security officer recruitment agency · fractional, interim, part-time, permanent
CISO Recruitment Agency · fractional, interim, part-time and permanent CISOs
A CISO recruitment agency for every shape of the seat: Fractional Quest recruits fractional, interim, part-time, temporary and permanent chief information security officers. The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.
Reviewed by Fractional Quest · updated 23 October 2026 · 5 sources linked below
- £1,200–£2,000fractional day rate
- £96,250–£161,750permanent salary
- 3–5our shortlist
Fractional seats our founder has held
Climatise
One Up Productions
CK Delta
In the press
- Financial TimesThe executives going ‘fractional’, not freelance
- International FinanceRenting the C-suite, and why the fractional executive era has arrived
The agency
What a CISO recruitment agency should find for you
Brief us on the scope, the engagement and the start date. We come back with a shortlist of 3–5, each with rate or salary, availability and IR35 position set out. The board below shows current CISO roles, labelled by engagement.
The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk. A good CISO recruitment agency recruits for that scope, not for the title: the information security strategy and risk register, security policies, controls and certification such as Cyber Essentials or ISO 27001, incident response planning and exercises, and supplier and third-party security assurance and board reporting on cyber risk.
We recruit the seat in every shape. A fractional CISO, often called a virtual CISO, gives a business a named security leader on a standing weekly commitment: the strategy, the policies and the board conversation, with operations delivered by the team or a provider. A part-time CISO works fixed days each week, suited to a business that holds sensitive data and wants the same security lead embedded long term. A permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.
The seat in more depth: CISO services · fractional CISO services · interim CISO services · part-time CISO services · current CISO roles · what a CISO does.
On the board · last 90 days
Current CISO roles on the board
From our jobs feed. Where a posting states no rate, “est” is our estimate from the seat’s published band; ◆ marks days a week the posting states.
6 of 6 roles
Function
Engagement
- Reg Advantage LtdSyndicatedFractionalProduction Lead and Fractional CTO
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI (FTC)
- Flat IronSyndicatedFractionalFractional IT Director – Technology & AI
- Green Orbit LtdSyndicatedFractionalFractional CTO Wanted | Green Orbit | Initially Equity Only | UK-Based
- Maxima Opus Ltd | Cloud, Cyber & CTO ConsultingSyndicatedFractionalFractional CTO
Every fractional role in the UK is on the fractional jobs board.
Three seats
What does a fractional seat look like in practice?
Three fractional seats our founder has held. Real companies, named with their permission; we state only what the seat covered.
Fractional seats our founder has held
ClimatiseFractional · go-to-marketA carbon-reporting software company that needed go-to-market leadership before a full-time hire.
- Seat
- Fractional go-to-market lead
- Days
- Two days a week
- Scope
- Go-to-market
One Up ProductionsFractional · go-to-marketA production company that needed both the go-to-market strategy and its execution.
- Seat
- Fractional go-to-market: strategy and execution
- Days
- Two days a week
- Scope
- Go-to-market
CK DeltaFractional · technologyTechnology work: tech stack implementation.
- Seat
- Fractional technology lead
These are seats our founder has held, not placements.
The scope
What we assess — and what we do not confuse it with
Assessed against the brief. The information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.
Out of scope. Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.
The neighbouring seats. The CISO owns security risk; the CIO owns systems. Keeping them separate gives the board an independent view of risk.
When companies come to a CISO recruitment agency: A customer security questionnaire you cannot answer, a tender requiring certification, an incident, or an insurer or investor asking who owns cyber risk.
The process
How does a brief become a shortlist?
Six steps, one accountable person at each. We don’t promise a shortlist by a date; the weeks below are what a well-scoped brief usually takes.
- Day 001The 15-minute callThe seat, the engagement shape, the days or hours, the start date and the budget. No account needed; a call or a written brief.You and us
- Week 102Scope agreed in writingThe outcome the seat exists for, which days, and how the engagement will run for IR35. A brief that describes a person rather than a job, we rewrite with you.Us
- Weeks 1–203Search and approachWe approach people who aren’t looking and verify prior tenure in the seat at your scale and stage.Us
- Weeks 2–304References, taken by usFrom recent clients and boards: what they delivered, not what they titled it.Us
- Week 305Shortlist of three to fiveEach with day rate or salary, availability and IR35 position set out. You interview and decide.You
- Week 406Kick-offScope, first-month outcomes and the contract agreed before day one.You, them and us
What it costs
CISO rates what the published benchmarks say
Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate.
| Benchmark | Published figure | Source |
|---|---|---|
| Fractional CISO day rate | £1,200–£2,000 | Optima Europe |
| Interim CISO day rate | £1,000–£1,500 | Barclay Simpson |
| Permanent CISO salary (25th–75th percentile) | £96,250–£161,750 | Robert Half 2026 |
Your figures
What does part of a CISO’s week cost?
Rate × days × weeks, against a loaded full-time package. Move the sliders; the numbers redraw.
- CISO band £1,200–£2,000 (Optima Europe)
Year-one cost, fractional
£147,200
Fractional costs less in year one by£7,588
Our arithmetic. £135,250 Robert Half 2026 median salary + employer NI at 15% above £5,000 (HMRC) = £154,788. Excludes pension, bonus and any search fee.
Against the alternatives
Recruitment agency, headhunter or job board
Four ways to fill a CISO seat, on the dimensions that decide between them.
| Recruitment agency (us) | Retained headhunter | Job board | Your own network | |
|---|---|---|---|---|
| What you get | A shortlist of 3–5, each with rate, availability and IR35 position | A retained search for one permanent appointment | Applications, unfiltered | Whoever you already know |
| Engagements | Fractional, interim, part-time, temporary and permanent | Permanent, sometimes interim | Mostly permanent | Whatever they will agree to |
| Assessment | Five-stage vetting against your brief | Deep assessment of a long list | None | Your own judgement |
| Best when | You want options across engagement shapes, quickly briefed | A confidential permanent search at the top of the market | A well-known role with many applicants | You have the right person already |
| Commercials | Agreed in writing per engagement | Retainer, typically in stages | A listing fee | Your time |
The decision
Which CISO engagement to brief us for
Match the shape to the work, not the title.
- Weekly judgementFractional CISOA fractional CISO, often called a virtual CISO, gives a business a named security leader on a standing weekly commitment: the strategy, the policies and the board conversation, with operations delivered by the team or a provider.
- Now, full-timeInterim CISOAn incident has happened or nearly happened. An interim CISO leads the response, the remediation and the regulator and customer conversations.
- For yearsPermanent CISOA permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.
Vetting
How do we vet a CISO?
Five stages before anyone reaches a shortlist of three to five.
- Pedigree screenTenureWe verify prior tenure in the seat, at the scale and stage you need. No consultant presenting as an executive.
- Mandate fitFitFit to your stage, sector and the problem the seat exists to solve, not a CV keyword.
- Reference deep-diveVerifyWe take references ourselves, from recent clients and boards: what they delivered, not what they titled it.
- ShortlistShortlistThree to five candidates, each with day rate, availability and IR35 position set out.
- Kick-offStartScope, first-month outcomes and the contract agreed before day one.
The full process is on how we vet.
how the search runs
How our CISO recruitment agency works from brief to start date
Brief. A scoping call on the seat, the engagement shape, the days or hours, the start date and what success looks like in the first ninety days. The brief names the decisions the CISO will own.
Search and assessment. We search the market for your brief, then assess against the brief through our five-stage vetting: qualification, mandate fit, reference deep-dive, shortlist and analysis, kick-off.
Shortlist. 3–5 chief information security officers, each with day rate or salary expectation, availability and IR35 position set out, so you compare like with like.
Interviews and start. You meet the shortlist; we handle the offer, references and the contract shape. Start dates depend on each candidate’s availability — fractional and interim executives hold a portfolio, so a start date is agreed rather than immediate.
choosing an agency
Choosing a CISO recruitment agency four questions to ask
Do they recruit every shape? Many recruiters place permanent CISOs only, or interim only. If you are not yet sure whether the seat is fractional, interim, part-time or permanent, choose an agency that recruits all four and let the brief decide.
Do they assess the scope? Ask what the agency tests for. For the CISO seat that is the information security strategy and risk register and security policies, controls and certification such as Cyber Essentials or ISO 27001, not a CV keyword match.
Do they check standing? What the board should expect from its security lead; see the NCSC Cyber Security Toolkit for Boards.
Do they set out IR35? For a fractional or interim CISO, each candidate’s IR35 position should be on the shortlist, and the engagement written to match how it will actually run — HMRC’s guidance for clients sets out who determines status.
The right route
Agency, recruiter, interim or permanent?
Three taps. Say how much senior work there is, for how long, and whether it is one leader or a run of hires; the tool names the route.
The route · Fractional recruiter
An embedded fractional recruiter.
A hiring plan to work through below the leadership team is a talent-acquisition job: a recruiter inside your business for part of the week, paid for their time. We don’t supply them; the page below explains the role.
The route · Non-executive director
A non-executive director.
Independent oversight and constructive challenge, not executive direction. We recruit NEDs through the same brief process.
The route · Advisor
An advisor, not yet a seat.
Less than a day a week of senior input is advisory. Buy it as a scoped engagement; when it grows into a day or more, brief us for a fractional executive.
The route · Interim
An interim executive.
Four or five days for a fixed period is interim: cover for a departure, a turnaround or a transaction. The IIM puts the UK average at £907 a day and ten months.
The route · Permanent
A permanent search.
Four or five days of work, ongoing, is a full-time seat. We recruit permanent executives through the same brief process.
The route · Fractional executive
Brief a fractional recruitment agency.
Senior judgement for part of the week: a fractional CFO, CTO, CMO or COO on one to three days. We come back with a shortlist of three to five, each with day rate, availability and IR35 position set out.
We recruit executives. We don’t supply embedded fractional recruiters; where that is the right route, the tool says so.
Clients
What do companies say about our fractional work?
From a company where our founder has held a fractional seat. Name and logo given with the client’s permission.
“Excellent fractional support for building both our go-to-market strategy and our execution.”
Charlie AndersonDirector, One Up ProductionsWhere we are
Where is Fractional Quest?
Where we are
71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Fractional Quest Ltd, registered in England and Wales, no. 17322105. This is our registered office; meetings are by appointment, and most briefs start on a 15-minute call.
Questions
CISO recruitment agency questions, answered
It finds and assesses chief information security officers for your brief. Fractional Quest recruits CISOs on fractional, interim, part-time, temporary and permanent engagements: you brief us on scope, engagement and start date, and we come back with a shortlist of 3–5, each with rate or salary, availability and IR35 position set out, assessed through our five-stage vetting.
Our fees are agreed with each client in writing per engagement, so there is no figure on this site. What we can show is what the market publishes on pay: Fractional CISO day rate £1,200–£2,000 (Optima Europe); Interim CISO day rate £1,000–£1,500 (Barclay Simpson); Permanent CISO salary (25th–75th percentile) £96,250–£161,750 (Robert Half 2026).
Fractional when you need CISO judgement every week but not every day; interim when you need full-time cover or a change led now; part-time when the load is steady and you want the same person long term; permanent when the seat is full-time work for years. The CISO owns security risk; the CIO owns systems. Keeping them separate gives the board an independent view of risk.
Yes. We recruit fractional, interim, part-time, temporary and permanent executives and non-executive directors. A permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.
The seat’s real scope: the information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk. We also check what is out of scope, because hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.
A permanent or part-time employee is on your payroll, so IR35 does not arise. A fractional or interim CISO working through their own company falls under the off-payroll rules: for medium and large private-sector clients, the client makes the status determination. Every candidate on our shortlist states their IR35 position.
Sources
Where does every figure on this page come from?
The primary publisher for each number, linked. Where a figure is our own arithmetic, the page says so where it appears.
- Optima Europe
- HMRC
- legislation.gov.uk
- 1
- 2Understanding off-payroll working (IR35) HMRCStatus depends on how the engagement runs; medium and large clients make the determination.
- 3Rates and thresholds for employers 2026 to 2027 HMRCEmployer National Insurance at 15% above £5,000 a year.
- 4
- 5Employment Agencies Act 1973 legislation.gov.ukThe law a recruitment agency works under; no fee to a work-seeker.
