Interim Group Chief Information Officer — Scale

Cyber resilience, but not as a security project

A CIO could treat this mandate as a list of controls to install. That would miss the point. The Interim Group Chief Information Officer, answering to the Technology Committee Chair for 12 months, is appointed to make cyber resilience follow what the business and its customers depend on most: which systems must recover first, how quickly, and at whose expense when priorities collide. Nor is this an advisory brief. It carries executive authority, and the work involves turning down some well-argued requests.

The decisions that shape resilience

The CIO establishes the group's thresholds for what local technology leaders decide alone and decides which evidence governs technology spending, recovery capacity and security controls. They determine which inherited commitments survive. They refuse proposals that pass on cost or risk unless someone answerable takes it, decline investment where adoption, dependencies and the downside go unaddressed, and sign off who leads and how incidents escalate.

In practice, resilience is a ranking exercise. A system that schedules vehicles and a portal that books shipments may both be critical, but they are rarely equally critical at three in the morning in the middle of an incident. Agreeing that order in advance with operations and commercial leaders, then funding recovery to match it, is where a CIO earns the role. Buy-side acquisitions complicate the picture, since an acquired estate brings its own systems, contracts and weak points, all of which have to be folded into the same ranking.

A CIO who has ranked systems under pressure

Technology you have led served a business of at least $635 million in revenue, employing 3,100 or more people in three countries or more. Your record includes buy-side M&A, digital transformation and professionalisation, and you understand why operating priorities can shift faster than technology plans. Risk judgement is the capability we weigh most, at level 4; data and AI governance, architecture at scale and product delivery are wanted at level 3. You have made a provisional call on partial evidence and firmed it up as better information arrived, and after a board has ruled you remain the person who answers for it, technology exceptions included.

Recovery order, tested and owned

After the first ninety days, cyber resilience priorities should be ranked against the operating and customer services they protect, with an accountable lead for each and an agreed split of who decides what across the group. Around month nine, recovery plans for the critical operating and customer systems should have been tested in earnest, with gaps owned and escalated rather than merely noted. By month 12, group reporting on cyber resilience should be part of the committee's regular work, and system ownership should be clear enough for others to carry on.

The Technology Committee Chair meets you first, privately over video, in the opening week. At week three the Regional President works with you on how operating priorities translate into recovery order. Executives heading each function meet you face to face as a panel in week five, and the seventh week is spent with the full board. Our response to each stage arrives in writing within five working days.