Head of Department, Cyber & Information Resilience

The FCA has retained Odgers to advise on this appointment. For further information about the position and additional details on qualifications, requirements, terms and conditions of service and how to apply, please click here.
About the FCA
At the FCA, we’re creating a fair and more resilient financial system. We’re establishing more transparent relationships between financial services and customers, building trust in financial markets and protecting vulnerable consumers.
We’re currently on an exciting journey as we drive forward significant organisational, people, process, and technology transformation to become a more forward-thinking, proactive regulator. We will use data more effectively to drive better regulatory decisions and build greater cohesion across our broad financial services remit.
Significant improvements in digital enablement, business intelligence, market data and information management maturity are all being pursued to maintain our position as a world leader in financial services regulation.
In March 2025, the FCA launched a new 5-year strategy to deepen trust, rebalance risk, support growth and improve lives. The FCA will focus on four priorities:
Be a smarter regulator; predictable, purposeful and proportionate. The FCA will improve its processes and embrace technology to become more efficient and effective.
Support sustained economic growth, by enabling investment, innovation and ensuring the continued competitiveness of the UK’s world-leading financial services.
Help consumers navigate their financial lives by working with industry to boost trust, product innovation and ensuring the right information and support is available for people to take financial decisions.
Fight financial crime, focusing on those who seek to use the fact they are regulated to do harm. It will go further to disrupt criminals and support firms to be an effective line of defence.
The Role
The Cyber and Information Resilience department is responsible for protecting the FCA’s systems, data, services and information assets, and for providing the organisation with the strategic cyber security, information resilience and assurance capability needed to operate within risk tolerance. This role is the single Head of Department for Cyber and Information Resilience and operates as the organisational CISO. It combines strategic oversight, departmental leadership and delivery of delegated SMF responsibilities from the COO, setting the organisation’s cyber strategy, owning departmental planning, risk and governance, and ensuring senior decision-makers receive clear, timely advice on cyber and information resilience matters.
What will the candidate get from the role?
Joining the Senior Leadership Team at the FCA during an exciting and challenging time of great change in financial services, technology and its regulation
Leading a strategically important department responsible for cyber security, information resilience, assurance and operational cyber capability across the FCA
Exposure to strategic cyber, technology risk, operational resilience and regulatory issues, working with senior stakeholders across DTI, enterprise governance, audit, risk and regulatory forums
Key responsibilities:
Set the strategic direction for Cyber and Information Resilience, ensuring priorities, operating model, controls and capability plans align to FCA risk appetite, enterprise priorities and regulatory expectations.
Own departmental planning, including annual and in-year prioritisation, workforce and capability planning, budget and FTE considerations, delivery commitments, performance reporting and dependency management.
Deliver delegated SMF responsibilities on behalf of the accountable senior executive, ensuring cyber and information resilience risks, controls, issues and decisions are visible, evidenced and escalated through appropriate governance.
Senior engagement with Technology and Data, enterprise governance forums, audit, and risk is managed to provide clear judgment on material cyber risks, trade-offs, and control expectations.
Provide the mandate, prioritisation and escalation support required for the Deputy CISO and C&IR management team to organise delivery across cyber defence, assurance, governance, security expertise and related teams.
Ensure C&IR operates as an integrated department, connecting strategic cyber risk, operational insight, assurance findings, change demand, incident learning and external threat intelligence into a coherent plan of action.
Skills/Experience Required
We’re proud to be a Disability Confident Employer, and therefore, people or individuals with disabilities and long-term conditions who best meet the minimum criteria for a role will go through to the next stage of the recruitment process. In cases of high application volumes we may progress applicants whose experience most closely matches the role’s key requirements. (To learn more about the Disability Confident Scheme Click Here)
Minimum
Significant experience leading cyber security, information resilience, technology risk or comparable enterprise risk functions in a complex organisation, with ability to lean in and drive team performance across all areas (including detection & response, Assurance, SSDLC, policy and AI Security).
Demonstrated experience translating cyber and information resilience risk into senior-level decisions, priorities, control expectations and accountable delivery plans.
Experience owning or contributing to departmental planning, workforce planning, budget prioritisation, governance reporting and management of cross-cutting dependencies.
Experience operating with delegated senior management accountabilities, including evidencing decisions, escalating material risks and maintaining effective governance disciplines.
Experience leading through senior managers, deputies or management teams, with the ability to set mandate and direction while enabling operational leaders to manage delivery.
Essential
Strong strategic judgement, with the ability to identify material cyber and information resilience risks, make proportionate trade-offs and advise senior stakeholders clearly.