Group Director – Regulatory Assurance and Cyber in Edinburgh

Locations: Circle Square, Belfast, Cardiff, Edinburgh, London/Hybrid

Full time / Part time

Salary: £119,930 - £145,590, with potential for further progression to £171,248 with our pay progression scheme

End Date: August 17, 2026

Contracted to our Manchester, London, Edinburgh, Cardiff or Belfast office

Why work for the ICO?

• Pay progression scheme.
• Hybrid and flexible working options.
• 25 days paid holiday per year, plus privilege and public holidays.
• Flexi leave (up to 26 additional days leave per year).
• Pension (employer contribution around 28.9%).
• Online discount scheme to save money at major supermarkets, retailers, gyms, restaurants, insurance providers and many more.
• Health Cash Plan.
• Fantastic development opportunities to learn and progress.

Job Summary

Join the Information Commissioner’s Office at a pivotal moment, where rapid technological change and the growing importance of data are reshaping the UK’s economy and society. As Group Director for Regulatory Assurance and Cyber, you’ll take on a high-impact leadership role, steering the ICO’s approach to assurance and cyber regulation. You’ll drive forward a risk-led, outcome-focused supervisory model, ensuring the UK maintains strong, trusted data protection frameworks that support innovation and public confidence. From delivering major regulatory programmes to shaping the ICO’s response to new cyber legislation, you’ll lead expert teams to provide proactive assurance, targeted interventions and strategic oversight where it matters most. This is a unique opportunity to influence national regulatory direction, strengthen cyber resilience, and play a critical role in enabling a secure, data-driven future.

The Information Commissioner’s Office (ICO) is the independent regulator of information rights. In a data-driven world, we provide advice, guidance, and support to organisations enabling compliance with their obligations, as well as protecting individuals and their personal data. As an employer, we are passionate about making a positive difference to the lives and careers of our people, and we empower you to be curious, impactful, collaborative and respectful.

Job Description

Reporting to the Executive Director for Regulatory Risk and Innovation, the role provides focused leadership and capacity in a high‑risk, fast‑evolving regulatory area. You will work closely with Executive Directors and senior leaders across the organisation to ensure coherence between assurance, supervision, investigations and enforcement activity, and to support clear prioritisation and measurable regulatory impact. As a senior leader, you will be expected to make a significant contribution to the development and delivery of the ICO’s strategic plans, policies and initiatives. You will also promote and safeguard the good corporate reputation of the ICO, raise awareness of information rights and obligations and provide leadership to the organisation and its people.

Key Responsibilities

• Work collaboratively with senior leader colleagues to develop and deliver the ICO’s purpose and vision, role modelling our values at all times.
• Provide direct leadership and line management for the Director of Regulatory Assurance, Director of Cyber, and two PACE product roles, bringing together assurance, cyber and product capability under a single senior leadership role. You will be responsible for ensuring all staff within the directorates are clear about standards expected and are empowered to achieve them.
• Provide senior oversight of PACE product activity within scope, ensuring product delivery supports regulatory assurance and cyber priorities and is aligned to the ICO’s strategy and Better Regulatory Interventions approach.
• Lead delivery of the ICO’s regulatory responsibilities arising from the Cyber Security and Resilience Bill, ensuring readiness, capability and effective supervisory approaches are in place.
• Ensure strategic risks and opportunities in all areas of responsibility are managed effectively. This means agreeing clear risk appetites, ensuring all risks are clearly articulated and actively managed, and that all controls and mitigating actions are effective and proportionate.
• Overall budgetary and fiscal responsibility for Regulatory Assurance and Cyber functions, overseeing operational spend and leading on development of business cases where necessary.
• Embed a supervisory approach to regulation, focused on earlier engagement, prevention of harm and delivery of clear, measurable regulatory outcomes.
• Ensure assurance and cyber interventions are proportionate, evidence‑based and consistent with the ICO’s Better Regulatory Interventions approach.
• Work closely with Legal, Investigations and other regulatory functions to support effective escalation, enforcement decision‑making and end‑to‑end regulatory coherence.
• Contribute to organisational horizon‑scanning and risk assessment, identifying emerging threats, opportunities and trends relevant to cyber resilience and assurance.
• Establish and maintain effective internal and external relationships with government, public bodies, regulators, industry and other stakeholders to support delivery of regulatory objectives, regulatory coherence and effective risk management.
• Support the Executive Director for Regulatory Risk and Innovation in business planning, performance management and reporting on assurance and cyber activity.
• Engaging across the whole of the ICO, establishing close working relationships and taking responsibility for matrix management where necessary to ensure a connection across the organisation to achieve a successful and cohesive implementation of the relevant strategies.
• Ensure that the ICO values diversity in its workforce and demonstrates equality of opportunity in its treatment of staff, customers and in all aspects of its business.
• Seeking continuous improvement in all areas of responsibility and acting as a catalyst for efficiency, high performance, continuous improvement and innovation across the organisation.
• Play a significant role in the leadership of the ICO and all relevant initiatives, taking personal responsibility for ad hoc projects or tasks agreed with the CEO and Executive Team.
• Represent the ICO and personally advise the Executive Team wherever required.

Person specification

Essential Criteria Assessed At Application Stage

• Senior‑level experience demonstrating widely recognised expertise in cyber, regulatory assurance or closely related risk‑focused disciplines, gained in public, private or third‑sector settings.
• Strong track record of leading complex cyber‑related, regulatory or assurance activity and delivering high‑quality outcomes in high‑risk or fast‑moving contexts.
• Extensive experience of senior leadership and people management, including setting clear direction, motivating teams and sustaining delivery through change.
• Experience operating effectively in high‑profile, high‑risk environments with significant reputational, public trust or wider system implications.
• Substantial experience in senior representational and negotiating roles, building effective relationships with government, regulators, industry and other stakeholders to influence outcomes, manage risk and maintain public confidence.

Essential Criteria Assessed During Interview

• Strong understanding of the principles of good regulation and their practical application within assurance and supervisory contexts.
• Knowledge of cyber risk, resilience, assurance or related regulatory domains with the credibility to operate authoritatively at senior levels, or the demonstrable ability to develop and apply such expertise quickly.
• Ability to champion and role model equality, diversity and inclusion, demonstrating strong personal integrity and a commitment to the ICO’s values at both an organisational and team level.
• The ability to exercise sound judgement in ambiguous or controversial circumstances.
• Ability to lead cross‑functional and matrix working, influencing without line authority where required.
• Experience of embedding outcome‑focused, proportionate regulatory interventions and measuring their effectiveness.
• Good understanding of public sector governance, accountability and performance management.
• Commercially and politically aware, with an understanding of how cyber risk, technological change and system resilience impact regulatory decision‑making and public trust.
• Collaborative leadership style, with a commitment to empowering others and building high‑performing teams.
• Strong written, verbal and communications skills, directed in particular at negotiating with and influencing a wide range of stakeholders including public speaking and media.
• Resilient, adaptable and able to operate effectively under pressure.

Equality, diversity, and inclusion

The ICO is committed to promoting and enhancing equality, diversity, and inclusion. We are focused on developing a workforce that is representative of the communities we serve and together we are building an inclusive workplace where all of our colleagues have the opportunity to make a real difference. We are championing this through our Equality Diversity and Inclusion Board together with a number of staff networks. Read more about our commitment on our website.

Candidates with a disability who meet the minimum criteria for this vacancy will be invited to interview as part of the ICO’s commitment to the Disability Confident Scheme. As part of the ICO’s commitment to our EDI objectives and creating a workplace that represents the communities and societies we serve, we guarantee an interview to candidates who declare they identify as belonging from an ethnic minority background and who meet the minimum criteria for this vacancy.