Chief Information Security Officer
Ocado Retail · Hatfield, United Kingdom · hybrid
Chief Information Security Officer
Contract type: Permanent
Location: Hatfield (Hybrid working - 3 days in the office)
Working hours per week: 40 hours
Reports to: Chief Data and Technology Officer
Application Closing Date: 2nd November 2026
About us
Our mission is to deliver joy in every shop, through unbeatable choice, unrivalled service, and reassuringly good value. We’re also on a mission to empower our business with smart technology; we've recently launched our AI Academy, providing a tailored AI learning journey for every colleague.
We’re Ocado Retail, a market-leading joint venture between Ocado Group and M&S, and the world’s largest dedicated online supermarket, ocado.com. Not only is Ocado the only place to shop a full range of M&S food online, it’s also the home to the widest online supermarket range in the UK and a champion of small, independent brands. We’re also the brains behind Zoom by Ocado, our same-day grocery delivery service.
About the team and the role
We are building a company where people and AI agents work side by side. Agents will write code, handle customer queries, move data, and take actions in our systems, so the security model has to change with them.
We are looking for a CISO who treats AI as both the biggest new attack surface and the biggest opportunity to transform security itself. You will run a security function where agents do much of the routine work (triage, detection, investigation, compliance evidence) and humans focus on judgement, strategy, and risk. You will also define how we securely adopt AI and agents across the whole business.
What you’ll do
Security for an agentic enterprise
- Define the security architecture for AI agents: identity and authentication for non-human actors, least-privilege tool access, sandboxing, action approval thresholds and audit trails.
- Set policies and controls for AI-specific risks, including prompt injection, data leakage, model and supply chain compromise, tool and plugin abuse, and over-permissioned agents.
- Govern how third-party models, MCP servers, connectors and AI-enabled SaaS are assessed and approved.
- Work with Engineering, Data and Legal on safe-by-default patterns so teams can ship AI features quickly without creating unmanaged risk.
An AI-native security function
- Redesign the security operating model so agents handle first-line work: alert triage, vulnerability prioritisation, access reviews, phishing analysis, policy questions and control testing.
- Measure the function on outcomes (time to detect, time to remediate, risk reduced per head) rather than headcount or ticket volume.
- Build and maintain the human oversight layer: clear escalation paths, evaluation of agent performance, and accountability for automated decisions.
- Hire, develop and retain people who can supervise and improve agent-driven workflows.
Threat readiness in an AI-accelerated landscape
- Anticipate adversaries using AI for faster reconnaissance, convincing social engineering, deepfakes and automated exploitation, and adapt defences accordingly.
- Lead AI-aware red teaming, adversarial testing of our own models and agents, and incident response exercises that include agent-related scenarios.
- Own incident response end to end, including communication with the Board, regulators, customers and the press.
Governance, risk and compliance
- Own the information security strategy, risk register and board reporting.
- Maintain certification and alignment to ISO 27001 as the core security management framework.
- Apply the NIST AI Risk Management Framework and UK GDPR obligations to how we build, buy and deploy AI systems and agents.
- Automate evidence collection and continuous control monitoring wherever possible.
- Act as a trusted partner on data protection, privacy and AI ethics alongside the DPO and General Counsel.
Leadership and influence
- Be a credible voice at executive and Board level, translating technical and AI risk into business decisions.
- Build a culture where security enables speed, and where employees are confident using AI tools safely.
- Manage the security budget and vendor portfolio with a bias towards consolidation and automation.
What success looks like in the first 12 months
- A clear AI and agent security strategy, approved by the executive team and Board.
- An inventory of every AI system and agent in use, with owners, permissions and risk ratings.
- Agent identity, access and audit controls live for all production agents.
- At least [three to five] core security workflows run largely by supervised agents, with measurable improvements in speed and quality.
- An AI-aware incident response plan, tested through a live exercise.
- A hiring and development plan for the team you need in an AI-first environment.
Who you are
Essential
- Substantial experience leading security at a senior level (CISO, Deputy CISO or equivalent) in a complex, fast-moving organisation.
- Hands-on understanding of how LLMs and agentic systems work, and of how they fail and are attacked. You should be able to discuss tool use, context and memory, agent orchestration and guardrails in detail.
- Evidence that you have used AI and automation to change how a security team operates, not just bought AI-branded tooling.
- Strong grounding in modern security disciplines: cloud, identity, application and data security, detection and response, and third-party risk.
- Experience reporting to Boards and regulators, and managing a major incident.
- A pragmatic, risk-based approach that enables the business to move fast.
Desirable
Background in engineering or security engineering, with the ability to read code and challenge technical designs.
- Experience with AI governance, model risk management or responsible AI programmes.
- Familiarity with emerging standards for agent identity, authorisation and interoperability.
- Professional qualifications such as CISSP, CISM or equivalent (valued, not required).
How you work
- Curious and hands-on: you use these tools daily and stay current as the field changes.
- Clear under uncertainty: you can make and explain decisions where best practice does not yet exist.
- Collaborative: you partner with product and engineering rather than policing them.
- Accountable: you are comfortable owning outcomes, including when an agent gets it wrong.
What’s in it for you
By joining Ocado Retail, you’ll have the chance to experience life at the world’s largest online retailer, work with an amazing bunch of people who challenge what’s possible each day, and grow your skills and career in online retail. You'll also be part of our AI Academy, a dedicated learning journey designed to empower every colleague with the smart technology skills of the future.
If that’s not enough to tempt you, you’ll also get access to loads of great benefits to sweeten the deal. Here’s a taste of what we offer:
Health & Wellbeing: Private medical insurance with option to add your family, Digital GP appointments, market-leading family policies, mental health support, discounted gym memberships, dental insurance, and more.
Spend & Save: Annual bonus scheme split between personal and business objectives, recognition with reward platform, up to 7% matched pension contributions, 15% Ocado discount, 20% M&S discount, free breakfast every day in the office, electric vehicle leasing scheme, and free shuttle bus from Hatfield station to the office.
Never miss the moments that matter: Hybrid working, 26 days holiday plus 8 flexible bank holidays, options to buy extra holiday, 2 weeks work from anywhere, and lifestyle break opportunities.
Our Hiring Process
We receive a high volume of applications and genuinely appreciate the time and effort every candidate invests. To ensure a fair and thorough process, every application is reviewed by a member of our team. If your skills and experience are a strong match, a Talent Partner will contact you to discus