Head of Cyber Strategy and Resilience

About the role

Lead the organization’s cyber strategy, security investment portfolio, third‑party cyber risk, remediation governance and cyber resilience capabilities. The role converts enterprise priorities and risk appetite into a funded multi‑year roadmap and ensures that critical services can prepare for, withstand, respond to and recover from significant cyber disruption.

Key responsibilities

• Own the cyber strategy, target‑state operating model and multi‑year roadmap, and lead the annual strategy refresh cycle.
• Govern portfolio prioritization, business cases, benefits, dependencies, OpEx and CapEx, and provide executive‑level performance reporting.
• Maintain the cyber resilience strategy and crisis‑management framework and oversee exercises, cyber recovery readiness and lessons learned.
• Oversee the first‑line third‑party cyber risk programme and ensure supplier risks are assessed and treated through the procurement lifecycle.
• Establish central remediation governance, risk‑based prioritization and escalation for overdue or SLA‑breaching security issues.
• Set objectives, service measures and accountability across strategy, resilience, remediation and third‑party risk teams.

Required profile

• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, IT, Engineering or related field; master’s degree advantageous. 10‑15 years experience, including at least 5 years in cyber leadership, strategy, resilience or portfolio governance.
• Demonstrated experience in a regulated, high‑availability or financial‑services environment.
• Strong analytical, written communication, stakeholder‑management and evidence‑management skills in a regulated environment.
• Sound judgement, integrity and ability to handle sensitive information and high‑pressure situations.

Required skills

• Cyber strategy and operating‑model design
• Portfolio governance and executive reporting
• Cyber resilience, crisis management, Business Impact Analysis (BIA) and IT disaster recovery
• Cyber recovery planning
• Financial planning, investment prioritization and supplier governance
• Enterprise risk management and third‑party risk
• Regulatory compliance for financial services
• NIST Cybersecurity Framework 2.0
• ISO/IEC 27001