Job overview
The Chief Information Security Officer is a senior Group leadership role within Group Digital Services, accountable for leading a coherent, resilient and risk-based cyber security function across the UHL Group.
The postholder will provide strategic leadership for cyber security, digital assurance and security governance, ensuring that the Group’s digital estate, information assets and critical services are protected in a way that supports safe, effective and sustainable care delivery. The role will operate within the group-wide Digital TOM, where cyber security, information governance and digital risk management are brought together through a unified assurance framework to reduce variability, strengthen resilience and ensure compliance with national standards.
Working across the UHL Group’s multi-site environment, the postholder will translate national policy, strategic ambition and technical assurance requirements into practical controls, operating models and leadership behaviours that enable digitally enabled transformation. The role will support the UHL Group’s five-year ambition to make best use of digital and data, contribute to the analogue-to-digital shift described in the national 10-year plan, and ensure that innovation, interoperability, patient trust and clinical safety are underpinned by robust cyber resilience, secure digital design and proportionate assurance.
Advert
The CISO will establish a Group-wide cyber and information governance framework for the UHL Group. You will shape cyber strategy, define risk appetite, influence investments, and interface directly with boards to embed security, resilience, and compliance into all digital service delivery. This includes delivering comprehensive cyber assurance, information governance, and digital risk management while ensuring strict compliance with DSPT, GDPR, and Cyber Essentials Plus.
To succeed, you must translate these expectations into a robust operational capability. This involves leading incident response, forensic activity, privacy assessments, access controls, and breach investigations, ensuring clear accountability across all sites. Crucially, you will need to align with the UHL Group Target Operating Model by balancing Group-wide security standardisation with practical, locally responsive solutions tailored to individual hospitals and services.
Ultimately, success depends on building trusted relationships with clinical and operational leaders so that security is viewed as a core enabler of safe care rather than a barrier. By protecting patient confidentiality and fostering trust, the role directly supports the UHL Group’s five-year analogue-to-digital transformation, enabling the secure rollout of the single patient record, seamless data sharing, interoperability, and future AI adoption.
Working for our organisation
NHS University Hospitals of Liverpool Group (UHL Group) was formed on 1 November 2024, born from a shared aim to improve the care we provide our communities.
We are one of the largest employers in region, with over 18,900 colleagues who are dedicated to caring for our communities - from birth and beyond.
For the 630,000 people across Merseyside, we are their local NHS. We provide general and emergency hospital care, alongside highly specialised regional services that extend to more than two million people in the North West.
We operate from five hospital sites: Aintree University Hospital is the single receiving site for adult major trauma patients in Cheshire and Merseyside, and hosts a number of regional services including an award-winning stroke facility. Broadgreen Hospital is home to several elective surgical, diagnostic and treatment services, together with specialist patient rehabilitation. Liverpool Heart and Chest Hospital provide specialist services in cardiothoracic surgery, cardiology and respiratory medicine, both in the hospital and out in the community. Liverpool Women’s Hospital specialises in the health of women and babies, delivering over 7,200 babies in the UK’s largest single site maternity hospital each year. The Royal Liverpool University Hospital is the largest hospital in the country to provide inpatients with 100% single en-suite bedrooms and mainly focuses on complex planned care and specialist services.
Detailed job description and main responsibilities
Lead the development and delivery of the UHL Group cyber security and information governance strategy
Establish and maintain a Group-wide digital assurance and risk management framework
Ensure compliance with national and regulatory standards for data protection and cyber security
Provide strategic leadership on cyber risk, resilience and incident response
Oversee the management of cyber threats, vulnerabilities and security incidents
Embed security and assurance into all digital programmes and services
Lead the development of policies, standards and procedures for cyber security and information governance
Provide expert advice and assurance to senior leaders and governance forums
Develop organisational capability and culture in cyber security and data protection
Manage relationships with external regulators, partners and assurance bodies
Please ensure you check the email account (including junk/spam boxes) from which you apply regularly as we will use this to contact you regarding your application.
Posts advertised to ‘internal staff’ are open to employees of hospitals within University Hospitals of Liverpool Group and you should confirm your employment within your application form.
Note: Under current Home Office Immigration Rules we are currently unable to offer right to work visa sponsorship for Band 2 and 3 roles with a salary of less than £25,000 pa as they do not meet the UK Visas & Immigration criteria.
Only those applicants who demonstrate clearly how they meet our person specification will be shortlisted for interview.
We reserve the right to close any vacancies from further applications when we have received a minimum number of applications from which to make a shortlist. Please ensure you apply without delay if you wish to be considered for this role.
Candidates applying for the role of Healthcare Assistant on the staff bank should note that due to the nature of the role, workers must be aged 18 or above when commencing in post. Applicants are therefore welcome from those aged over 18 or within 3 months’ of their 18th birthday.
The Trust is committed to promoting a healthy work-life balance and achieve fair, equitable and consistent practice. We welcome flexible working requests and will consider a variety of flexible working arrangements from day one of your employment. Not all roles are suitable for every flexible working opportunity all of the time. Flexible working options may include reduced hours, compressed hours, fixed shifts, time back in lieu and home working.
The Trust is committed to promoting equality and diversity; we value the contribution of individual talent, skills, knowledge and experience and aim for a workforce demography representative of the local community. We encourage applicants from the following groups that are currently under-represented in our workforce black, Asian and minority ethnic, lesbian, gay, bisexual and Transgender (LGBTQ+), disabled, male and age 16-24.
Trust policy requires that the cost of submitting & processing the successful applicant/s DBS application be recovered via salary deduction following start in post. The amount of £25.70 (standard disclosure) or £46.70 (enhanced disclosure) will be deducted from salary, in manageable monthly instalments for up to 3 months following commencement of employment. Bank posts require upfront payment.
From April 2017, Skilled visa applicants and their adult dependant(s) will be required to provide a criminal record certificate from each country they have lived in consecutively for 12 months or more in the past ten years.
Applicants requiring sponsorship may wish to determine the likelihood of obtaining sponsorship for this position by assessing themselves against the criteria on the gov.uk website - https://www.gov.uk/check-uk-visa.
This organisation has a zero-tolerance approach to the abuse of children, young people and vulnerable adults. All staff must ensure they adhere to the organisations safeguarding children and adults’ policy and comply with the Local Safeguarding Children and Adult Board procedures.
Staff should be mindful of their responsibility to safeguard children and adults in any activity performed on behalf of the organisation in line with the requirements of statutory guidance and legislation.
All employees (and volunteers)are expected maintain their safeguarding knowledge and skills by completing mandatory safeguarding training which includes understanding and recognising the signs of abuse and neglect and taking appropriate action.
As an organisation, we have adopted the Merseyside Domestic abuse workplace scheme which supports our staff who are experiencing Domestic Abuse /any forms of sexual violence.
If you have any personal requirements that will enable you to participate in our recruitment process please contact a member of the Recruitment Services by phone on 0151 706 4666 at the earliest opportunity to ensure that measures can be put in place to enable your application for this post.
Our statement on modern slavery
We have zero tolerance of slavery and human trafficking and are committed to maintaining and improving systems, processes and policies to avoid complicity in human rights violation and to prevent slavery and human trafficking in our supply chain.
The Trust policies, procedures, governance and legal arrangements are robust, ensuring that proper checks and due diligence are applied in employment procedures to ensure compliance with this legislation. We also conform to the NHS employment check standards within our workforce recruitment and selection practices. This strategic approach incorporates analysis of the Trust’s supply chains and its partners to assess risk exposure and management on modern slavery.
Please note: new entrants to the NHS will commence on the first pay point of the relevant band.