Head of Cyber Protection

As the Head of Cyber Protection, you will drive a proactive risk-based approach to cyber security, ensuring threats and vulnerabilities are identified, understood, prioritised, and effectively managed. You will lead a high-performing team, foster a culture of continuous improvement, and work closely with senior stakeholders across the business to strengthen Metro Bank's security posture while enabling innovation and growth.

Lead Metro Bank's Cyber Protection capability, including Cyber Risk Assessment, Cyber Awareness & Training, Identity & Access Management (IAM), and Data Loss Prevention (DLP). Define and deliver the Cyber Protection strategy and roadmap, ensuring alignment with the Bank's overall cyber security and business objectives. Oversee cyber risk assessments for technology change and development, ensuring risks are identified and managed effectively.

Drive cyber awareness across the organisation, helping colleagues understand their responsibilities and adopt secure behaviours. Ensure appropriate controls are in place to manage access to systems and data, following least-privilege and security best practices. Lead the Data Loss Prevention capability, protecting sensitive customer and business information from unauthorised access or disclosure. Work closely with Technology, Data, Risk, Change and business teams to embed security into processes, projects and new solutions.

Provide regular reporting to the CISRO and governance forums on cyber risks, control effectiveness, capability maturity and key priorities. Build and develop a high-performing team, creating a culture of accountability, collaboration and continuous improvement. Manage suppliers, budgets and service performance to ensure the Cyber Protection function delivers effective outcomes and value. Work effectively with second and third lines of defence, external auditors and regulators to support strong governance and compliance.

Any other duties as reasonably required within the role Proven experience operating in a senior cyber security leadership role within a regulated financial services environment or similarly complex organisation. Demonstrable expertise in leading cyber protection, security engineering, security architecture, vulnerability management, identity and access management, or security operations functions.

Strong track record of delivering significant cyber security control improvements, remediation programmes, and transformation initiatives across complex technology estates. Deep technical understanding of enterprise cyber security controls, including identity and access management, endpoint security, network security, cloud security, vulnerability management, logging and monitoring. Strong knowledge of industry-standard cyber security frameworks and methodologies, including NIST CSF, ISO 27001, CIS Controls, COBIT and MITRE ATT&CK.

Experience communicating cyber risks, control effectiveness and investment recommendations to Executive Committees, senior leadership teams and governance forums. Proven ability to translate complex technical cyber risks into clear business impacts and actionable recommendations for non-technical stakeholders. Experience working with second and third lines of defence, external auditors and regulatory bodies, ensuring effective governance and regulatory compliance.

Strong stakeholder management and influencing skills, with the ability to constructively challenge, build consensus and drive accountability across all levels of the organisation. Demonstrated experience managing security budgets, suppliers and third-party service providers, ensuring effective operational performance and value for money. Proven people leadership experience, including building high-performing teams, developing talent and fostering a culture of continuous improvement.

Strong understanding of cyber threats, attack methodologies and emerging security trends across hybrid and cloud environments. Relevant professional cyber security qualifica