Chief Information & Security Officer (CISO) in London

London, Warrington, Bristol – to note: this role will require significant attendance at our London office, if not based there. Please ensure you are only selecting locations you are willing to work in as you may be offered a post in any of your location preferences.

Working Pattern: Full time, Part time, Job share

Job Summary: The Chief Information Security Officer (CISO) is an exciting, new role for the Agency. The CISO will provide strategic leadership for information and cyber security across the Agency, ensuring that its information, technology, operational capabilities and people are protected from the continually evolving threats faced by a law enforcement organisation of national importance and scale. As the Agency’s senior information and cyber security professional, the CISO will provide authoritative advice to the Director Generals, Executive Committee, Audit and Risk Committee, Information, Security and Standards Committee and senior operational leaders on cyber risk, information assurance, resilience and the security implications of strategic and operational decisions. The postholder will lead the Agency’s cyber security strategy, risk appetite and security architecture, ensuring that security is embedded into the design and delivery of digital, data and technology capabilities rather than treated as a separate compliance function. The role is particularly important in protecting capabilities that support serious and organised crime investigations, intelligence, covert operations, sensitive law enforcement information and critical national infrastructure. The CISO will report directly to the Director General Capabilities and will be responsible for circa 25 staff and a multi-year Cyber investment programme.

Key Responsibilities:

• Strategic leadership: Develop and lead the Agency’s information and cyber security strategy and risk appetite, aligned with government security policy, the Agency’s strategic objectives and the threat environment. Provide clear, independent and authoritative advice to the Director Generals, Executive Committee and Board on the Agency’s cyber security posture and principal risks. Ensure cyber security considerations are incorporated into strategic planning, investment decisions, organisational change and operational capability development.
• Operational cyber security and resilience: Ensure the Agency has the capability to prevent, detect, respond to and recover from cyber-attacks and other information security incidents. Lead the Agency’s approach to cyber incident management, ensuring effective escalation, coordination and executive decision-making during significant incidents. Maintain effective relationships with relevant national cyber security and law enforcement partners and ensure the Agency can respond rapidly to emerging threats. Provide assurance that critical operational systems and services have appropriate security controls, resilience and recovery arrangements.
• Security of operational capabilities: Ensure security is proportionate to the sensitivity and operational importance of the Agency’s capabilities and information. Provide security leadership for the development and deployment of new operational technology, applications, data capabilities, cloud services and emerging technologies, including artificial intelligence.
• People and culture: Build a strong security culture in which every employee understands their responsibility for protecting Agency information and systems. Develop and retain high-performing cyber security and information assurance professionals.
• Supply chain and third parties: Ensure cyber security risks associated with suppliers, partners, contractors and technology providers are appropriately assessed and managed.
• Government and external relationships: Develop strong relationships with relevant government security functions, the National Cyber Security Centre, law enforcement partners and other national security organisations. Maintain an effective network of professional relationships across the wider cyber security community.

Leadership responsibilities:

As an SCS1 leader, the CISO will:

• Provide visible, confident and inclusive leadership across the Agency.
• Set a clear strategic direction and create a high-performing security function.
• Build trusted relationships with operational, corporate and technology leaders.
• Provide constructive challenge to senior colleagues while maintaining a strong focus on organisational outcomes.
• Lead through ambiguity and respond effectively to a rapidly changing threat environment.
• Develop organisational capability and future leadership talent.
• Champion diversity, inclusion and professional development.
• Demonstrate the Civil Service leadership behaviours and values expected of an SCS leader.

The NCA CISO role is part of the Government Digital and Data profession, the Government Security profession and the newly formed (January 2026) Government Cyber Unit.

Person Specification:

In your application you will need to demonstrate evidence against the below essential criteria:

• Proven experience developing and implementing cyber security strategies and policies within a complex, digital, data and technology reliant, fast paced, highly regulated organisation and operating environment.
• In-depth understanding of cybersecurity threats, technologies and risk management practices with the ability to make sound judgements on the trade-offs between operational capability and security.
• Experience leading an operational cyber security function, including researching, and implementing, proven industry standard Cyber/Information Security related frameworks.
• Exceptional communication skills, with the ability to present complex security concepts to both technical and non-technical stakeholders at all levels.
• Demonstrable commitment to lead, develop and nurture a highly performing, diverse and talented workforce.
• One or more professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) or Certified Chief Information Security Officer (CCISO).

If you do not hold any of the above qualifications, your application will not be progressed.

Please Note: The NCA is a 24/7 organisation, and working patterns must support business requirements. You are expected to participate in an on-call rota (approx. 4 - 5 weeks per year). On-call runs Mon-Fri and 24 hours per day on weekends and bank holidays. Training will be given prior to joining the rota. This is a corporate requirement and no additional remuneration is paid. Examples for on-call include staffing incidents; building issues (flooding etc); operational incidents; cross-government liaison. Individuals will be required to undertake and pass a substance misuse test as part of pre-employment checks. If successful, the offer made will be conditional on you being able to acquire and retain security clearance Developed Vetting (DV) prior to commencing in the role, and STRAP post appointment.

We want to recruit and retain the very best and broadest diversity of officers so the NCA welcomes applications from individuals from all minority backgrounds and protected characteristics. Please be aware that you can be posted to any location that you put in your preferences. If you would only like to be posted to one location, please confirm one location only. If you are posted to a location that you have requested and you do not accept that location, you may not be offered another role.