Insurers know risk better than almost anyone, and the UK’s insurance market, from Lloyd’s specialists to digital car insurers and life reinsurers, is a prime target for attackers seeking data and disruption. The five CISOs below protect some of the country’s best-known insurance names, and their careers took very different routes to the role. One designed security for an air traffic control system and serves as a trustee of The National Museum of Computing at Bletchley Park. Another spent two years in Ethiopia teaching networking to regional civil servants as a VSO volunteer. A third started as an ecommerce developer and rose through the same insurer for 15 years, and a fourth spent nearly 16 years in IT at Bank of America before becoming a CISO.
Simon Legg – CISO, Hastings Direct
Simon Legg spent nearly 16 years at Bank of America, rising to SVP of IT risk, services, and operations for its global markets, corporate and investment banking, and credit card businesses, and then served as SVP and CISO for Bank of America Merrill Lynch across EMEA, Asia Pacific, and the non-US Americas. After a period as an independent consultant, he joined PRA Health Sciences, where he took on a dual CISO and CTO role while the company more than doubled in size, completed three acquisitions, and went public. He then served as Group CISO of JLT Group. Legg became CISO of Hastings Direct in September 2019, building the security capability behind its ambition to become the best and biggest digital insurer, work highlighted in case studies by Zscaler and CybSafe. He also served for nearly seven years as a non-executive director of an education business partnership.
Ben Trethowan – CISO, Brit Insurance
Ben Trethowan began as an industrial trainee and systems engineer at Lockheed Martin, working on electronic warfare research and security accreditation. As security lead on a project to replace the systems used by air traffic controllers, he defined its security strategy and architecture, and he designed an embedded alert solution for a radar subsystem. At Leidos he led security architecture for a £300 million private cloud programme, then designed Project SIREN, a cloud-based security analytics platform, as senior security architect at Electronic Arts. As director of technical security at Square Enix, he built its bespoke SIEM and led work on anti-piracy and anti-cheat, and he then served as director of cyber security at Featurespace. Trethowan became CISO of Brit Insurance in September 2023. He is a trustee and longstanding volunteer at The National Museum of Computing at Bletchley Park and a police support volunteer in a cyber crime unit.
Katie Hermans – UK&I CISO, Intact Insurance UK
Katie Hermans started as an ecommerce developer at EDS before joining LV= in 2008, where she spent nearly 15 years moving from developer and team lead to digital development manager, then head of IT systems for digital, integration and robotics, head of IT delivery, and head of IT risk and standards. She joined RSA in 2023 to lead technology risk management for the UK and Ireland and became its UK&I CISO in 2025, a role she continued as RSA became Intact Insurance UK in October 2025. Hermans was named to Computing’s Tech Women Celebration 50 in 2025.
Alan Mercer – Group CISO, Monument Re Group
Alan Mercer began as a server administrator at Hewlett Packard and spent several years in security roles at Marlborough Stirling, Assureweb, and Sesame Group. He then spent two years in Ethiopia as a VSO volunteer, teaching Cisco networking and Windows and Exchange Server to IT staff across a regional civil service. Back in the UK, he rose at iPipeline to director of global security and compliance, then led IT governance across the UK, Europe, and China for RR Donnelley and assurance and security operations at Paragon Customer Communications. After serving as CISO of The Openwork Partnership, Mercer became Group CISO of Monument Re Group in September 2024. He holds an MSc in information security and C|CISO, CISSP, and SANS Gold certifications, and previously served on the ISSA-UK management committee and the SANS GSNA advisory board.
Dave Lochhead – CISO, Commercial Insurance & Group Technology Operations, Zurich Insurance
Dave Lochhead has spent more than 27 years at Zurich Insurance. After nine years in a range of roles, he worked as a risk consultant and then in data security assurance and information security consulting for the UK business. He went on to serve as business information security officer for the UK, Luxembourg, and group shared services, and then across EMEA. Lochhead became CISO for Commercial Insurance and Group Technology Operations in April 2021.
Insuring the Insurers
These five CISOs bring a wide range of experience to insurance security. Legg and Trethowan carried banking, defence, and gaming experience into the market, while Hermans and Lochhead built long careers inside the insurers they now protect. Mercer combined governance expertise with international volunteer work. Together they help insurers keep the promises they make to policyholders.
Discover more CISOs securing their organizations:
-
- Dreaming Spires, Hardened Defences: The UK’s Higher Education CISOs to Watch
- Powering Europe: The EU’s Energy and Utilities Cybersecurity Leaders to Watch
- Vault Keepers: Australia’s Banking CISOs to Watch
- Trust and Treasure: New Zealand’s Financial Services Cybersecurity Leaders to Watch
- Protecting the Patient: The Netherlands’ Hospital CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.