Risk Talent · Executive search
Cyber and ICT risk recruitment at head-of level starts with what the role may decide: when the first line keeps a system running past the end of vendor support, can the second line block it? RiskTAE runs retained searches for second-line heads of cyber, information and technology risk in banks, building societies, insurers, investment firms and payment firms.
A partner runs the search from the written brief to the first day, and every candidate is interviewed on the technical substance of the role before you see a CV.
You meet people who can challenge the chief information security officer on the evidence and put technology risk in front of the board in its own language.
By Benn PopleUpdated
The role
The head of cyber and ICT risk is the second line for technology: the person who tests, challenges and reports on how well the firm’s systems, data and suppliers are protected, without running any of them.
In a bank the technology the role challenges belongs to the Chief Operations function, SMF24, defined by the PRA as responsibility for the internal operations and technology of a firm. The head of cyber and ICT risk sits in the risk function, which the Risk Control Part requires to be independent from the operational functions, with the authority and access to warn the board, and reports to the chief risk officer (SMF4) or the head of operational risk.
Cyber and ICT risk is part of operational risk, which the UK Capital Requirements Regulation defines as the risk of loss from inadequate or failed internal processes, people and systems or from external events. Neither regulator’s list of senior management functions for a bank names the role, so it is usually a certification function, certified by the firm rather than approved by the regulator. The first thing we settle in a brief is what the role may decide: a candidate at this level asks who signs a risk acceptance when the first line keeps a system running past the end of vendor support, and whether the second line can block it.
Sources: UK CRR, Article 4(1)(52); PRA Rulebook, Senior Management Functions Part, rules 3.4 and 3.8, Risk Control Part, rule 3.4, and Certification Part, rule 2.1; FCA Handbook, SUP 10C Annex 1.
Remit
Firms must identify their important business services, set an impact tolerance for each and be able to stay within it through a severe but plausible disruption, which they had to be able to do by 31 March 2025. The Chief Operations function implements the policies, so the second line’s job is challenge, and we ask each candidate which scenario tests they have challenged: a cyber scenario that takes a service past its tolerance separates a head of cyber risk from a CISO with a risk title.
Boards and senior managers cannot outsource their responsibilities, and the PRA expects notice before a firm enters or significantly changes a material outsourcing arrangement. A new version of SS2/21, published on 18 March 2026, takes effect on 18 March 2027 following PS7/26 on operational incident and third-party reporting, so the reporting your hire signs off changes in their first year. We ask which entries on the outsourcing register carry an important business service, and which of those run in a public cloud.
The risk function must be able to report directly to the board in its supervisory function and warn it, and the PRA expects the board to keep the effectiveness of the risk control framework under active review. Where the 2024 UK Corporate Governance Code applies, Provision 29 adds an annual review of that framework’s effectiveness for accounting periods beginning on or after 1 January 2026. Our test is whether the candidate can put one technology risk in front of a risk committee on a single page and say what the firm is accepting.
Sources: PRA Rulebook, Operational Resilience Part, chapters 2 and 7, and Risk Control Part, rule 3.4; PRA SS1/21, March 2022, paragraphs 4.14 and 7.4; SS2/21, November 2024, paragraphs 4.3 and 5.14, and the version published 18 March 2026; SS5/16, July 2018, paragraph 4.2; FRC, UK Corporate Governance Code 2024, Provision 29.
Candidates
Strong candidates come from four places: sitting heads of technology, information or cyber risk at other firms, who bring a framework that has been through a supervisory visit; deputies in larger technology risk teams who have run the control testing or the scenario challenge; CISOs crossing from the first line who would rather challenge than operate; and people from IT audit, consulting or the regulator, who know the standard but have not held a line with a chief information officer.
We test hardest for judgement: given a penetration test report, can the person say which findings matter to the board, and tell a control gap from a risk outside appetite? Can they hold a line with the CISO and keep the relationship? And scale: in a large bank the role runs one part of the framework with a team for each domain, while in a smaller firm the same person writes the policy, does the deep dives and presents to the risk committee with one analyst.
Process
| Stage | What happens | What is different for this role |
|---|---|---|
| Brief | A 30-minute call, then a written brief: the role, first-year success, terms and timetable. | We settle the reporting line, the boundary with the CISO and the Chief Operations function, and what the role may block. |
| Market map | The people who fit, most of whom are not looking, approached in confidence without naming you until they are interested. | Titles vary (technology, information, IT or cyber risk), so we map by remit and reporting line. |
| Technical screen | Each candidate is interviewed on the substance before you see a CV. | By former chief risk officers and heads of risk, former regulators and interim executives. |
| Shortlist | A short list with our written view of each person, then interviews and feedback both ways. | The CISO or chief information officer meets the final two; the chair of the risk committee meets the last one. |
| Offer, checks and start | We handle the offer, plan the checks and stay close through notice and the first months. | Regulatory references over six years apply to this role too; our guide to regulatory references after PS12/26 sets out the timetable. The PRA expects a criminal records check for non-SMF holders too, with the candidate’s consent. |
Sources: PRA Rulebook, Fitness and Propriety Part, rule 2.7; PRA SS28/15, April 2026, paragraphs 4.19, 6.4 and 6.5; PS12/26, 22 April 2026, paragraph 2.79.
Failure points
Sources: PRA SS5/16, July 2018, paragraph 10.2; PRA Rulebook, Risk Control Part, rule 3.4, and Allocation of Responsibilities Part, rule 7.1.
Working with your team
The chief risk officer owns this hire. The CISO and the chief information officer will work with the new head every week, so we ask them to agree the brief and meet the shortlist. The chair of the risk committee, whom the PRA holds responsible for safeguarding the independence of the risk function, usually meets the final candidate.
Where the role sits under a head of operational risk or beside a head of operational resilience, we run the searches together so the remits do not overlap: see our pages on operational risk and operational resilience search.
HR, in-house talent acquisition and RPO teams own the process and the offer; we bring the market map and the technical screen (see how we work with talent acquisition teams). A search can be paired with interim advisory cover from Risk Advisory, or with training for the new head’s team from Risk Education.
Sources: PRA SS5/16, July 2018, paragraph 4.3; PRA SS28/15, April 2026, Table F.
FAQ
Usually not. Neither regulator’s list of senior management functions for a bank names the role, so in most firms it is a certification function, which the firm certifies as fit and proper each year. Where the person holds overall responsibility for an area under the FCA’s rules and no other approval, SMF18 applies, with the regulator’s approval.
No. The CISO runs security in the first line, inside the Chief Operations function’s remit; the head of cyber and ICT risk sits in the risk function and challenges that work. Where a firm wants one person to do both, we say in the brief that the Risk Control Part requires the risk function to be independent from the operational functions.
Yes. The remit is the same whether the title is head of technology risk, IT risk, information risk or cyber risk oversight, and in some firms it is part of a wider non-financial risk role. An ICT risk leadership search maps the market by remit rather than title, and we test each part of the remit on its own.
Rarely. Head of cyber risk recruitment at this level is confidential, so we approach people directly. If you are thinking about a move, book a confidential career call, message us on WhatsApp on +44 7537 159269 or email talent@risktae.com. Your name is never put forward without your agreement.
Insights
A head of non-financial risk leads the second-line oversight of a bank's risks that do not arise from lending, trading or funding: operational risk, operational resilience, third-party and outsourcing risk, technology and cyber risk, and in some banks conduct and model risk. The role challenges the first line and reports on these risks to the CRO and the board.
By Benn Pople · 6 min readDated PRA changes that affect a UK bank's risk function, with a link to the source for each, updated on the first working day of each month.
RiskTAE
A UK bank hiring a senior manager, a certification function holder or a notified non-executive director must request regulatory references covering the candidate’s previous six years from every relevant former employer, and must normally hold them...
By Benn Pople · 8 min readNext step
In 30 minutes we will agree the brief, say how the market is likely to read it and tell you whether a retained search is the right route.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.