British universities run some of the most open and complex networks in the country, balancing academic freedom and global research collaboration against a steady stream of ransomware and state-backed attacks. The five CISOs below protect institutions from Oxford to Newcastle, and their routes into the role are as varied as the universities they serve. One served as Deputy Lord Mayor of Oxford. Another designed the IT for Newcastle University’s medical school campus in Malaysia. A third began as a network manager in Cornish and Devon schools before leading security at an NHS trust, and a fourth served as a government-trained crypto custodian at the Parliamentary and Health Service Ombudsman.
David Jones – CISO, Bath Spa University
David Jones started as IT manager for the International Study and Language Centre at the University of Reading, then managed networks and IT teams at Teignmouth Community School and saltash.net community school. As head of ICT at Arts University Plymouth for six years, he led the university’s move to a cloud-first model with Jisc and achieved full-scope Cyber Essentials Plus. He then served as CISO of University Hospitals Plymouth NHS Trust, an acute trust with more than 10,000 staff serving over 2 million people. Jones became CISO of Bath Spa University in July 2023, leading its information and cyber security strategy, reporting to university committees, deputising for the CIO, and representing the university in national networks including JANET CSIRT. He holds a Senior Leader MBA from Exeter Business School and is a Chartered Manager.
Tom Stoddart – CISO, Manchester Metropolitan University
Tom Stoddart began as a database administrator at City, University of London and an analyst at ECA International, then spent more than 11 years at the Parliamentary and Health Service Ombudsman. There he rose from application support to head of ICT and IT security officer for 500 staff, maintaining PSN compliance, serving as a CESG-trained crypto custodian, and liaising with CESG and CPNI on threats and compliance. After managing information security and compliance at Outsourcery, he joined Manchester Metropolitan University in 2016 as information security manager. As assistant director of information security, he led projects spanning SIEM, network access control, and mobile device management and sat on the Jisc CISO forum. Stoddart became CISO in December 2020, accountable for the university’s ISMS and advising its Executive Group and Audit Committee. He holds CISM and NCSC Certified Cyber Professional (SIRA) certifications.
Mia McGuigan – CISO, University of Leeds
Mia McGuigan spent nearly eight years advising the British Association for Counselling and Psychotherapy on data protection and information security, then worked as an information security solutions architect at FedEx Europe and IT security manager at Sytner Group. She led information security at The Open University before spending more than four years at Halfords, first as head of information security and data protection officer and then as group privacy and security director. At VetPartners she served as interim cyber security director and then group information security director. McGuigan became CISO of the University of Leeds in August 2026. She spoke on a panel on quantum threats and future-proofing cybersecurity at Accountex London in May 2026, and is a passionate LGBTQIA+ advocate who works to bring inclusivity and security together.
Jason Bain – CISO, Newcastle University
Jason Bain began as a research associate at Newcastle University administering Mailbase, a mailing list service for the UK academic community, and spent five years as a networking specialist at Imperial College. Returning to Newcastle in 1999, he managed the university campus and regional NorMAN networks and went on to lead its IT infrastructure teams as assistant director for more than 15 years. He led the IT design and implementation for the university’s Medical School campus in Malaysia, which opened in 2011, and served for 18 months as acting director of University IT. Bain has served as CISO of Newcastle University since November 2020, accountable for cyber security across the university.
Tony Brett – CISO, University of Oxford
Tony Brett started as IT manager at the Institute of Molecular Medicine, growing its network to 450 computers, and managed IT at Corpus Christi College before spending 13 years coordinating and supporting Oxford’s 600 IT staff. As director of Medical Sciences Division IT Services, he led a 22-person team across three sites, and during the pandemic he directed the university’s Early Alert Testing Service and helped set up three large vaccination centres. Brett became interim CISO in February 2024 and CISO that October, leading the central information security team, including the OxCERT security operations centre, with work based on the NIST Cybersecurity Framework. He holds the CISSP. Outside the university, he served as an Oxford city councillor and as Deputy Lord Mayor of Oxford from 2013 to 2014, chairs the local governing body of The Oxford Academy, and is a keen choral singer.
Protecting the Campus
These five CISOs show how many routes lead into university security. Bain and Brett have spent most of their careers inside the institutions they now protect, while Stoddart brought government information assurance experience to Manchester. Jones moved from schools to the NHS and back into higher education, and McGuigan carried privacy and retail security leadership into a Russell Group university. Together they keep British research, teaching, and student data secure.
Discover more CISOs securing their organizations:
-
- Powering Europe: The EU’s Energy and Utilities Cybersecurity Leaders to Watch
- Vault Keepers: Australia’s Banking CISOs to Watch
- Trust and Treasure: New Zealand’s Financial Services Cybersecurity Leaders to Watch
- Protecting the Patient: The Netherlands’ Hospital CISOs to Watch
- Public Service, Protected: New Zealand’s Government CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.