Head of Protective Controls - Cyber Security - Permanent

Head of Protective Controls – Cyber Security

Permanent | Midlands / Hybrid | £90,000–£120,000 plus benefits

Our client is undertaking a significant, multi-year transformation programme and is looking for an experienced cyber security leader to take ownership of the organisation’s technical security controls.

Reporting to the CISO, you will define and deliver the strategy for preventing, detecting and responding to threats across endpoints, networks, identity, data and systems. You will ensure that controls are effective, proportionate, measurable and supported by clear evidence.

You will lead a multidisciplinary team of security specialists, oversee security testing and vulnerability management programmes, and act as a trusted adviser to senior leadership on security architecture, control effectiveness and cyber risk.

Key responsibilities

• Develop the strategic direction and multi-year roadmap for the organisation’s technical security controls, aligned with business priorities and the evolving threat landscape.

• Own the design, implementation and ongoing effectiveness of endpoint, network, identity and access, data and system security controls across on-premises, cloud and hybrid environments.

• Ensure a balanced control framework covering preventive, detective and corrective measures, with clear ownership, performance indicators and assurance arrangements.

• Align security controls with appropriate recognised frameworks, standards and good practice, including ISO 27001, NIST CSF, CIS Controls and the NCSC Cyber Assessment Framework.

• Commission, scope and oversee penetration testing, application security testing and other security assurance activities, including the management of specialist third-party providers.

• Ensure security findings are risk-rated, assigned to accountable owners and remediated within agreed timescales, with clear reporting on progress and residual risk.

• Oversee vulnerability management across infrastructure and applications, ensuring risks are identified, prioritised and addressed effectively.

• Maintain cyber security policies, technical standards and operating procedures relating to protective controls.

• Report control effectiveness, security posture, key risks and remediation progress to executive leadership and relevant governance forums.

• Support audit readiness by providing clear, reliable evidence of control design and operating effectiveness to internal and external auditors.

• Lead, manage and develop a multidisciplinary team of security professionals, building capability through coaching, succession planning and professional development.

• Work closely with IT, enterprise architecture, infrastructure, service partners and other stakeholders to embed security into day-to-day operations and transformation initiatives.

• Act as a trusted adviser on security architecture, technical risk and the practical implementation of proportionate security controls.

About you

• Significant experience leading cyber security, security architecture, security engineering or protective controls functions at a senior level.

• Strong knowledge of security controls across identity and access management, endpoint security, networks, cloud, applications, data and infrastructure.

• Experience designing and implementing security strategies, control frameworks and multi-year roadmaps in complex environments.

• Practical experience overseeing penetration testing, vulnerability management and security assurance programmes.

• Ability to translate technical security issues into clear business risks, priorities and recommendations for senior stakeholders.

• Experience leading, developing and motivating multidisciplinary security teams.

• Strong understanding of recognised cyber security frameworks and assurance principles, such as ISO 27001, NIST, CIS Controls or the NCSC Cyber Assessment Framework.

• Excellent communication, influencing and stakeholder management skills, with the ability to work effectively across technical and non-technical teams.

What’s on offer

• A senior leadership role with broad ownership of the organisation’s protective security controls.

• The opportunity to shape cyber security strategy during a major, multi-year transformation programme.

• Hybrid working in the Midlands.

• A salary of £90,000–£120,000 plus a comprehensive benefits package.