The appointment owns
The part-time CISO owns the security plan, reviews risk with the board and leads the security team during agreed hours.
part-time executive recruitment
Hire Part-Time CISO
Hire Part-Time Chief Information Security Officer: create a continuing employed security-leadership seat on reduced hours, with clear board access and incident cover outside those hours.
Brief us on this role →Chief Information Security Officer briefChoose a part of the brief
Part 01 / 04
Ongoing remit
Define the security strategy, risk reporting and team leadership the employee will hold.
Part 02 / 04
Working hours
Place board, risk and delivery meetings within the agreed pattern where possible.
Part 03 / 04
Delegation
Name the security or IT leads who can act on routine controls and incidents.
Part 04 / 04
Out-of-hours authority
Specify who can declare and lead an incident or escalate material risk outside the CISO hours.
Hire Part-Time Chief Information Security Officer: what must the role own?
Define the security strategy, risk reporting and team leadership the employee will hold.
Ongoing remitDefine the security strategy, risk reporting and team leadership the employee will hold.
Working hoursPlace board, risk and delivery meetings within the agreed pattern where possible.
DelegationName the security or IT leads who can act on routine controls and incidents.
Out-of-hours authoritySpecify who can declare and lead an incident or escalate material risk outside the CISO hours.
Role reference: Acas guidance on part-time workers. Acas explains employed reduced-hours work and protection from less favourable treatment. The organisation still needs a named incident and risk-decision owner outside the CISO’s hours.
What changes when the Chief Information Security Officer is part-time?
Part-time is a continuing employment pattern, not an interim assignment. The CISO still owns the ongoing security strategy and risk advice; the employer must design decision cover and incident escalation for hours when the employee is away.
part-timeChoose a part of the brief
Part 01 / 04
Employment
Define the employed part-time role and its continuing responsibilities.
Part 02 / 04
Days
Agree working days, meetings and how changes to the schedule will be handled.
Part 03 / 04
Cover
Name who can decide and respond outside those working days.
Part 04 / 04
Fairness
Apply the employment terms and recruitment process fairly to part-time candidates.
How would this work in a real brief?
The hiring decision becomes clearer when the work and its boundary are written down together.
Illustrative brief · an organisation with a capable security operations team
The team handles daily alerts and controls, but needs continuing executive direction and board advice. The leadership work fits a reduced employed week.
The part-time CISO owns the security plan, reviews risk with the board and leads the security team during agreed hours.
Another owner retains
A named operations lead runs alerts and incidents outside those hours, with a clear escalation route for board-level decisions.
How should you assess Chief Information Security Officer candidates?
Put the same work and evidence in front of each candidate before comparing answers.
The evidenceChoose a part of the brief
Part 01 / 04
Continuity plan
Ask candidates how they have kept board risk decisions moving on a reduced schedule.
Part 02 / 04
Delegated decisions
Test what the operations lead may decide without waiting for the CISO.
Part 03 / 04
Incident scenario
Use the same out-of-hours incident scenario for every candidate.
Part 04 / 04
Employment pattern
Agree hours, reporting line and cover before an offer is made.
Acas recommends a consistent, fair selection process: choosing who to interview.
Does this hiring pattern fit the work?
Test the amount of the week, the expected end and the continuity needed before writing the contract.
The working pattern · part-time
A part-time Chief Information Security OfficerAn employee holds a continuing seat for fewer hours. Agree the schedule, employment terms and cover outside working hours.
What must happen before the Chief Information Security Officer starts?
Confirm the employed hours, reporting line and continuing authority.
A clear startChoose a part of the brief
Part 01 / 04
Contract
Confirm the employed hours, reporting line and continuing authority.
Part 02 / 04
Calendar
Schedule the board and security forums around the working pattern.
Part 03 / 04
Cover
Record the operational and incident decision chain outside those hours.
Part 04 / 04
First review
Check whether hours and delegation support timely security decisions.
- 1
Contract
Confirm the employed hours, reporting line and continuing authority.
- 2
Calendar
Schedule the board and security forums around the working pattern.
- 3
Cover
Record the operational and incident decision chain outside those hours.
- 4
First review
Check whether hours and delegation support timely security decisions.
A useful Chief Information Security Officer brief names the decision, the working pattern and the evidence before it names a candidate.
What should the brief say?
Hire Part-Time Chief Information Security Officer begins with ongoing remit, a stated working pattern and the evidence you will ask every candidate to show.
15 minutes · video or phone
Brief us on a Chief Information Security Officer
Tell us what the role must own, how it will work and when it must start.
- 01A brief built around the decisions and working pattern.
- 02A shortlist of 3–5 with pay or day rate, availability and IR35 position set out.
- 03Five-stage vetting before a candidate reaches you.
Pick a day that suits · live availability
