What is a fractional CISO for financial services?

A fractional CISO for financial services is an experienced security leader who carries the chief information security officer mandate for a regulated firm on a part-time, ongoing basis. They own the security strategy, set risk appetite with the board, run the control framework, and act as the named senior person regulators and auditors can point to, without the firm paying for a full-time executive. For banks, brokers, asset managers, payment firms, lenders and insurers, the role sits at the meeting point of operational resilience, financial crime controls and information security. It is the same engagement model as a virtual CISO or CISO as a service, applied to the specific demands of a regulated balance sheet.

The regulatory pressure financial firms actually face

Financial services is one of the most heavily supervised sectors in the UK, and security is now squarely a supervisory matter. The FCA and PRA treat cyber as an operational resilience question: firms must identify important business services, set impact tolerances, and prove they can stay within them through a severe but plausible disruption. The Bank of England, FCA and PRA operational resilience regime expects this to be evidenced, not asserted. Firms in scope of DORA for EU-facing operations, those handling card data under PCI DSS, and any firm processing personal data under UK GDPR all carry overlapping obligations that a security leader has to reconcile into one coherent programme.

Then there is the SYSC framework, third-party and outsourcing risk under the FCA’s expectations, and the senior managers regime, which makes individual accountability for technology and security risk explicit. A fractional CISO maps these obligations to controls, sits across the firm’s cyber security for financial services posture, and gives the SMF holder the evidence base they need to sign off honestly. Where the EU’s NIS2 regime touches a group’s operations, the same leader keeps your NIS2 compliance aligned with the UK picture rather than running it as a separate workstream.

The risks that are specific to this sector

Financial firms are targeted because that is where the money and the data are. The threat is concentrated and professional: account takeover and authorised push payment fraud, ransomware aimed at trading and settlement systems, business email compromise on payment instructions, and supply chain compromise through the long chain of fund administrators, custodians, payment processors and SaaS vendors that a modern financial firm depends on. The IBM Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million, and financial services consistently sits above that average because of regulatory cost, client redress and the reputational damage of a public failure.

The regulatory consequences are real and documented. The ICO fined British Airways £20 million in 2020 after a breach exposed customer payment data, and fined Interserve £4.4 million in 2022 for failing to keep personal data secure. For a financial firm, a comparable event carries FCA scrutiny on top of the data protection penalty, and the loss of client trust is harder to price than either. A fractional CISO builds the control environment that keeps you out of that position, and the ransomware readiness and incident response plan that limit the damage if something does get through.

What the role genuinely needs to deliver

A financial firm does not need a security leader who writes policies and disappears. It needs someone who can do the following, and be measured on it.

• Set risk appetite with the board and translate it into a control framework that auditors and the FCA recognise.
• Own operational resilience for the security domain: impact tolerances, scenario testing, and recovery you can actually execute.
• Manage third-party and outsourcing risk across the firm’s vendor and intra-group dependencies.
• Run a credible incident response capability and rehearse it with the executive team, not just the IT function.
• Give the senior manager accountable for technology a defensible, evidenced position when regulators ask.

This is leadership work, not tooling work. It connects to the firm’s wider IT strategy and, increasingly, to how the firm governs artificial intelligence. As trading, underwriting and client-service teams adopt AI tools, a fractional CISO sets the guardrails through proper AI governance and brings shadow AI back under control before it becomes a data leakage or model risk problem.

The commercial case against a permanent hire

A full-time CISO in UK financial services is expensive and hard to recruit. A UK CISO salary runs roughly £95,000 to £600,000 or more depending on firm size and sector, before employer costs, equity and the recruitment time to fill a scarce senior role. For a mid-market firm, a boutique asset manager, a payments business or a growing lender, that is more capability than the risk profile demands and more cost than the budget supports. The honest answer for many firms is that they need senior security ownership for one or two days a week, not five.

A fractional model gives you the seniority where it matters and scales the time to the firm’s actual needs. You get a leader who has carried the accountability before, working at the cadence your risk profile justifies. If you want to see how the numbers compare for your firm, the CIO and CISO cost calculator and the published pricing set out the difference plainly. For firms that also need technology leadership, the combined fractional CIO and CISO engagement covers both mandates under one accountable person.

How a fractional CISO works in a regulated firm

The engagement starts with an honest assessment of where the firm stands against its regulatory obligations and its real threat exposure, not a generic maturity score. From there the fractional CISO builds a prioritised programme: close the control gaps that carry regulatory and financial weight first, then improve the slower-moving foundations. They attend the relevant board and risk committee meetings, own the security reporting line, and act as the firm’s point of contact for auditors, regulators and the firm’s own clients during due diligence.

This is deliberately not a project that ends. Security in a regulated firm is a standing capability, and the value of a fractional leader is continuity: the same person who set the risk appetite is the one who tests it, reports on it, and adjusts it as the firm and its obligations change. For firms acquiring or being acquired, the same leader runs the technology due diligence that surfaces security risk before it becomes a price chip or a post-deal surprise. Boards that want an independent read on whether they are governing cyber properly can start with a structured board cyber governance review.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

That experience of carrying both the technology and security mandate inside large, private-equity-backed and regulated-adjacent organisations is exactly what a financial firm needs from a fractional CISO: someone who has answered to boards, owned risk personally, and built control environments that stand up to outside scrutiny. For a fuller view of the engagement model, see what is a vCISO, the broader cyber security consulting offer, and the vCIO service for firms that need technology leadership alongside security.

Frequently asked questions