Interim Group Chief Information Officer — Recovery

More than a security brief

A quick reading of this appointment might take it for a cyber role wearing a broader title. It is not. The Interim Group Chief Information Officer is asked to make cyber resilience part of how the business runs, ranked against the same operating and customer priorities as everything else, rather than a separate programme with its own budget and its own language. That requires a technology executive who can talk to a store manager about what an outage costs, and to a committee about which risks the business is choosing to carry.

The work, and the authority behind it

Reporting to the Technology Committee Chair, you hold interim executive authority over technology and cyber. You will draw the decision rights for technology and cyber, with clear thresholds left to local leaders. Which measures judge technology investment, capacity and control across markets is yours to settle, as is the fate of each inherited commitment: continued, held or closed. You can stop proposals that push a cyber cost or exposure along without anyone taking it on, and decline investment cases that ignore whether the change will be used, what it leans on or how it might fail. You approve who leads technology and cyber and how incidents escalate, work through disagreements between the committee and the store and distribution heads, and fix how the board hears about resilience progress, exceptions and unresolved choices.

Resilience in a retail and distribution setting is a practical question. Which customer services must recover first, and how fast? Which recovery plans have been rehearsed, and which only exist on paper? The best answers come from operators and technologists working out together what the business cannot do without, then testing it.

A technologist who knows when to keep local discretion

You can tell necessary local judgement apart from variation that persists because nobody has challenged it. The organisations you have led had revenue of $450 million or more, with 1,200 people working in three countries, and you have handed over authority in store, digital and distribution operations that had to keep trading throughout. The committee chair will look at your record in cost transformation, digital transformation and regulatory remediation, at risk judgement at level 4, and at level 3 in architecture at scale, in data and AI governance and in product delivery. You know which local discretion to preserve and which to withdraw, and you write that boundary down so others can follow it. Stopping a technology commitment will not require each market to sign off first.

Ranked, rehearsed, routine

Within ninety days, cyber resilience priorities should be ranked against operating and customer needs, each with an accountable owner and thresholds agreed with the Technology Committee Chair. Around month nine the inherited technology and cyber commitments should be resolved, and recovery controls should have been tested against the most critical customer services. By month 24 cyber resilience should be governed as an ordinary part of operating priorities, with a tested route for escalation and a leadership team able to sustain it after you leave.

The selection follows its own arc. It opens in the first week with the Technology Committee Chair, in confidence and over video. Week three is a working session with the Risk Committee Chair on how you would decide which risks to carry. Week five puts you, in person, before the executives who run the functions that would live with an outage, and the directors follow in week seven, sitting as a full board. Four working days is the most you will wait for our written response to any stage.