Security, Privacy & GRC - Executive & VP
VP of Cyber Security and Risk
VP Level
Independently auditedSets company direction and answers for it to the board. Owns the function across the company, including its plan, its budget, and its leaders.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Project & Work Management
- GRC & Compliance
- Analytics & BI
- FP&A & Planning
- ITSM / Service Desk
Deliverables
- Strategy and operating plans
- Board and executive narrative
- Investment and trade-off recommendations
- Organisational design proposals
Responsibilities
- Translate the CISO's security-and-risk strategy into an operating plan - roadmap, OKRs, milestones, owners, dependencies, and budget - and drive it to delivery
- Run the portfolio of security programs (engineering, operations, detection & response, GRC, identity) through Directors and managers, load-balancing across teams
- Own the enterprise / operational / third-party risk program end to end - the risk register at portfolio scale, risk quantification, and the risk-committee cadence
- Own delivery: program status, milestone attainment, and the operating cadence (weekly ops review, monthly business review, quarterly planning)
- Own the headcount plan and org design under them - where to add, where to consolidate, how the functions are structured
- Steward the security-and-risk budget the CISO secured - allocate it across programs by risk retired, track burn, and defend variances
- Run cross-functional risk execution - the security-and-risk touchpoints with Engineering, Product, IT, Legal/Privacy, and Enterprise Risk
- Lead and develop Directors and managers; build the bench so the org scales without the VP as a single point of failure
The essence of this seat
The VP of Cyber Security and Risk runs the combined cybersecurity and risk organization and owns its execution.
Signature move
Reconcile the plan against real capacity before you commit. On any strategy, roadmap, or ask, the first move is to test it against what the portfolio can actually deliver this quarter - commit owners, dates, and budget, not aspiration, and surface the capacity gap up rather than absorb it silently
What good looks like
converts each pillar into owned/dated/budgeted OKRs and milestones through Directors; reconciles the whole plan against real capacity before committing; delivers the committed plan plus an explicit capacity-gap list with priced trade-off options up to the CISO; refuses both silent over-commit and silent scope-drop; leaves the strategy and appetite call with the CISO
Decision rights
- - the operating plan and roadmap sequencing, how budget and headcount are allocated across programs, org design and structure below you, program prioritization and the operating cadence, Director-level hiring and performance, and which execution risks you manage vs
Working vocabulary
What this role does
The VP of Cyber Security and Risk runs the combined cybersecurity and risk organization and owns its execution. They sit one tier below the CISO and one above the Directors: the CISO sets strategy, owns the board relationship and the budget, and holds risk-acceptance authority; the VP takes that strategy and turns it into an operating plan that ships - a roadmap with owners, dates, dependencies, and a headcount to deliver it. Where the CISO answers "what is our posture and what risk will we accept?", the VP answers "are we executing the plan, on time, within budget, across every team?" They report to the CISO (and often dotted-line to the CIO), and are accountable for delivery, not for setting the risk appetite. The mandate is unusually wide because it spans two disciplines under one leader: the cyber security side (the engineering, operations, detection, GRC, and identity programs delivered through Directors and their teams) and the risk side (enterprise, operational, and third-party risk - the register at portfolio scale, risk quantification, the risk-committee cadence). The VP is the connective tissue that makes those two run as one operating system rather than two silos. The day is portfolio management: load-balancing across Directors, unblocking the program that slipped, deciding which of three under-resourced teams gets the next hire, and keeping the CISO's strategy honest against what the org can actually deliver this quarter. What separates great from average is operating leverage and execution translation: converting a strategy deck into an OKR-and-milestone plan the org can be measured on, running a cadence that surfaces slippage early instead of at quarter-end, spending headcount and budget where they retire the most risk, and developing Directors into leaders who run their own portfolios so the VP is not the bottleneck. The VP does not chase individual findings or write the board's risk narrative - they make the machine that does both run reliably at scale.
Best-fit customer
organisations that need experienced judgement applied to company strategy, operating performance, and enterprise accountability
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.