Virtual Chief Information Security Officer (vCISO)

Company Description

Our Mission

At Palo Alto Networks® everything starts and ends with our mission:

Being the cybersecurity partner of choice, protecting our digital way of life.
Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way things are done, and we’re looking for innovators who are as committed to shaping the future of cybersecurity as we are.

Who We Are

We take our mission of protecting the digital way of life seriously. We are relentless in protecting our customers and we believe that the unique ideas of every member of our team contributes to our collective success. Our values were crowdsourced by employees and are brought to life through each of us everyday - from disruptive innovation and collaboration, to execution. From showing up for each other with integrity to creating an environment where we all feel included.

As a member of our team, you will be shaping the future of cybersecurity. We work fast, value ongoing learning, and we respect each employee as a unique individual. Knowing we all have different needs, our development and personal wellbeing programs are designed to give you choice in how you are supported. This includes our FLEXBenefits wellbeing spending account with over 1,000 eligible items selected by employees, our mental and financial health resources, and our personalized learning opportunities - just to name a few!

Job Description

Your Career

Our leading consultancy seeks a dynamic and visionary vCISO to champion and operationalize cybersecurity best practices for a key public sector client. This crucial role will act as an account CISO and requires a trusted advisor who can effectively engage with client stakeholders (including CISOs, security teams, IT management, and executive leadership) across the account. The vCISO will primarily be responsible for the delivery of security services as part of a large-scale transformation programme and will also be required to identify and develop additional opportunities within the broader client organisation. 

This position requires a seasoned cybersecurity professional eager to influence client outcomes and drive meaningful improvements to their security posture. This role is key in managing and reducing operational security risks for our public sector clients to acceptable levels by leading remediation programs and guiding the implementation of appropriate security controls. 

The vCISO will serve as the primary point of contact for all client cybersecurity matters and requires a broad understanding of security control implementation within various corporate environments. Success in this role hinges on exceptional relationship management skills and the ability to drive adoption of recommended security solutions within the client organization.

Your Impact

Client Engagement and Programme Delivery:

• Serve as a trusted security advisor to client stakeholders, including CISOs, security teams, IT management, and executive leadership. 

• Work with different delivery partners across a complex product and service ecosystem to pragmatically manage risk and drive successful outcomes. 

• Develop and own the programme delivery and security services operational risk register

• Develop deep, trusted relationships across the client organization, fostering open communication and collaboration.

• Provide strategic guidance and mentorship to client security teams, empowering them to effectively manage security risks.

• Present security recommendations and findings to various client audiences, tailoring communication to the specific group.

• Represent our consultancy on client calls and escalations, offering expert security advice and guidance.

• Champion security best practices within the client organization and drive the adoption of recommended solutions.

Thought Leadership & Industry Collaboration:

• Maintain an up-to-date understanding of UK government security policies

• Stay abreast of industry best practices, emerging threats, and regulatory changes to provide cutting-edge guidance to clients.

• Share relevant industry insights and best practices with the client's security team to foster continuous improvement.

• Support executive engagement / peer relationships across the UK Public Sector and international peers.

Security Risk Management & Remediation:

• Conduct cybersecurity risk assessments, vulnerability analyses, and maturity assessments for clients.

• Develop and implement client-specific cybersecurity roadmaps, strategies, policies, and procedures.

• Provide expert advice on security architecture, incident response, disaster recovery, and business continuity planning.

• Oversee and guide client security teams in implementing and managing security controls.

• Assist clients with compliance requirements related to various regulations (GDPR, CCPA, HIPAA, PCI DSS, etc.) and standards (e.g., ISO 27001, SOC 2).

• Manage security risk committees to support client cyber risk management practices.

• Track and manage remediation of security audit and compliance findings for clients.

• Review security metrics and lead remediation programs within the client's environment.

• Lead or sponsor client security initiatives.

• Ensure necessary security controls are in place in conjunction with client data privacy initiatives.

Qualifications

Your Experience 

• Proven experience as an in-house CISO, or as vCISO within a consulting or systems integrator organisation.

• 10+ years of experience in cybersecurity, with expertise in areas like email security, cloud security, incident response, application security, vulnerability management, network security, cloud security, security operations, physical security, and supplier risk management.

• Strong experience in implementing and operating security controls in complex corporate environments.

• Demonstrated ability to engage with C-level executives and deliver impactful presentations.

• UK public sector experience, preferably within Emergency Services.

• Deep understanding of UK public sector security policies, compliance/assurance requirements, and audit practices. 

• Understanding of industry-recognised cybersecurity frameworks (NIST, ISO 27001, CIS), global privacy regulations, and emerging threats.

• Current holder of (or able to be cleared to) SC and ideally DV security clearance.

• Experience of working in multi-provider, multi-year programmes.

• Proven track record of building and implementing account growth strategies, both in terms of security maturity and business development.

• Exceptional communication (written/verbal), presentation, and interpersonal skills, including the ability to communicate technical concepts to diverse audiences.

Highly Desired:

• Advanced degree in Cybersecurity, Business Administration, or a related field.

• Professional certifications such as CISSP, CISM, CCISO, or GIAC.

• Experience with ISO 27001, Cyber Essentials+, and other relevant compliance standards.

• Published thought leadership and public speaking experience at major industry events.

Additional Information

The Team

Unit 42 brings together our world-renowned threat researchers with an elite team of security consultants to create an intelligence-driven, response ready organization. The Unit 42 Threat Intelligence team provides threat research that enables security teams to understand adversary intent and attribution, while enhancing protections offered by our products and services to stop advanced attacks. As threats escalate, Unit 42 is available to advise customers on the latest risks, assess their readiness, and help them recover when the worst occurs.

Our Commitment

We’re problem solvers that take risks and challenge cybersecurity’s status quo. It’s simple: we can’t accomplish our mission without diverse teams innovating, together.

We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at  accommodations@paloaltonetworks.com.

Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.

All your information will be kept confidential according to EEO guidelines.