Interim CISO services
Hire an interim CISO for the vacancy
An interim CISO is a full-time, fixed-term security leader who takes accountability for information security when the seat is empty or the risk will not wait: after a breach, ahead of an audit or certification, during a move to a new framework, or while a permanent CISO is found.
We scope the mandate with you in fifteen minutes and come back with a shortlist of three to five, each with day rate, availability and IR35 position set out.
- Shortlist of 3–5
- Day rate, availability and IR35 on each
- Published rate bands
- Fixed-term, full-time mandates
How a brief runswhat we undertake
- 01Brief30-MINUTE SCOPING CALLDay 0
- 02Shortlist of 3–5VETTED · RATE BENCHMARK · IR35After the brief
- 03InterviewsYOU MEET THE SHORTLISTYour diary
- 04Scoped startFIRST-MONTH OUTCOMES AGREEDYou set the date
- 05Fractional, interim and permanentIR35 POSITION SET OUTOn every brief
Shortlist3–5
15 minutes · video or phone
Book 15 minutes to scope the mandate
Tell us the situation, the days and the start date. We come back with interim CISO candidates, their day rates and availability.
- 0115 minutes, video or phone
- 02We scope the assignment
- 03A shortlist of 3–5 after the call
- 04Fractional, interim, part-time and permanent briefs
Pick a day that suits · live availability
On the board · last 3 months
Interim CISO and security roles on the board
No Interim CISO and security roles on the board in the last three months. Showing fractional and contract security roles instead — each card says what it is.
Looking? Build your repo once on Fractional Quest and every role on the board is read against it.
Sign up now →01/ definition
What an interim CISO actually does
An interim CISO holds accountability for information security for a defined term.
That means owning the risk picture the board sees, leading the security team and its suppliers, and making decisions that cannot wait for a permanent appointment.
The mandate has a reason and an end date, and a good interim leaves behind a clearer risk register, a working programme and a successor who can pick it up.
COVER
Holds accountability while you search
The CISO leaves, or the role sits with an overstretched IT lead. The interim takes the risk register, the security team and the board reporting so that nothing important drifts during the permanent search.
Holds accountability while you search. The CISO leaves, or the role sits with an overstretched IT lead. The interim takes the risk register, the security team and the board reporting so that nothing important drifts during the permanent search.
Leads security through and after a breach. An incident has happened or is still running. The interim works with the response team, insurers, regulators and the board, then turns the lessons into a funded remediation plan.
Gets the business ready to be examined. A certification, a customer audit, a regulator’s questions or a due-diligence request. The interim closes the gaps that matter, gathers the evidence and stands behind the answers.
Moves the organisation to a new security model. A new framework, a cloud migration, a merger of two IT estates or a new outsourced security provider. The interim designs the target, sequences the move and keeps risk visible while it happens.
Gives the board a security picture it can act on. Directors are accountable for cyber risk but often lack a clear view of it. The interim builds reporting the board can understand and decide on, and sets out the permanent role it needs.
02/ scope
What the CISO owns on a mandate
Agree the boundaries early.
Security cuts across IT, legal, HR and suppliers, and an interim without a clear remit spends the term negotiating it.
- The information security risk register and risk appetite proposal
- The security programme, budget and roadmap during the term
- Incident response leadership and post-incident review
- Board and audit committee security reporting
- Security policy, standards and the control framework
- Third-party and supplier security assurance
- The hand-over to the permanent CISO
- Day-to-day security operations monitoring (to the SOC or provider)
- Infrastructure changes (to IT and engineering)
- Legal advice and regulator correspondence drafting (to counsel)
- Penetration testing (to accredited testers)
- Data protection officer duties, unless agreed in writing
03/ which model
Interim, fractional or permanent?
Move the slider to the days the security seat needs and choose how long.
Four or five days on a fixed term is interim.
A day or two a week of senior security oversight, open-ended, is a fractional arrangement — our parent company, a fractional recruitment agency, searches for both and for permanent CISOs.
The model that fits · CISO
Interim
A full-time or near full-time leader on a fixed-term mandate — a gap, a turnaround, a transaction — who hands over at the end.
Book a call about an interim CISO →Our framing, not a measured rule: the lines between the four models blur, and many briefs could run two ways.
04/ alternatives
The CISO seat against the alternatives
Each option answers a different question: who is accountable, how quickly, and for how long.
→ Interim when accountability cannot wait; permanent when the role and the programme are settled.
05/ rates
Interim CISO day rates
Published bands only, each with its source named.
Enter a day rate you have been quoted to see where it sits.
- Interim CISO£1,000–£1,500Barclay Simpson
- Fractional CISO£1,200–£2,000Optima Europe
- Permanent CISO (salary ÷ 220 days)£438–£735Robert Half 2026 salary ÷ 220 days
Bands are as each source publishes them; permanent day equivalents are the salary band ÷ 220 working days, our arithmetic. Recruiter guides are named, not linked. Rates vary with sector, scope and location.
06/ calculator
What an interim CISO costs
Model a fixed-term interim CISO against a permanent Chief Information Security Officer over the same period.
£1,250 a day is within the published CISO band (£1,000–£1,500, Barclay Simpson).
Interim cost for the term
£162,500
130 working days · 5 d/wk · 6 mo · before tax
Interim costs more over 6 months£44,156
Interim CISO, the term£162,500
Permanent CISO, same period£118,344
Interim CISO, the term$215,296
Permanent CISO, same period$156,794
Converted from £ at $1.3249 per £1 (Bank of England spot rate), 2 Oct 2026. A conversion, not a US market rate. Source ↗
Interim CISO, the term€190,873
Permanent CISO, same period€139,007
Converted from £ at €1.1746 per £1 (Bank of England spot rate), 2 Oct 2026. A conversion, not a EU market rate. Source ↗
Our arithmetic, indicative. Permanent = the £135,250 Robert Half 2026 median salary pro rata for the same months, plus 15% employer NI, plus a 30% search fee on the annual base (UK retained search runs 25–35%, Headhunters.co.uk). Excludes pension, bonus and equity.
07/ decision
When to bring in interim security leadership
Most interim security mandates begin in one of four situations.
If one sounds like your next board meeting, an interim is worth a conversation.
Which sounds like you?
A resignation or sudden exit leaves the security team without a leader and the board without a risk owner. An interim takes accountability quickly, keeps the programme moving and gives the permanent search time to find the right person.
- → Departure at short notice
- → Board or audit committee reporting due
- → No internal successor ready
A ransomware attack, a data breach or a near miss has shown the board how much depends on security. The interim leads recovery alongside the response team, handles the conversations with insurers and regulators, and turns the review into a plan the board can fund.
- → Recent or ongoing incident
- → Regulator or insurer questions
- → Remediation plan not yet owned
A new standard to certify against, a new outsourced provider, a cloud migration or two IT estates to merge after a deal. An interim CISO who has led the same transition designs the target state, sequences the move and keeps the board informed of the risk while it happens.
- → Certification or framework deadline
- → Change of security provider
- → Merger or migration under way
Security questionnaires are slowing sales, an investor’s due diligence has flagged cyber risk, or a major customer wants an audit. The interim closes the material gaps, gathers evidence and answers with authority.
- → Deals stalled on security review
- → Diligence findings to close
- → Audit or assessment booked
08/ tax and IR35
How an interim CISO is contracted
General position under UK rules, with the HMRC source for each point. Not tax advice — check your own case with your accountant.
01 · DEDUCTIBLE
Fees are a business expense
Fees, like a salary, are deductible against profits when incurred wholly and exclusively for the trade (HMRC BIM37000), with corporation tax at the 25% main rate.
02 · WHO DECIDES
Status turns on how the work runs
Medium and large clients make the off-payroll status determination themselves; for a small private-sector client, the interim’s own company does (HMRC off-payroll guidance).
03 · WHAT HMRC LOOKS AT
Substitution, control, mutuality
Whether a substitute could genuinely be sent, who decides how the work is done, and whether either side must offer or accept further work. HMRC’s CEST tool walks through the same questions.
09/ guide
Interim CISO services: a practical guide
Interim CISO services fill a seat that boards increasingly understand they cannot leave empty.
Directors are accountable for cyber risk, and the NCSC’s Cyber Security Toolkit for Boards is built around the idea that the board should be able to discuss and decide on that risk, not only receive reports about it.
When the CISO leaves, or the role was never filled, an interim gives the board someone to hold accountable while the permanent appointment is made.
Start the brief with the situation and the outcome.
"Cover the role" invites any security leader.
"Lead recovery from the incident, close the audit findings by year-end and hand over to a permanent CISO" tells you what kind of interim you need: an incident leader, an assurance specialist, a transformation lead or a steady pair of hands for a vacancy.
Decide the intensity next.
Most interim CISOs work four or five days a week on a fixed term.
If what you need is a few days a month of senior security oversight, a virtual or fractional CISO may fit better and cost less over a year.
We search for both, and for permanent CISOs when the seat is ready to fill for good.
Compare cost like for like.
An interim is paid a day rate for the days worked; a permanent CISO carries salary, employer National Insurance, pension, bonus and usually a search fee.
The calculator above runs both on published figures.
For an incident or a transition of a few months, an interim is often the cheaper route to the same outcome.
Give the interim real authority.
They need a seat at the executive table, a clear line to the board or audit committee, and the right to stop changes that create unacceptable risk.
Agree those rights, and the budget they control, before the first day.
Our interim management agency page explains how we run the search itself.
Plan the hand-over from the start.
A good interim mandate ends with an updated risk register, documented decisions, a funded roadmap and, ideally, a permanent CISO who overlaps with the interim before they leave.
If the incident is still live, the NCSC’s incident management guidance is a useful common reference for the board and the interim.
10.1/ how to hire
How to hire an interim CISO step by step
Hiring an interim CISO runs in five steps.
Write a one-page brief with the situation, the outcome and the term.
Decide the days a week and set a budget against published day-rate bands.
Brief one search partner, so candidates hear one consistent account of a sensitive situation.
Interview a shortlist of three to five.
Contract on clear terms, including confidentiality and, where you are a medium or large company, the status determination.
On IR35: medium and large clients decide the interim’s status and give them a status determination statement — see HMRC’s off-payroll working guidance.
For small clients the interim’s own company decides.
Status turns on how the engagement runs in practice.
What to put in the brief
The situation in two lines, the outcome by the end of the term, the start date, days a week, sites, reporting line, size of the security team and providers, the frameworks or certifications in scope, any live incident, and the decisions the interim can take alone.
How to test candidates
Ask each one to walk through a mandate like yours: what they found, which risks they escalated first, how they reported to the board and who they handed over to.
Then call that person.
References we take ourselves are part of every shortlist.
10.2/ ciso recruitment
CISO recruitment: interim, permanent or both
CISO recruitment is often two searches at once.
The business needs someone accountable now and a permanent leader for the long run, and the two briefs are rarely identical.
An interim can hold the seat, reshape the role from the inside and help you write a better permanent brief than you could have written on day one.
We run CISO recruitment for interim, fractional, part-time and permanent appointments.
For each search we scope the brief with you, search and screen against it, and come back with a shortlist of three to five, each with pay or day rate, availability and the reasons we think they fit.
Permanent CISO searches are run through our parent company’s fractional executive search firms practice.
Whoever you hire, judge them on evidence.
A CISO candidate should be able to show the risk reporting they gave a board, the incidents they led, the frameworks they took an organisation through and the team they built.
We test those claims against the brief and take references ourselves before anyone reaches your shortlist.
Specialist security staffing firm or executive search with interim capability?
A specialist security staffing firm usually knows the technical contractor market well and can fill hands-on roles quickly.
An executive search firm with interim capability is usually better at board-level leadership: scoping an accountable role, testing candidates on governance and stakeholder handling, and running the permanent search alongside.
For an interim CISO who must report to the board, the leadership test matters more than the technical depth alone.
10.3/ the consultant route
Cyber security interim consultant or the full CISO seat?
A cyber security interim consultant is usually brought in for a defined piece of work: a gap assessment, a policy rewrite, readiness for a certification, or a technical review after an incident.
An interim CISO takes accountability for security as a whole, leads people and reports to the board.
The titles overlap, but the authority does not.
Where the wider technology seat is also empty, see our interim CTO and CIO guide.
If you need a specific deliverable and someone else already owns the risk, a consultant is often the right choice.
If nobody owns the risk, or the board needs one person to answer to, hire at CISO level.
For organisations running essential services, the NCSC Cyber Assessment Framework is a common structure for scoping either kind of engagement.
10.4/ for executives
Interim CISO jobs and how to find them
Interim CISO jobs are often filled through direct approaches before they are widely advertised.
The board above reads the Fractional Quest pipeline daily and labels every role honestly.
Our parent site lists interim CISO jobs, and the interim jobs board covers every interim seat.
Most interim CISOs work through their own limited company.
Keep your day rate, notice period, clearances, certifications and the situations you have led — incidents, audits, transitions — current, because that is what a hiring board reads first.
10/ process
How we run the search
What we undertake on every brief, run by Fractional Quest, our parent company.
- 01
Brief
A scoping call on the role, the days a week, the start date and what the interim CISO must have delivered.
DAY 0 - 02
Search
We search and screen against that brief: track record at your stage, in your situation, and references we take ourselves.
SCREENING - 03
Shortlist
Three to five candidates, each with day rate or salary, availability and IR35 position set out.
SHORTLIST OF 3–5 - 04
Start
You interview and choose. The executive you choose contracts with you.
YOU CHOOSE
11/ the family
Security and technology leadership across Fractional Quest
Interim Quest is part of Fractional Quest.
When the brief is part-week, permanent or a wider technology seat, these pages cover it.
How executive search for senior hires is run, and how to choose a firm.
Fractional, interim, part-time and permanent executive search in one firm.
12/ questions
Questions, answered
For hiring managers, and for executives looking for the role.
Book 15 minutes · shortlist of 3–5
Start with the brief.
Fifteen minutes to scope the seat, the days and the start date.