Chief Information Security Officer

Ofgem works on behalf of energy consumers to ensure that every household and business in the UK can rely on a safe, affordable and environmentally sustainable energy supply. We are playing a vital part in accelerating the transition to Net Zero and a carbon neutral energy system. You will be playing your part in creating new energy solutions that are vital for customers, and vital for the environment.

This CISO sits at the heart of Ofgem’s Security, Privacy and Resilience function within DDSS, with responsibility for leading the organisation’s cyber and information security strategy, strengthening resilience, and ensuring security enables rather than inhibits delivery. It is a high-impact leadership role requiring clear judgement, pragmatism and the ability to build trusted relationships across the organisation and with external partners.

Team context

The CISO is a strategic leadership role at the heart of Ofgem’s security, privacy and resilience agenda. Reporting into the CDIO, you will lead the organisation’s cyber and information security capability, setting the direction for a function that enables the business to operate safely, securely and with confidence.

Overview of the role

As Chief Information Security Officer, you will create the environment and culture that ensures Ofgem can deliver services in a safe and secure way. You will lead the development and delivery of the information and cyber security strategy, shape the organisation’s security maturity, and ensure risk is managed in a balanced and proportionate way.

You will be accountable for building trust with colleagues and stakeholders, re-establishing confidence in the security function and helping create a positive cultural shift across the organisation. This is an opportunity to lead with influence, bring people with you, and be a true enabler for Ofgem.

You will be responsible for:

• Leading and driving change. You will go beyond traditional governance and assurance to take ownership from strategy through to delivery, turning priorities into action and driving change through to successful implementation and measurable impact.
• Bringing pragmatism, clarity and energy to complex security challenges, you will work closely with senior stakeholders to understand business priorities, find practical routes to “yes”, and position security as an enabler of delivery, innovation and great user experience.
• Developing and maintaining Ofgem’s Cyber strategy, associated risk register and forward work plan, addressing risks to business operations and corporate functions.
• Enabling leaders and all staff to be routinely briefed on strategic and tactical threats to Ofgem’s security, privacy and resilience, and develop mitigating actions consistent with Ofgem’s risk appetite.
• Managing Cyber assurance, data protection, security operations and response capabilities, including Incident Management on Data, leak investigations and independent investigation activity with Cabinet Office.
• Acting as a security and privacy professional, championing best practice and embedding Ofgem’s security, privacy and resilience culture within Ofgem, third parties and business partners; publish associated guidance, practices, tools, standards and templates.
• Overseeing delivery of the Cyber Assessment Framework (CAF) and Departmental Security Health Check (DSHC), working with Cabinet Office and DESNZ.
• Contributing to Directorate and Ofgem strategic programmes; partner with senior leadership to prioritise work and resources, and represent Ofgem across Government and the Energy Sector.
• Setting the strategic direction of the function and provide intellectual leadership, including strategic workforce planning; act as the SME and deputise for the Head of Cyber Security Profession, including Professional Development Lead duties.
• Detecting and analyse relevant trends; advise on implications of new technologies and uses of data; support innovation; determine security investment priorities and create a security roadmap that enables Ofgem to achieve its objectives.

You will need:

• Direct experience in leading Cyber Security, including ongoing definition and delivery of a robust security and privacy strategy, which incorporates intelligence management; threat and risk analysis; risk mitigation; business continuity preparations; and incident detection, response and recovery.
• Substantial experience in a combination of business and risk management, information security, IT services and operational security positions.
• Knowledge across relevant information security and privacy management frameworks and legislation, such as NIST, the NIS Regulations 2018, ISO/IEC 27001, ITIL, COBIT, Data Protection Act 2018 (GDPR).
• Proven experience of working with strategic vendors and partners to deliver high impact and fit-for-purpose results
• An engaging, adaptable, collaborative leadership style with experience of that fosters and supports diversity and inclusion with evidence of operating flexibly in an inclusive manner that engenders diversity in teams.
• Excellent communication skills, both verbal and written with the ability to enthuse stakeholders and colleagues, encouraging them to embrace change.
• Able to obtain and maintain DV clearance.
• Holds Qualifications in, LRD512: Security Leadership Essentials for Managers, BCS Certificate in Information Security Management Principles, GIAC Information Security Fundamentals
• Holds Accreditation in Chartered Qualification

This is a significant opportunity to shape how Ofgem approaches security, privacy and resilience at a time of increasing complexity and importance. We are looking for someone who combines deep expertise with strong judgement, commercial awareness and the ability to lead positively, someone who can build trust, enable delivery and help the organisation move forward with confidence.

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours, Experience and Technical skills.

As part of your application, you will be asked to upload a 2-page copy of your CV and provide a 1250 word ‘personal statement’ evidencing how you meet the essential and desirable skills and capabilities listed in the role profile. Please ensure you demonstrate clearly, within your supporting statement, how you meet each of the criteria listed in the role profile. In the event of receiving a large number of applications, an initial sift may take place on just the lead criteria indicated in the essential criteria.

The personal information we have collected from you will be shared with Cifas who will use it to prevent fraud, other unlawful or dishonest conduct, malpractice, and other seriously improper conduct. If any of these are detected, you could be refused certain services or employment. Your personal information will also be used to verify your identity. Further details of how your information will be used by us and Cifas, and your data protection rights, can be found by [https://www.cifas.org.uk/fpn].

At Ofgem, we expect our staff to carry out their roles with honesty, fairness and openness. They should follow the Civil Service code and be free from any influence or bias. We are committed to making sure interests are recognised, declared and managed appropriately so that we can fulfil our duties as an energy regulator. Our Conflicts of Interest policy outlines the types of interests Ofgem staff must declare before onboarding, and the rules they must follow throughout employment so that we can clearly demonstrate that our decisions are not influenced by private interests.

Feedback will only be provided if you attend an interview or assessment.