Interim Group Director of Cyber Risk Integration

Begin with consequential services

Identify the services and information whose loss or compromise would materially affect each business. Assess current controls and recovery capability using evidence proportionate to their importance. Reconcile inconsistent risk descriptions so that group leaders can compare decisions without pretending that every business has the same operating environment.

Build the management arrangement

Define group requirements, local responsibilities and the route for justified exceptions. Establish ownership of remediation and a clear process for accepting residual risk at the appropriate level. Ensure that business leaders understand the consequences of their choices and are not asked to approve technical statements they cannot interpret.

Coordinate security, technology, operations and finance teams around an executable investment sequence. Address critical shared dependencies and improve incident escalation across business boundaries. The director will manage approved resources and resolve delivery conflicts within delegation; reserved expenditure and formal risk acceptance remain with authorised executives or the governing body.

Avoid compliance without improvement

Measure whether controls work and whether exposure is changing. A completed assessment or closed action should be supported by evidence. Where a requirement is impractical, revise the implementation approach or escalate the trade-off rather than allowing informal non-compliance to become routine.

Experience needed

Applicants should have led cyber-risk implementation across multiple operating units and can demonstrate collaboration with business executives. They must explain how they dealt with a unit that had legitimate reasons to differ from group standards. Strong candidates combine technical credibility with practical financial and organisational judgement.

The permanent operating model

Handover must include accountable owners, useful risk information and a funded improvement plan. Success means the group can identify material changes, prioritise investment and respond coherently across boundaries. The programme should leave local teams capable of maintaining controls and leaders capable of making informed decisions without a temporary central director interpreting every issue for them.