Chief Security Officer

About this role

Details

£150,000 up to a maximum of £173,000 per annum for an exceptional external candidate.

A Civil Service Pension with an employer contribution of 28.97%

GBP

Job grade

SCS Pay Band 2

Business area

HMRC - CDIO - CDPO - Governance & Delivery Enablement

Type of role

Information Technology

Operational Delivery

Senior leadership

Working pattern

Flexible working, Full-time

Number of jobs available

1

Contents

• Location
• About the job
• Benefits
• Things you need to know
• Apply and further information

About the job

Job summary

Reporting to the Chief Digital and Information Officer (CDIO), the Chief Security Officer is a core member of the CDIO Senior Leadership Team, with overarching responsibility for safeguarding HMRC's information assets, managing security and data protection risks, and setting enterprise-wide security policies and standards across cyber, information, personnel and physical security. This role offers a unique opportunity to influence HMRC’s security agenda across wider government.

Job description

Security Operations & Risk Management

• Deliver a range of technical security services across HMRC in an agile and risk-informed way, enabling the organisation to operate securely and effectively at scale.
• Ensure security and privacy is by design and implementation and that appropriate controls exist throughout CDIO and the wider HMRC business.
• Strengthen HMRC’s personnel security position by designing and implementing an appropriate personnel security framework.
• Establishes enterprise-level physical security policy, standards, and assurance frameworks; day-to-day operations are managed by HMRC’s Estates function.
• Drive the implementation and monitoring of compliance to relevant regulatory and government requirements (e.g., NCSC, ISO 27001).
• Oversee the identification, evaluation, and reporting of legal and regulatory, IT, and cyber security risk to information assets.
• Liaise with other functions (Finance, HR, Legal, Ethics) and third parties to ensure security and data protection risks are understood, considered, and satisfactorily mitigated.

Threat Response & Innovation

• Strategic leadership to identify, understand and effectively address emerging threats such as AI attacks, ransomware, and supply chain vulnerabilities.
• Ensure appropriate response to security incidents and drive continuous improvements by learning from them.
• Drive innovation in security technologies such as Zero Trust architecture and secure AI adoption.

Governance, Architecture, and Influence

• Facilitate an appropriate security governance structure; provide regular reporting on the status of the security and data protection programme to senior leaders, including the Executive Committee and Audit and Risk Committee.
• Work with the Head of Architecture and Innovation to build alignment between the security and enterprise architectures.
• Implement and drive policy changes across HMRC and the wider government. Represent HMRC on relevant cross-government boards and engage with the Government Security Group to influence and help deliver the cyber, physical and personnel security policy agenda across government.
• Liaise with external agencies, such as law enforcement and other advisory bodies, including National Technical Authorities.
• Build and nurture external networks consisting of peers in government and industry to address common trends, findings, incidents, and cybersecurity risks.

Accountability & Public Trust

• Define and report on security performance metrics to demonstrate accountability and effectiveness.
• Promote public trust through transparent security practices and effective communication.

Person specification

Essential Criteria

• *Professional Expertise & Standards -*demonstrates a deep and current understanding of information security principles, technologies, and control frameworks. This is evidenced by relevant security qualifications and practical experience, alongside professional certifications such as CISSP, CISM, or equivalent. Shows a strong commitment to delivering against recognised industry standards and best practices.
• *Executive Security Leadership -*proven strategic leadership in managing security, risk and compliance across large, complex organisations and technology environments. Brings an outstanding track record of shaping and delivering enterprise-wide security programmes that support organisational resilience and regulatory compliance.
• *Technical Authority & Innovation -*extensive technical expertise across multiple domains of security and compliance, with the ability to exercise independent judgment and make high-impact decisions. Demonstrates a forward-looking approach to emerging threats, including experience in researching and implementing innovative solutions such as Zero Trust architectures, secure AI, and other cutting-edge security models.
• *Strategic Influence & Stakeholder Management -*exceptional influencing, negotiation, and relationship-building skills, with a proven ability to engage and maintain trust with senior stakeholders across government, industry, and third-party providers. Able to align security strategy with broader organisational goals through effective cross-functional collaboration.
• *Organisational Change & Vision -*demonstrable experience in anticipating and preparing for major organisational or technological shifts, including emerging cyber threats. Confidently leads through uncertainty, ensuring the organisation remains agile and informed.
• *Team Leadership & Development -*proven ability to build, lead, and develop high-performing teams across multiple locations. Skilled in empowering senior managers and specialists within the security and compliance disciplines, fostering a culture of excellence, accountability, and continuous improvement.

Benefits

Alongside your salary of £150,000, HM Revenue and Customs contributes £43,455 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides .

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an employer contribution of 28.97%

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance for more information on appropriate and inappropriate use.

Selection process details

For full selection process details please see attached Candidate Pack.

Feedback will only be provided if you attend an interview or assessment.

This role has a minimum assignment duration of 3 years. An assignment duration is the period of time a Senior Civil Servant is expected to remain in the same post to enable them to deliver on the agreed key business outcomes. The assignment duration also supports your career through building your depth of expertise.

As part of accepting this role you will be agreeing to the expected assignment duration set out above. This will not result in a contractual change to your terms and conditions. Please note this is an expectation only, it is not something which is written into your terms and conditions or indeed which the employing organisation or you are bound by. It will depend on your personal circumstances at a particular time and business needs, for example, would not preclude any absence like family friendly leave.

About security roles for ex-police

Security management, operations and consultancy roles. Years of operational policing — command, incident response, public order — translate directly into corporate security, and employers in this sector actively rate police experience.