Head of Information Security (Deputy CISO)

NewDay is recruiting a brand-new Deputy Chief Information Security Officer role to help shape, lead and strengthen our enterprise-wide security capability.

Reporting directly to the CISO, you will be the senior operational leader for Information Security and the CISO’s principal deputy. You will translate our security strategy into clear priorities, measurable outcomes and consistent execution across security operations, governance, risk, architecture, engineering, identity, third-party security, resilience and assurance.

This is a high-impact leadership opportunity with significant enterprise visibility. You will represent Information Security at senior forums, provide clear insight on cyber and technology risk, and ensure our security organisation remains aligned with NewDay’s risk appetite, regulatory responsibilities, customer commitments and commercial ambitions.

What you’ll be responsible for

Lead the Information Security function

• Lead, develop and bring together NewDay’s Information Security teams, creating clear priorities, strong delivery and an accountable, high-performing culture.

• Act as the CISO’s delegate across executive, risk, governance, customer, supplier and regulatory forums.

• Ensure the function has the right operating model, capabilities, technology and management information to protect NewDay and support future growth.

Turn security strategy into action

• Be responsible for the operational delivery of NewDay’s security strategy, ensuring investment and activity are focused on reducing material cyber and technology risk.

• Own the Information Security Management System and support continued alignment with ISO/IEC 27001:2022, the NIST Cybersecurity Framework and other recognised standards.

• Maintain effective security policies, standards and controls, ensuring they are understood, embraced, evidenced and continuously improved.

• Support compliance with PCI DSS, UK GDPR, the Data Protection Act 2018 and relevant FCA expectations.

Strengthen cyber operations and resilience

• Lead security monitoring, threat management, vulnerability management, incident response and cyber preparedness across NewDay’s technology environment.

• Maintain effective incident playbooks, escalation routes, exercises and lessons-learned processes.

• Oversee the technology and security contribution to operational resilience, business continuity, disaster recovery and cyber recovery.

• Drive improvements in security tooling, telemetry, automation and operational efficiency.

Manage technology and information risk

• Own the technology and information risk framework, including risk appetite, assessment, quantification, treatment and reporting.

• Ensure security risks and control effectiveness are clearly understood, challenged and transparent to the right decision-makers.

• Embed security into major technology change, cloud adoption, platform engineering, digital delivery and supplier-led transformation.

• Partner with technology and engineering leaders to make secure-by-design delivery practical, proportionate and commercially aligned.

Lead assurance and emerging risk

• Oversee third-party and supply-chain security risk across key suppliers, affiliates and strategic partners.

• Coordinate internal and external assurance activity, including audits, independent assessments and regulatory engagement.

• Ensure findings, control gaps and regulatory commitments have clear ownership and are delivered to the required standard.

• Lead NewDay’s approach to AI security and governance, establishing practical controls that enable safe and responsible adoption.

What we’re looking for

You will be an established security leader who can combine strategic judgement with operational delivery. You will be comfortable leading broad, multidisciplinary teams while providing credible, concise advice to executives and Board-level stakeholders.

You will bring:

• Significant experience leading a broad Information Security function within a regulated organisation, ideally financial services, consumer credit, cards, payments or FinTech.

• Experience operating as a senior deputy to a CISO, or in an equivalent enterprise security leadership position.

• Experience across security operations, governance, risk and compliance, architecture, engineering, third-party risk, assurance and operational resilience.

• Strong practical knowledge of ISO/IEC 27001, PCI DSS, UK GDPR, the Data Protection Act 2018 and recognised control frameworks such as NIST.

• A solid understanding of technology risk, risk appetite, control effectiveness and operational resilience.

• Experience leading security incidents, audits, assurance programmes, regulatory engagement and senior-level reporting.

• Excellent judgement, communication and influencing skills, with the confidence to make clear decisions and build alignment across complex stakeholder groups.

Professional certifications such as CISSP, CISM, CRISC, CISA or ISO 27001 Lead Implementer or Auditor would be valuable. Experience of Microsoft Azure security, AI governance, cyber insurance, supplier assurance or major technology transformation would also be beneficial.

Why join NewDay?

This is an opportunity to take on a newly created, enterprise-wide leadership role with the directive to influence how security enables NewDay’s customers, technology strategy and commercial growth.

You will work closely with the CISO and senior leaders across technology, product, operations, risk, compliance, data protection, legal and procurement. Most importantly, you will help build a pragmatic, risk-led security culture that protects NewDay while enabling the organisation to move forward with confidence.

Externally this job title might also be known as Deputy CISO or Head of Information Security or Information Security Lead