Chief Information Security Officer

Ocado Retail

. Define the security architecture for AI agents, including identity, authentication, least-privilege tool access, sandboxing, action approval thresholds and audit trails .

Posted 10/23/2026full-timeHatfield • United KingdomLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in defining security architecture for AI agents, managing AI-specific risks, and leading incident response strategies. Proficient in applying frameworks like NIST AI Risk Management and maintaining ISO 27001 certification while fostering a culture of safe AI adoption.

Highest-signal resume keywords

Security Architecture DefinitionAI Risk ManagementIncident Response LeadershipCloud Security ExpertiseAI Governance Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Identity ManagementAuthentication ProtocolsData Leakage PreventionVulnerability PrioritizationAI Model Risk ManagementAgent OrchestrationCode ReadingAutomation in SecurityThird-Party Risk AssessmentIncident Management

Soft Skills

Collaborative WorkDecision-Making Under UncertaintyPragmatic Risk-Based ApproachCommunication with ExecutivesTeam Development

Tools & Technologies

AI AgentsMCP ServersAI-Enabled SaaSISO 27001NIST AI Risk Management FrameworkContinuous Control MonitoringSecurity Budget ManagementVendor Portfolio Management

Certifications & Qualifications

CISSPCISM

Industry Keywords

AI EthicsData ProtectionPrivacy RegulationsAdversarial TestingRed TeamingBoard ReportingRegulatory ComplianceEmerging Standards for AI

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Define the security architecture for AI agents, including identity, authentication, least-privilege tool access, sandboxing, action approval thresholds and audit trails
Set policies and controls for AI-specific risks including prompt injection, data leakage, model and supply chain compromise, tool and plugin abuse, and over-permissioned agents
Govern assessment and approval of third-party models, MCP servers, connectors and AI-enabled SaaS
Work with Engineering, Data and Legal on safe-by-default AI patterns
Redesign the security operating model so agents handle first-line work such as alert triage, vulnerability prioritisation, access reviews, phishing analysis, policy questions and control testing
Measure security outcomes including time to detect, time to remediate and risk reduced per head
Build and maintain human oversight, escalation paths, agent performance evaluation and accountability for automated decisions
Hire, develop and retain security staff who supervise and improve agent-driven workflows
Anticipate AI-enabled adversary tactics and adapt defences
Lead AI-aware red teaming, adversarial testing and incident response exercises
Own incident response end to end, including communication with the Board, regulators, customers and press
Own the information security strategy, risk register and Board reporting
Maintain ISO 27001 certification and alignment
Apply the NIST AI Risk Management Framework and UK GDPR obligations
Automate evidence collection and continuous control monitoring
Partner with the DPO and General Counsel on data protection, privacy and AI ethics
Advise executives and the Board on technical and AI risk
Build a culture of safe AI adoption
Manage the security budget and vendor portfolio

Requirements

What you’ll need

Substantial experience leading security at a senior level (CISO, Deputy CISO or equivalent) in a complex, fast-moving organisation
Hands-on understanding of how LLMs and agentic systems work, including how they fail and are attacked
Detailed knowledge of tool use, context and memory, agent orchestration and guardrails
Evidence of using AI and automation to change how a security team operates
Strong grounding in cloud, identity, application and data security, detection and response, and third-party risk
Experience reporting to Boards and regulators
Experience managing a major incident
Pragmatic, risk-based approach
Ability to read code and challenge technical designs
Experience with AI governance, model risk management or responsible AI programmes
Familiarity with emerging standards for agent identity, authorisation and interoperability
Professional qualifications such as CISSP, CISM or equivalent are valued but not required
Ability to work collaboratively with product and engineering teams
Ability to make and explain decisions under uncertainty
Comfortable owning outcomes, including when an agent gets it wrong

Benefits

Comp & perks

Private medical insurance with option to add your family
Digital GP appointments
Market-leading family policies
Mental health support
Discounted gym memberships
Dental insurance
Annual bonus scheme split between personal and business objectives
Recognition with reward platform
Up to 7% matched pension contributions
15% Ocado discount
20% M&S discount
Free breakfast every day in the office
Electric vehicle leasing scheme
Free shuttle bus from Hatfield station to the office
Hybrid working
26 days holiday plus 8 flexible bank holidays
Options to buy extra holiday
2 weeks work from anywhere
Lifestyle break opportunities
AI Academy learning journey
Professional growth and career development opportunities