The appointment owns
The continuing CISO sets a security strategy, gives the board an owned risk register and establishes how incident decisions are escalated.
permanent executive recruitment
Hire Chief Information Security Officer
Hire Chief Information Security Officer: appoint a continuing security executive to set cyber risk direction, advise the board and ensure the organisation can respond to incidents.
Brief us on this role →Chief Information Security Officer briefChoose a part of the brief
Part 01 / 04
Risk decisions
Name the services and information whose compromise would most affect the organisation.
Part 02 / 04
Board line
State how the CISO will report risk, exceptions and investment choices to decision makers.
Part 03 / 04
Security authority
Set who may approve controls and who can accept an exception or residual risk.
Part 04 / 04
Incident role
Name the executive’s authority during a cyber incident and the operational teams that respond.
Hire Chief Information Security Officer: what must the role own?
Name the services and information whose compromise would most affect the organisation.
Risk decisionsName the services and information whose compromise would most affect the organisation.
Board lineState how the CISO will report risk, exceptions and investment choices to decision makers.
Security authoritySet who may approve controls and who can accept an exception or residual risk.
Incident roleName the executive’s authority during a cyber incident and the operational teams that respond.
Role reference: Government Digital and Data: Chief Information Security Officer capability framework. The government framework names security strategy, cyber risk advice, governance, incident readiness and security culture as parts of the CISO remit. Adapt the decisions and reporting line to the organisation rather than copying a government job description.
What changes when the Chief Information Security Officer is permanent?
A Chief Information Security Officer owns the security strategy and the advice on cyber risk. The board decides what risk it will accept. A CIO or CTO may own systems and engineering delivery; name how those leaders act on the CISO’s security priorities.
permanentChoose a part of the brief
Part 01 / 04
Seat
Describe the continuing role, reporting line and decisions the appointment will own.
Part 02 / 04
Search
Set the evidence and assessment criteria before comparing candidates.
Part 03 / 04
Offer
Confirm employment terms, authority and any conditions before the offer is accepted.
Part 04 / 04
Induction
Arrange access, introductions and a clear first assignment.
How would this work in a real brief?
The hiring decision becomes clearer when the work and its boundary are written down together.
Illustrative brief · a company with separate product and corporate systems
Customer security questions, product controls and internal access risks are being answered by different teams. The board has no common view of the most important exposures.
The continuing CISO sets a security strategy, gives the board an owned risk register and establishes how incident decisions are escalated.
Another owner retains
Engineering and IT teams implement controls; the board owns its risk appetite and accepts material residual risk.
How should you assess Chief Information Security Officer candidates?
Put the same work and evidence in front of each candidate before comparing answers.
The evidenceChoose a part of the brief
Part 01 / 04
Board explanation
Give each candidate the same risk register and ask what the board must decide.
Part 02 / 04
Exception judgment
Ask for a real example of a security exception they escalated and how it was recorded.
Part 03 / 04
Incident leadership
Test how they assigned authority before an incident and reviewed decisions afterwards.
Part 04 / 04
Delivery boundary
Ask how they work with IT, engineering, privacy and operations without obscuring ownership.
Acas recommends a consistent, fair selection process: choosing who to interview.
Does this hiring pattern fit the work?
Test the amount of the week, the expected end and the continuity needed before writing the contract.
The working pattern · permanent
A permanent Chief Information Security OfficerAn employee holds a continuing full-time seat. Assess the long-term remit, reporting line and induction plan.
What must happen before the Chief Information Security Officer starts?
Agree the risk outcomes and the CISO’s reporting line.
A clear startChoose a part of the brief
Part 01 / 04
Mandate
Agree the risk outcomes and the CISO’s reporting line.
Part 02 / 04
Evidence
Share the current risk register, incidents, control gaps and supplier dependencies.
Part 03 / 04
Authority
Write who approves security decisions and who may accept risk.
Part 04 / 04
First review
Review the highest-priority exposures and the incident decision chain with the board.
- 1
Mandate
Agree the risk outcomes and the CISO’s reporting line.
- 2
Evidence
Share the current risk register, incidents, control gaps and supplier dependencies.
- 3
Authority
Write who approves security decisions and who may accept risk.
- 4
First review
Review the highest-priority exposures and the incident decision chain with the board.
A useful Chief Information Security Officer brief names the decision, the working pattern and the evidence before it names a candidate.
What should the brief say?
Hire Chief Information Security Officer begins with risk decisions, a stated working pattern and the evidence you will ask every candidate to show.
15 minutes · video or phone
Brief us on a Chief Information Security Officer
Tell us what the role must own, how it will work and when it must start.
- 01A brief built around the decisions and working pattern.
- 02A shortlist of 3–5 with pay or day rate, availability and IR35 position set out.
- 03Five-stage vetting before a candidate reaches you.
Pick a day that suits · live availability
