> Markdown version of [/jobs/ext/4100578-chief-information-security-officer](https://www.wearedevelopers.com/jobs/ext/4100578-chief-information-security-officer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Chief Information Security Officer - **Company:** Ocado - **Location:** Hatfield, United Kingdom - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Software as a Service, Cyber Security, Information Leak Prevention, Data Security, Vector Graphics, Anti-Phishing, Large Language Models, Agentic-AI - **Published:** October 23, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=a38c18ceeedb5bcf ## About the Role * Substantial experience leading security at a senior level (CISO, Deputy CISO or equivalent) in a complex, fast-moving organisation. * Hands-on understanding of how LLMs and agentic systems work, and of how they fail and are attacked. You should be able to discuss tool use, context and memory, agent orchestration and guardrails in detail. * Evidence that you have used AI and automation to change how a security team operates, not just bought AI-branded tooling. * Strong grounding in modern security disciplines: cloud, identity, application and data security, detection and response, and third-party risk. * Experience reporting to Boards and regulators, and managing a major incident. * A pragmatic, risk-based approach that enables the business to move fast. Desirable Background in engineering or security engineering, with the ability to read code and challenge technical designs. * Experience with AI governance, model risk management or responsible AI programmes. * Familiarity with emerging standards for agent identity, authorisation and interoperability. * Professional qualifications such as CISSP, CISM or equivalent (valued, not required). How you work * Curious and hands-on: you use these tools daily and stay current as the field changes. * Clear under uncertainty: you can make and explain decisions where best practice does not yet exist. * Collaborative: you partner with product and engineering rather than policing them. * Accountable: you are comfortable owning outcomes, including when an agent gets it wrong. ## Description * Define the security architecture for AI agents: identity and authentication for non-human actors, least-privilege tool access, sandboxing, action approval thresholds and audit trails. * Set policies and controls for AI-specific risks, including prompt injection, data leakage, model and supply chain compromise, tool and plugin abuse, and over-permissioned agents. * Govern how third-party models, MCP servers, connectors and AI-enabled SaaS are assessed and approved. * Work with Engineering, Data and Legal on safe-by-default patterns so teams can ship AI features quickly without creating unmanaged risk. An AI-native security function * Redesign the security operating model so agents handle first-line work: alert triage, vulnerability prioritisation, access reviews, phishing analysis, policy questions and control testing. * Measure the function on outcomes (time to detect, time to remediate, risk reduced per head) rather than headcount or ticket volume. * Build and maintain the human oversight layer: clear escalation paths, evaluation of agent performance, and accountability for automated decisions. * Hire, develop and retain people who can supervise and improve agent-driven workflows. Threat readiness in an AI-accelerated landscape * Anticipate adversaries using AI for faster reconnaissance, convincing social engineering, deepfakes and automated exploitation, and adapt defences accordingly. * Lead AI-aware red teaming, adversarial testing of our own models and agents, and incident response exercises that include agent-related scenarios. * Own incident response end to end, including communication with the Board, regulators, customers and the press. Governance, risk and compliance * Own the information security strategy, risk register and board reporting. * Maintain certification and alignment to ISO 27001 as the core security management framework. * Apply the NIST AI Risk Management Framework and UK GDPR obligations to how we build, buy and deploy AI systems and agents. * Automate evidence collection and continuous control monitoring wherever possible. * Act as a trusted partner on data protection, privacy and AI ethics alongside the DPO and General Counsel. Leadership and influence * Be a credible voice at executive and Board level, translating technical and AI risk into business decisions. * Build a culture where security enables speed, and where employees are confident using AI tools safely. * Manage the security budget and vendor portfolio with a bias towards consolidation and automation. What success looks like in the first 12 months * A clear AI and agent security strategy, approved by the executive team and Board. * An inventory of every AI system and agent in use, with owners, permissions and risk ratings. * Agent identity, access and audit controls live for all production agents. * At least [three to five] core security workflows run largely by supervised agents, with measurable improvements in speed and quality. * An AI-aware incident response plan, tested through a live exercise. * A hiring and development plan for the team you need in an AI-first environment.