Group Director – Regulatory Assurance and Cyber

Description

Reporting to the Executive Director for Regulatory Risk and Innovation, the role provides focused leadership and capacity in a high‑risk, fast‑evolving regulatory area. You will work closely with Executive Directors and senior leaders across the organisation to ensure coherence between assurance, supervision, investigations and enforcement activity, and to support clear prioritisation and measurable regulatory impact.

As a senior leader, you will be expected to make a significant contribution to the development and delivery of the ICO’s strategic plans, policies and initiatives. You will also promote and safeguard the good corporate reputation of the ICO, raise awareness of information rights and obligations and provide leadership to the organisation and its people.

Key Responsibilities

• Work collaboratively with senior leader colleagues to develop and deliver the ICO’s purpose and vision, role modelling our values at all times.
• Provide direct leadership and line management for the Director of Regulatory Assurance, Director of Cyber, and two PACE product roles, bringing together assurance, cyber and product capability under a single senior leadership role. You will be responsible for ensuring all staff within the directorates are clear about standards expected and are empowered to achieve them.
• Provide senior oversight of PACE product activity within scope, ensuring product delivery supports regulatory assurance and cyber priorities and is aligned to the ICO’s strategy and Better Regulatory Interventions approach.
• Lead delivery of the ICO’s regulatory responsibilities arising from the Cyber Security and Resilience Bill, ensuring readiness, capability and effective supervisory approaches are in place.
• Ensure strategic risks and opportunities in all areas of responsibility are managed effectively. This means agreeing clear risk appetites, ensuring all risks are clearly articulated and actively managed, and that all controls and mitigating actions are effective and proportionate.
• Overall budgetary and fiscal responsibility for Regulatory Assurance and Cyber functions, overseeing operational spend and leading on development of business cases where necessary.
• Embed a supervisory approach to regulation, focused on earlier engagement, prevention of harm and delivery of clear, measurable regulatory outcomes.
• Ensure assurance and cyber interventions are proportionate, evidence‑based and consistent with the ICO’s Better Regulatory Interventions approach.
• Work closely with Legal, Investigations and other regulatory functions to support effective escalation, enforcement decision‑making and end‑to‑end regulatory coherence.
• Contribute to organisational horizon‑scanning and risk assessment, identifying emerging threats, opportunities and trends relevant to cyber resilience and assurance.
• Establish and maintain effective internal and external relationships with government, public bodies, regulators, industry and other stakeholders to support delivery of regulatory objectives, regulatory coherence and effective risk management.
• Support the Executive Director for Regulatory Risk and Innovation in business planning, performance management and reporting on assurance and cyber activity.
• Engaging across the whole of the ICO, establishing close working relationships and taking responsibility for matrix management where necessary to ensure a connection across the organisation to achieve a successful and cohesive implementation of the relevant strategies.
• Ensure that the ICO values diversity in its workforce and demonstrates equality of opportunity in its treatment of staff, customers and in all aspects of its business.
• Seeking continuous improvement in all areas of responsibility and acting as a catalyst for efficiency, high performance, continuous improvement and innovation across the organisation.
• Play a significant role in the leadership of the ICO and all relevant initiatives, taking personal responsibility for ad hoc projects or tasks agreed with the CEO and Executive Team.
• Represent the ICO and personally advise the Executive Team wherever required.

Person specification

Essential criteria assessed at application stage:

• Senior‑level experience demonstrating widely recognised expertise in cyber, regulatory assurance or closely related risk‑focused disciplines, gained in public, private or third‑sector settings.
• Strong track record of leading complex cyber‑related, regulatory or assurance activity and delivering high‑quality outcomes in high‑risk or fast‑moving contexts.
• Extensive experience of senior leadership and people management, including setting clear direction, motivating teams and sustaining delivery through change.
• Experience operating effectively in high‑profile, high‑risk environments with significant reputational, public trust or wider system implications.
• Substantial experience in senior representational and negotiating roles, building effective relationships with government, regulators, industry and other stakeholders to influence outcomes, manage risk and maintain public confidence.

Essential criteria assessed during interview:

• Strong understanding of the principles of good regulation and their practical application within assurance and supervisory contexts.
• Knowledge of cyber risk, resilience, assurance or related regulatory domains with the credibility to operate authoritatively at senior levels, or the demonstrable ability to develop and apply such expertise quickly.
• Ability to champion and role model equality, diversity and inclusion, demonstrating strong personal integrity and a commitment to the ICO’s values at both an organisational and team level.
• The ability to exercise sound judgement in ambiguous or controversial circumstances.
• Ability to lead cross‑functional and matrix working, influencing without line authority where required.
• Experience of embedding outcome‑focused, proportionate regulatory interventions and measuring their effectiveness.
• Good understanding of public sector governance, accountability and performance management.
• Commercially and politically aware, with an understanding of how cyber risk, technological change and system resilience impact regulatory decision‑making and public trust.
• Collaborative leadership style, with a commitment to empowering others and building high‑performing teams.
• Strong written, verbal and communications skills, directed in particular at negotiating with and influencing a wide range of stakeholders including public speaking and media.
• Resilient, adaptable and able to operate effectively under pressure.

Equality, diversity, and inclusion

The ICO is committed to promoting and enhancing equality, diversity, and inclusion. We are focused on developing a workforce that is representative of the communities we serve and together we are building an inclusive workplace where all of our colleagues have the opportunity to make a real difference. We are championing this through our Equality Diversity and Inclusion Board together with a number of staff networks. Read more about our commitment on our website.

Candidates with a disability who meet the minimum criteria for this vacancy will be invited to interview as part of the ICO’s commitment to the Disability Confident Scheme.

As part of the ICO’s commitment to our EDI objectives and creating a workplace that represents the communities and societies we serve, we guarantee an interview to candidates who declare they identify as belonging from an ethnic minority background and who meet the minimum criteria for this vacancy

If you are disabled or have an impairment and require an alternative application method, please email the HR team at k

Closing Date

Please submit your CV and cover letter by 23:59, 16 August. Your cover letter should be no more than 1,000 words and should clearly demonstrate how you meet the essential criteria for the role.

We may close this vacancy early if we receive a high volume of applications. To ensure your application is considered, we encourage you to apply as soon as possible. If you require any reasonable adjustments to support your application, please contact us at .

In the event of a high volume of applications, we may not be able to invite all candidates who meet the minimum criteria to interview. However, we encourage you stay in touch and apply for future roles that match your interests.

All candidates who meet the minimum criteria and apply in-line with our guaranteed interview scheme for disabled and ethnic minority applicants will be interviewed.

Please note that post holders for this role will be required to receive security clearance to DV level. This requires the disclosure of spent and unspent convictions. Although convictions will be taken into account, any such information will not necessarily prevent you from obtaining a security clearance.

Clearance Required for this role:

Developed Vetting (DV)