Fractional CISO at The Phoenix Group

The Phoenix Group requires an experienced Fractional CISO to evaluate existing security controls, identify vulnerabilities, and develop a prioritised improvement roadmap. The engagement is part-time at 10 to 15 hours per week and is based in New York on a hybrid basis. The advisor will work across Microsoft 365, Azure, and Entra ID environments, reviewing identity and access management, network segmentation, endpoint protection, backup and recovery, and incident response readiness.

The successful candidate will conduct enterprise risk assessments aligned to NIST CSF 2.0, maintain a risk register, assess third-party vendor risks, and present findings and recommendations directly to executive leadership. Preferred certifications include CISSP, CISM, CISA, or CRISC, and prior experience in a fractional or advisory CISO capacity is an advantage.

• Assess existing cybersecurity programmes, policies, technical safeguards, and administrative controls across the organisation.
• Conduct enterprise risk assessments aligned to NIST CSF 2.0 and maintain a prioritised risk register.
• Evaluate security across Microsoft 365, Azure, Entra ID, identity and privileged access management, and conditional access.
• Review network segmentation, endpoint protection, patch management, backup and recovery, and incident response procedures.
• Assess third-party vendor security risks and recommend improvements to vendor evaluation and monitoring practices.
• Develop a prioritised cybersecurity improvement roadmap and present findings to executive and non-technical stakeholders.

• 10 or more years of progressive experience in IT or cybersecurity, including at least 5 years in a security leadership or governance role.
• Prior experience as a CISO, Deputy CISO, Director of Information Security, or comparable senior security leader.
• Demonstrated ability to conduct enterprise cybersecurity risk assessments and apply the NIST Cybersecurity Framework (CSF 2.0).
• Hands-on knowledge of Microsoft 365, Azure, and Entra ID in hybrid IT environments.
• Experience with cloud security, identity and access management, vulnerability management, and incident response.
• Strong communication skills with the ability to translate technical risk into executive-level recommendations.

The Phoenix Group Advisors is a consulting firm committed to building diverse and inclusive working environments. The organisation places equal employment opportunities at the centre of its hiring practices and works with clients across a range of industries on advisory and professional services engagements.