The UK’s banks run on some of the most heavily regulated and heavily targeted technology in the world, and the seven CISOs below protect institutions ranging from global groups to high street names and challenger banks. Their routes into the role are anything but uniform. One began as head of counter-terrorism and resilience at a defence think tank. Another spent six years in equity sales in Hong Kong. A third led technology audit for a telecoms group across five African countries. Others secured a fleet of seaborne gas carriers and built virtual reality training for the offshore industry before moving into banking. Together they show how many paths lead to the top security seat in UK financial services.
Rebecca Cox – Group CISO, HSBC
Rebecca Cox started as head of counter-terrorism and resilience at the Royal United Services Institute, delivering research and consultancy for its homeland security and resilience department. She spent more than eight years at Lloyds Banking Group, beginning as incident response manager and supporting the group’s executives through major IT outages and pandemic planning. She went on to serve as chief of staff to the chief security officer, built the group’s strategic threat management structure as senior manager for intelligence and analytics, and led its information security risk portfolio. After advising financial services clients across EMEIA on security transformation at EY, Cox joined HSBC in 2017 as global head of cybersecurity governance, risk and compliance, then led its cybersecurity strategy and programme as a managing director. She became Group CISO in May 2023.
Neil Robinson – CISO, Virgin Money
Neil Robinson started in financial services consulting at Accenture and project management at Morgan Stanley before spending nearly a decade at RBS, including six years in equity sales in Hong Kong. At Standard Chartered he moved from client onboarding into security, leading cybersecurity framework implementation and risk reduction in Singapore before becoming head of information security for the corporate, commercial and institutional banking division across more than 50 markets and 40,000 employees. Robinson joined Virgin Money in 2023 as head of security engineering and cybersecurity and became CISO in April 2026. He leads a security organisation of more than 200 people and is executing a £54 million three-year cyber strategy, with around 15,000 endpoints under modern EDR and roughly a 60% reduction in vulnerability exposure, while embedding security through the Nationwide integration. He also works with early-stage cyber founders on what lands with CISO buyers.
Joao Stott – CISO, Santander UK
Joao Stott started as a software engineer building an EDI module for a shipping and maritime management tool and worked as an ITIL researcher and consultant. He spent five years at Barclays in Portugal across the COO control office and IT governance, taking on information security risk responsibilities for the Portugal business unit. After serving as chief security officer at TIMWE and as a manager in EY’s financial services advisory practice, he joined Santander Portugal in 2018, leading cyber GRC, identity and access management, and privileged access management before becoming CISO and head of fraud prevention in 2022. In 2024 he added the role of CISO for Santander’s European business. Stott moved to London in June 2026 as CISO and head of fraud prevention for Santander UK.
Tammy Naicker – CISO, HSBC UK
Tammy Naicker began in IT audit at KPMG South Africa and spent nearly five years at Absa, rising to head of audit for technology applications in its corporate and investment banking division, with a secondment to Barclays Internal Audit in London. At Vodacom she led technology internal audit across the group’s operations in South Africa, the DRC, Mozambique, Tanzania and Lesotho, then headed technology assurance across IT and the telecoms network. She moved to the UK as head of technology assurance at Vodafone, then served as risk and compliance director at Kaluza and head of audit at Monzo. Naicker joined HSBC in 2024 to lead its identity and access management control framework, audits, risk and assurance, and became CISO of HSBC UK in September 2025. She holds an MBA from the University of Roehampton.
Phil Knight – Group CTO & Group CISO, Bank of London
Phil Knight started as an IT consultant at PwC in London and worked as a solutions architect in Sydney for AMP, Optus and Vodafone Australia. After six years as a senior managing consultant at IBM and three as a principal advisor at KPMG, he joined Lloyds Banking Group as chief architect for digital channels serving 14 million active users, then directed infrastructure and security architecture across end user computing, data centres, networks, identity and cloud. As CISO and ExCo member at 10x Banking, he built global security, platform engineering and service operations teams that supported the launch of multiple banks worldwide on its cloud-native core. Knight has served as Group CTO and Group CISO of Bank of London since November 2022, leading the launch of its regulated banking activities, direct payment scheme membership and API.
Simon Brooker – CISO, Deutsche Bank
Simon Brooker started in IT support and worked at T-Mobile, Soundcraft Studer and Kaleidovision before becoming group IT and cyber security director at Protection Group International, where he insourced the company’s IT during a period of rapid growth. After leading IT at Huddle, he spent six years as head of IT and information security at Navigator Gas, responsible for technology and security across offices, terminals and 56 seaborne gas vessels and reporting to the CEO. He went on to direct IT and information security at shipbroker Braemar and lead IT and information security at Valstro. Brooker joined Deutsche Bank in September 2025 as CISO for its fintech entities, leading information security risk management, governance and technology resilience.
Sebastian Coles – CISO, OakNorth
Sebastian Coles placed joint third in the Cyber Security Challenge UK 2013 series as a university student, competing against 10,000 entrants. He started as a software engineer building virtual reality offshore training, then worked as a DV-cleared engineer at the UK Hydrographic Office, where he led a security champions programme. He built the application security capability at Clarks and consulted for international banking clients at Veracode. At ClearBank he grew from senior security engineer to senior engineering manager, building a security engineering team that was Highly Commended for Best DevSecOps Implementation at the 2023 Computing Awards and cutting Snyk flaws by 85% in 2022. He went on to lead application security and DevOps at LRQA and IT, security and cloud engineering at Seccl, and runs a bridging vCISO practice. Coles became CISO of OakNorth in August 2026. A regular speaker, he has presented at CyberUK, UKCyberWeek, NCSS Birmingham and several BSides events.
Many Routes to the Same Mandate
These seven CISOs show how differently banking security leaders are made. Cox came from counter-terrorism research and Robinson from the trading floor. Naicker and Stott built their careers on audit, governance and risk across three continents. Knight and Coles rose through architecture and engineering, while Brooker learned to secure global operations at sea before moving to Deutsche Bank. Across global groups, high street names and challengers, they share the same mandate: keeping the UK’s banking system secure while the institutions they protect continue to change.
Discover more CISOs securing their organizations:
- Taking the Stage: Australia’s Cybersecurity Leaders to Watch
- Where Downtime Isn’t an Option: Healthcare’s CISOs to Watch
- Where the Fleet Comes Ashore: Virginia Beach’s Cybersecurity Leaders to Watch
- The Gate City’s CISOs to Watch
- Atlantic Edge: Portugal’s Cybersecurity Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.