Chief Information Security Officer - Ministry of Defence - SCS1

Location

MOD Main Building London. There is an expectation that a minimum of 60% of working time will be spent in the office. All work-related travel and
subsistence costs will be reimbursed except when travelling to your base location in line with departmental policy.

About the job

Job summary

The Chief Information Security Officer (CISO) is a senior role within the Defence Nuclear Organisation (DNO), accountable for providing strategic leadership on cyber security matters. The role holds ownership of information security and cyber risk across DNO and provides strategic influence throughout the organisation, working across boundaries to ensure effective risk management and security practices. The position is critical for mainting a coherent enterprise view of information security risk and strengthening DNO’s overall security posture.

The post-holder will operate in a challenging and evolving cyber threat environment, facing risks from hostile states, criminals, ransomware groups, and others. As DNO becomes increasingly digital and data-led, the expanding attack surface underscores the importance of strong cyber leadership to protect critical systems, information, and services.

Job description

• Provide strategic leadership and accountability for cyber security across DNO, including policy framework, secure-by-design principles, and alignment with government and MOD requirements.
• Lead and develop a specialist cyber security team, managing resources, budget, capability while providing clear and trusted advice to senior leaders and governance boards.
• Deliver independent oversight and assurance of cyber and technology risks, ensuring effective risk management and escalation of material risks.
• Lead and coordinate senior responses to major cyber incidents, ensuring effective escalation, operational decision support, and post-incident learning.
• Collaborate with internal and external stakeholders, including MOD CISO, Product Owners, and CIO leads, to embed security into digital, data, technology, and transformation initiatives.
• Ensure cyber risk transparency through evidence-based reporting to support informed decision-making on resilience, mitigation, and investment.
• Manage cyber security resources effectively to deliver value for money and maintain organisational resilience amid evolving threats.

Person specification

• Expert knowledge of cyber security, information risk management and protective security, including cyber threats, risk mitigation and security controls.
• Proven ability to develop and implement cyber security strategies, policies and control frameworks aligned with government, national and industry standards.
• Strong analytical skills, with the ability to assess cyber threats, vulnerabilities and risks, challenge technical evidence, and provide clear advice to senior leaders.
• Proven experience of leading responses to major cyber incidents, demonstrating sound judgement and effective decision-making in complex, high-pressure environments.
• Strong strategic leadership capability, with the ability to set direction, drive improvement, and align cyber security outcomes with organisational objectives.
• Strong communication, influencing and stakeholder management skills, with the ability to translate technical issues for non-technical audiences and deliver outcomes across complex organisations.

Desirable criteria may be used in the event of a strong field of candidates when there is a need to distinguish between candidates. This will be as a second sift, after the essential criteria has been considered:

• Knowledge of technology services and secure delivery practices.
• Ability to collaborate with suppliers delivering critical services, sharing incident and risk information to strengthen overall security posture.
• Ability to evaluate emerging cyber threats, vulnerabilities in legacy systems, interdependencies across services, and security risks associated with new technologies such as artificial intelligence, applying national and MOD policies pragmatically.