CoE Lead - CyberSecurity

Role summary

The Cyber Security CoE Head leads the organisation’s Cyber Security Center of Excellence, providing strategic direction, governance, and thought leadership across security architecture, operations, risk, and compliance. This role is accountable for building and running the CoE as a central hub for security expertise, standards, and enablement, and for driving a strong security culture and measurable improvements in cyber resilience.

Key responsibilities

• Vision, strategy, and CoE operating model
  • Define and maintain the cybersecurity CoE vision, charter, and multi?year roadmap, aligned with business strategy, risk appetite, and regulatory requirements.
  • Design and operationalise the CoE operating model (services, engagement models, governance forums, KPIs) to support IT, OT, products, and business functions.
• Governance, risk, and compliance (GRC)
  • Strengthen cyber GRC posture across IT/OT systems, data, and devices by driving risk assessments, control frameworks, and policies.
  • Ensure ongoing compliance with relevant standards and regulations (e.g., ISO 27001, NIST, IEC 62443, GDPR/DP laws, sectoral regulations) and maintain audit readiness.
• Security standards, architecture, and best practices
  • Establish and maintain security policies, standards, patterns, and baselines for networks, infrastructure, applications, data, and identity.
  • Provide architectural guidance and design reviews to ensure major initiatives (cloud, OT, digital products) align with CoE standards and Zero Trust/security?by?design principles.
• Centre of Excellence services and enablement
  • Build the CoE as the “go?to” cybersecurity advisory and enablement hub, supporting business units, IT/OT teams, and product/R&D with risk assessments, design reviews, and expert consulting.
  • Develop reusable playbooks, templates, reference architectures, and training content to accelerate consistent adoption of security practices.
• Security operations and incident oversight
  • Provide leadership and oversight for incident response, threat hunting, and digital forensics, ensuring lessons learned feed back into controls and standards.
  • Monitor the global cybersecurity landscape (threats, vulnerabilities, regulations) and ensure the organisation’s security posture adapts accordingly.
• Talent development, culture, and awareness
  • Build and lead a high?performing cybersecurity team within the CoE, coaching and mentoring analysts, engineers, and architects; manage partner/vendor security teams where relevant.
  • Promote a strong security culture via awareness programs, training, and stakeholder engagement across the organisation and ecosystem (IT, business, partners, government, academia).
• Stakeholder management and external engagement
  • Engage senior stakeholders (CxOs, business heads, regulators, partners) to communicate risks, progress, and priorities, and to secure sponsorship for security initiatives.
  • Represent the organisation in external cybersecurity forums, industry groups, and government initiatives, positioning the CoE as a thought leader.

Required skills and experience

• Experience
  • Typically 10-15+ years in cybersecurity, with 5+ years in leadership / management roles across GRC, operations, architecture, or product security.
  • Proven experience in setting up or leading centers of excellence, practices, or security programmes in complex organisations (enterprise, government, or product/R&D).
• Technical competencies
  • Strong knowledge of security frameworks and standards (ISO 27001, NIST CSF/800?53, IEC 62443, etc.) and practical experience applying them.
  • Broad understanding of network and infrastructure security, application and data security, identity and access management, logging/monitoring, and incident response.
  • Familiarity with security tools and platforms (SIEM, SOAR, EDR/XDR, DLP, IAM/PAM, vulnerability management) and how they support controls and audits.
• Management and leadership skills
  • Strong programme and change management skills: ability to design and run multi?year security programmes, track deliverables, and manage dependencies.
  • Excellent communication and stakeholder management; able to influence at executive level and collaborate across IT, business, legal, compliance, and external bodies.

Education and certifications (indicative)

• Master’s or Bachelor’s degree in Computer Science, Information Security, Engineering, or related disciplines, optionally combined with a management degree.
• Relevant professional certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, and any sector?specific or cloud/security certifications as appropriate.