How to hire a CISO in the UK, fractional or full time

Hiring a fractional CISO in the UK takes seven steps: write the gap down, set the budget from the published day-rate band, check fractional is the right shape, shortlist people who have held the seat at your stage, interview with the six questions below, agree the day-ninety markers in writing, and contract the days and the IR35 position. Most companies go from brief to signed contract in about two weeks. To skip the reading and meet people, hire a fractional CISO from the seat page.

UK day rates for the seat run £900 to £1,500. All eleven seats compared →

Fractional or full time: which CISO hire you need

A fractional CISO costs £900 to £1,500 a day, usually two days a week, which is £6,900 to £11,500 a month with no employer costs. A full-time CISO is a salary plus employer National Insurance and pension, and a retained search adds 25 to 33 per cent of first-year earnings. Fractional fits two or three days of judgement; full time fits five days of leadership.

Three ways to hire a CISO, compared
Route	Cost basis	Time to start	Commitment	Best for
Fractional	£900 to £1,500 a day; £6,900 to £11,500 a month at two days	Met within days, starting in one to three weeks	One to three days a week, usually a month's notice	Owning the CISO decisions two or three days a week
Interim	£17,250 to £28,750 a month at 5 days	Weeks rather than months	Full time for a fixed term, typically 3 to 9 months	Cover for a departure, a transaction or a turnaround with an end date
Full-time search	A salary plus employer costs, and 25 to 33 per cent of year one as the search fee	eight to twelve weeks of search, then three to six months of notice	Permanent and employed, five days a week	A five-day seat that is certain to be permanent

The difference between the three routes is set out in full on fractional versus interim versus full-time, and hiring a full-time executive covers the permanent route.

Hiring a fractional CISO in seven steps

Write the gap down. Name the two or three things a fractional CISO must own in the first quarter, and how many days a week that is. Name the forcing event: which deal, which certification, which regulator, and the real deadline. Fractional CISOs plan and price around the trigger, and a brief without one reads as a seat with no mandate. Below ↓
Set the budget from the published band. UK fractional CISO day rates run £900 to £1,500 in 2026. Two days a week is £6,900 to £11,500 a month, with no employer costs on top. Fractional CISO cost →
Check fractional is the right shape. A fractional CISO is two or three days a week for a year or more. If the need is five days for six months, or the seat is a full-time job already, interim or permanent fits better. Below ↓
Shortlist people who have held the seat at your stage. Read track records, not titles. The right operator has been the CISO at a company of your size and stage before, and says what happened there in numbers. Browse the bench →
Interview with the six questions. Every question asks for something that happened. An operator who has held the seat answers from memory; one who has advised from the sidelines answers in the abstract. Below ↓
Agree the day-ninety markers in writing. Put the day-ninety outcomes in the brief before they start. A risk register exists in business language, with named owners, and the top five risks are each either mitigated or formally accepted by you in writing. Explicit acceptance is the test that the register is real. Below ↓
Contract the days, the notice period and the IR35 position. Fix the days a week, a notice period of a month, who owns the output, and the IR35 determination. Then set the start date and the first ninety-day review. IR35 for fractional executives →

What the seat covers is on the fractional CISO page. The rest of this page is the part that usually goes unwritten: the interview, day ninety, and when this hire is the wrong answer entirely.

Where to find a fractional CISO in the UK

Four routes work, and most companies use two of them at once. Whichever finds the person, the shortlist test is the same: they have held the seat at a company of your size and stage before.

A platform or bench with the rate on the profile. The day rate is visible before the first call, which settles the budget conversation early. The UK fractional platforms, compared.
A search against a written brief. Somebody else runs the longlist and the first interviews and puts a shortlist in front of you. How Operator Search works.
Your investors, accountant or lawyer. They have seen fractional CISOs work at other companies and know which ones they would have back.
Other founders. A CISO who has done it at a company like yours is usually two introductions away. Ask what they would hire them for again, not whether they were good.

Six questions to ask, and what a strong answer sounds like

Every question here asks for something that happened, not something they believe. An operator who has genuinely held the seat answers from memory; one who has advised from the sidelines answers in the abstract, and the difference is audible within a minute.

1. Walk me through the last ISO 27001 or SOC 2 programme you ran end to end. What was the starting point, and how long did it really take?

Listen for: Strong answers describe the specific company's starting posture, the gap analysis, the stage one and stage two audits, and something that went wrong on the way. Weak answers describe the standard itself, which anyone can read, rather than a run they actually led.

2. An enterprise prospect sends a 300-question security questionnaire due Friday. What do you actually do first?

Listen for: You want triage: which answers are deal-killers, which honest no answers can carry a remediation date, and a call to the buyer's security team where useful. Anyone who suggests answering everything yes should end the interview; a false questionnaire answer is worse than a lost deal.

3. Tell me about a real incident you handled. What did the first hour look like, and who did you call?

Listen for: A specific incident with containment steps, a decision about the ICO's 72-hour reporting window, and what changed afterwards. If every example is a tabletop exercise, they have the theory but have never run one live, which matters at 2am.

4. What would you refuse to spend money on at a company our size?

Listen for: Strong answers name things: a 24/7 SOC, an enterprise SIEM, a full red team before the basics exist. A CISO who cannot name controls that are disproportionate for you will happily build a FTSE-100 programme on your seed-stage budget.

5. One of our critical vendors is a two-person startup. How do you handle their security review?

Listen for: Risk-based thinking: what data they touch, contractual controls, an exit plan, and an explicit written acceptance of the residual risk. A weak answer runs the same pass-or-fail checklist used for AWS, which either blocks the vendor pointlessly or waves them through blind.

6. In your last fractional engagement, who did you report to, and how did the board hear about security risk?

Listen for: The strong answer is CEO or board, with a short risk register in business terms and specific decisions asked of them. Reporting into IT and presenting tool dashboards is a sign they run projects, not risk.

Red flags

Arrives with a product shopping list before asking what data you hold and what a breach would actually cost you. Tooling first, risk second is the wrong way round and it gets expensive.
Promises a certification timeline before asking a single question about your current posture. Anyone offering ISO 27001 in six weeks unseen is selling a template pack, not a security programme.
Cannot explain a risk without acronyms. Half this job is talking to an enterprise buyer's procurement team and your board; if you cannot follow them in the interview, neither will the people who matter.
Every control they propose assumes a security team exists to run it. If they have never operated where engineering is four people and there is no one to delegate to, the programme will be designed for staff you do not have.

What day ninety should look like

Agree these before they start, in writing, in the brief. A fractional engagement without a ninety-day marker drifts into a retainer nobody remembers the point of.

A risk register exists in business language, with named owners, and the top five risks are each either mitigated or formally accepted by you in writing. Explicit acceptance is the test that the register is real.
The questionnaire that triggered the hire is answered and the deal unblocked, and a reusable answer library exists so the next one takes days rather than weeks.
An incident response plan is written and has been walked through once, even as a one-hour tabletop, and the certification path is scoped with dates, audit cost and a named auditor.

When a fractional CISO is the wrong answer

You are mid-breach right now. You need an incident response firm today, this week, on retainer terms, and a fractional CISO afterwards to make sure there is no second time.
You want hands on keyboards: endpoints configured, firewalls tuned, alerts watched. That is a security engineer or a managed provider, at well under £900 a day, and a CISO will subcontract it anyway.
Nothing external is forcing it: no sensitive data, no enterprise pipeline, no regulator. Cyber Essentials through your IT provider and sensible defaults cover you for now, and the £900 to £1,500 a day is better spent elsewhere.

If one of those is you, say so in a brief anyway and we will tell you straight. Sometimes the honest answer is interim or full-time.

What to put in a fractional CISO brief

Name the forcing event: which deal, which certification, which regulator, and the real deadline. Fractional CISOs plan and price around the trigger, and a brief without one reads as a seat with no mandate.
State the stack and who can implement: cloud provider, engineering headcount, whether anyone can action controls. A CISO with no hands to direct will either decline or quote separately for the doing, and it is better to know which before they start.
The thing founders forget: decide who can accept risk. If every accepted risk needs founder sign-off, say so in the brief, and commit to giving the operator direct access to whoever the enterprise buyer's security team wants to interrogate.

What the contract should cover

General guidance rather than legal advice: have the engagement letter read by somebody who acts for you. These are the clauses that cause the arguments when they are missing.

The days. How many a week or a month, whether they roll over, and the day rate or monthly figure that pays for them.
Notice. A month either way is the usual term, long enough to hand over and short enough that neither side is trapped.
Intellectual property. Who owns the models, documents and code the CISO produces. It should be the company, said in writing, because without a clause it may not be.
IR35. Whether the engagement is inside or outside, who made the determination, and the reasons. IR35 for fractional executives explains who carries the decision.

The rest, from confidentiality to conversion terms, is in what a fractional executive contract should say.

Common questions about hiring a fractional CISO

How quickly can a company hire a fractional CISO?

Faster than any other way of filling the seat. A request to a fractional CISO on the bench is accepted or declined within three days, and a brief to Operator Search returns a shortlist in five business days. A permanent CISO search runs eight to twelve weeks to an accepted offer and then a notice period of three to six months, which is why fractional cover is the normal bridge.

How many days a week should a fractional CISO be hired for?

Two is the most common arrangement and one to three is the working range. Below a day a week nobody can own a function; above three the seat has usually become a full-time one and the honest conversation is about converting. Start at the lower end and add a day when decisions begin queueing for the CISO's days.

What is the monthly cost of a fractional CISO two days a week?

At the 2026 UK band of £900 to £1,500 a day, two days a week over 46 working weeks comes to £6,900 to £11,500 a month, invoiced by the operator's own company with no employer National Insurance, pension or recruitment fee on top. Among the highest fractional rates, driven by certification work and regulated sectors.

Can a fractional CISO later become the full-time CISO?

Yes, and it is one of the better routes to a permanent hire because both sides have had months of working interview. Raise the possibility early so the operator can plan their other clients, agree a start date around their notice to those clients, and check the engagement letter for any conversion terms before the conversation.

What should a brief for a fractional CISO say?

The three outcomes the seat owns in the first ninety days, the days a week and whether on site matters, who the CISO reports to and who reports to them, the systems and data they will inherit, and the budget as a day rate or a monthly figure. A brief that lists tasks rather than outcomes attracts people who want a to-do list, and the fractional CISOs worth hiring decline it.

When should a company hire a full-time CISO?

When the work fills five days and stays there: decisions queue for the CISO's days every week, there is a team of leaders to manage, and the role is certain to be permanent. A retained search for the seat runs 25 to 33 per cent of first-year earnings. Until all three are true, a fractional CISO at two days a week is the cheaper way to find out.

How long does it take to hire a CISO, fractional or full time?

A fractional CISO is usually met within days and starts in one to three weeks: Operator Search returns a shortlist in 5 business days, and a request on the bench is answered within three. A permanent CISO takes eight to twelve weeks of search to an accepted offer, then a notice period of three to six months, so a first day is usually six months or more away.

How do I find a part-time CISO?

Four routes work in the UK: a fractional platform or bench where the day rate is published before you speak to anybody, a search run against a written brief, a referral from an investor, accountant or another founder, and the CISO's own network of former colleagues. Whichever route, shortlist people who have held the seat at your stage, and agree the days, the notice period and the IR35 position in writing.

Ready to meet operators

Two ways in

Browse verified fractional CISOs on the bench and book direct, or brief Operator Search and we run the interviews above for you.

Does a fractional executive need their own insurance?Professional indemnity, D&O and the rest: which policy a fractional executive holds, which the company holds, and what the contract should say.