Chief Information Security Officer - OFGEM - SCS1

Location

Cardiff, Glasgow, London

About the job

Job summary

Ofgem works on behalf of energy consumers to ensure that every household and business in the UK can rely on a safe, affordable and environmentally sustainable energy supply. We are playing a vital part in accelerating the transition to Net Zero and a carbon neutral energy system. You will be playing your part in creating new energy solutions that are vital for customers, and vital for the environment.  

This CISO sits at the heart of Ofgem’s Security, Privacy and Resilience function within DDSS, with responsibility for leading the organisation’s cyber and information security strategy, strengthening resilience, and ensuring security enables rather than inhibits delivery. It is a high-impact leadership role requiring clear judgement, pragmatism and the ability to build trusted relationships across the organisation and with external partners. 

Team context 

The CISO is a strategic leadership role at the heart of Ofgem’s security, privacy and resilience agenda. Reporting into the CDIO, you will lead the organisation’s cyber and information security capability, setting the direction for a function that enables the business to operate safely, securely and with confidence.  

Overview of the role 

As Chief Information Security Officer, you will create the environment and culture that ensures Ofgem can deliver services in a safe and secure way. You will lead the development and delivery of the information and cyber security strategy, shape the organisation’s security maturity, and ensure risk is managed in a balanced and proportionate way.  

You will be accountable for building trust with colleagues and stakeholders, re-establishing confidence in the security function and helping create a positive cultural shift across the organisation. This is an opportunity to lead with influence, bring people with you, and be a true enabler for Ofgem. 

Job description

You will be responsible for: 

• Leading and driving change. You will go beyond traditional governance and assurance to take ownership from strategy through to delivery, turning priorities into action and driving change through to successful implementation and measurable impact. 
• Bringing pragmatism, clarity and energy to complex security challenges, you will work closely with senior stakeholders to understand business priorities, find practical routes to “yes”, and position security as an enabler of delivery, innovation and great user experience. 
• Developing and maintaining Ofgem’s Cyber strategy, associated risk register and forward work plan, addressing risks to business operations and corporate functions. 
• Enabling leaders and all staff to be routinely briefed on strategic and tactical threats to Ofgem’s security, privacy and resilience, and develop mitigating actions consistent with Ofgem’s risk appetite. 
• Managing Cyber assurance, data protection, security operations and response capabilities, including Incident Management on Data, leak investigations and independent investigation activity with Cabinet Office. 
• Acting as a security and privacy professional, championing best practice and embedding Ofgem’s security, privacy and resilience culture within Ofgem, third parties and business partners; publish associated guidance, practices, tools, standards and templates. 
• Overseeing delivery of the Cyber Assessment Framework (CAF) and Departmental Security Health Check (DSHC), working with Cabinet Office and DESNZ. 
• Contributing to Directorate and Ofgem strategic programmes; partner with senior leadership to prioritise work and resources, and represent Ofgem across Government and the Energy Sector. 
• Setting the strategic direction of the function and provide intellectual leadership, including strategic workforce planning; act as the SME and deputise for the Head of Cyber Security Profession, including Professional Development Lead duties. 
• Detecting and analyse relevant trends; advise on implications of new technologies and uses of data; support innovation; determine security investment priorities and create a security roadmap that enables Ofgem to achieve its objectives. 

You will need:  

• Direct experience in leading Cyber Security, including ongoing definition and delivery of a robust security and privacy strategy, which incorporates intelligence management; threat and risk analysis; risk mitigation; business continuity preparations; and incident detection, response and recovery.  
• Substantial experience in a combination of business and risk management, information security, IT services and operational security positions.   
• Knowledge across relevant information security and privacy management frameworks and legislation, such as NIST, the NIS Regulations 2018, ISO/IEC 27001, ITIL, COBIT, Data Protection Act 2018 (GDPR).  
• Proven experience of working with strategic vendors and partners to deliver high impact and fit-for-purpose results   
• An engaging, adaptable, collaborative leadership style with experience of that fosters and supports diversity and inclusion with evidence of operating flexibly in an inclusive manner that engenders diversity in teams.   
• Excellent communication skills, both verbal and written with the ability to enthuse stakeholders and colleagues, encouraging them to embrace change.  
• Able to obtain and maintain DV clearance.   
• Holds Qualifications in, LRD512: Security Leadership Essentials for Managers, BCS Certificate in Information Security Management Principles, GIAC Information Security  Fundamentals  
• Holds Accreditation in Chartered Qualification   

This is a significant opportunity to shape how Ofgem approaches security, privacy and resilience at a time of increasing complexity and importance. We are looking for someone who combines deep expertise with strong judgement, commercial awareness and the ability to lead positively, someone who can build trust, enable delivery and help the organisation move forward with confidence.  

Person specification

Essential Criteria

• Direct experience in leading Cyber Security, including ongoing definition and delivery of a robust security and privacy strategy, which incorporates intelligence management; threat and risk analysis; risk mitigation; business continuity preparations; and incident detection, response and recovery. (Lead Criteria)
• Substantial experience in a combination of business and risk management, information security, IT services and operational security positions. (Lead Criteria)
• Knowledge across relevant information security and privacy management frameworks and legislation, such as NIST, the NIS Regulations 2018, ISO/IEC 27001, ITIL, COBIT, Data Protection Act 2018 (GDPR).
• Proven experience of working with strategic vendors and partners to deliver high impact and fit-for-purpose results.
• An engaging, adaptable, collaborative leadership style with experience of that fosters and supports diversity and inclusion with evidence of operating flexibly in an inclusive manner that engenders diversity in teams.
• Excellent communication skills, both verbal and written with the ability to enthuse stakeholders and colleagues, encouraging them to embrace change.
• Able to obtain and maintain DV clearance.
• Holds Qualifications in, LRD512: Security Leadership Essentials for Managers, BCS Certificate in Information Security Management Principles, GIAC Information Security Fundamentals.
• Holds Accreditation in Chartered Qualification.

Desirable Criteria

• Experience in working in the regulated sector.