British retail runs on payment systems, online platforms, warehouses, and supply chains that criminals target relentlessly, and the nine leaders below protect some of the best-known names on the high street and online. Their routes into cybersecurity are as varied as the shops they defend. One ran shipboard IT for a cruise line before building a retailer’s security function from scratch. Another started on the Next desktop support desk in 2009 and now leads its information security. A third began as a systems manager at the Civil Aviation Authority in 1986, and a fourth leads adventure tours to places such as Timbuktu, Socotra and Bhutan when she is not running security governance for Sainsbury’s.
Simon Grant – CISO, Currys
Simon Grant spent eight years as an IT security analyst at Alliance & Leicester before moving through IT risk and operational risk roles at Produban, Santander UK and Coventry Building Society. As head of information security at Santander UK, he led awareness and culture, ran a bank-wide cyber ambassador programme and produced targeted material for high-risk groups such as SWIFT payment operators. At Sainsbury’s he built a DevSecOps product assurance framework and an in-house vulnerability management and penetration testing function that improved mean time to remediation by 30%, and led a task force that cut legacy technology by 22% in its first year. As CISO of Sainsbury’s Bank from 2023, he delivered a board-backed cyber strategy, supported the sale of its banking portfolios and the bank’s safe and solvent exit, and led a Gold-level crisis response during third-party breaches with no material customer impact or regulatory action. Grant became CISO of Currys in July 2026 and holds the CISSP.
Martin Bisiker – Head of Information Security, Next
Martin Bisiker joined Next as a desktop support analyst in 2009 and has spent more than 16 years with the retailer. He moved through technical services engineering, led DevOps and QA for its HR and finance systems, and managed development projects before becoming security operations manager in 2019, heading incident response, vulnerability management and threat intelligence. As head of cyber defence, he led a team of 40 across incident response, threat intelligence, security engineering, and identity and access management. Bisiker became head of information security in July 2024.
Al Price – Group CISO, JD Sports Fashion
Al Price spent more than a decade at Fujitsu, starting as a network and firewall engineer in Swansea and rising to service and operations manager. He then ran Alert Logic’s UK security operations centre in Cardiff as director, led security operations at BAE Systems Applied Intelligence, and headed security operations and intelligence at Whitbread. After leading cyber security at Chorus, he spent 18 months as a CISO advisor at Gartner, advising CISOs and CIOs on frameworks and technology decisions, and then headed security operations at Marks and Spencer. Price became Group CISO of JD Sports Fashion in January 2024.
Murshidah Boksh – Head of Information Security, Sainsbury’s
Murshidah Boksh began in consulting at CPA Global and Accenture, then worked in planning and as a technology partner at EE. As a senior consultant at Moorhouse, she worked on GDPR and MiFID II programmes for clients including Goldman Sachs, Sky and Virgin Media. At Sainsbury’s Argos she established the data governance team, helped grow the group function from seven to more than 30 people, delivered the GDPR plan, chaired the PCI steering group and set up the group’s privacy team. After directing data governance at Carnival UK, she returned to Sainsbury’s as head of information security in 2021, leading policy, governance, risk and compliance, PCI, product assurance and security awareness, and initially the security operations centre. Outside work, she leads three or four adventure tours a year for Lupine Travel, to destinations including Madagascar, Sudan, Bhutan, Socotra and Timbuktu.
Adam Gray – Head of Information Security, The Very Group
Adam Gray spent more than 12 years at BT, starting as a systems engineer and working nearly five years as a penetration tester. He helped launch the BT Cyber Security Platform, whose first major client engagement became a £13 million services deal, then built and led BT Security’s advanced services practice and its global cyber threat management advisory, working with UK government departments and international governments. At HackerOne he took the EMEA security advisory services capability from concept to a revenue-generating function within its first year. Gray joined The Very Group in February 2023 as head of information security, leading security across the online retailer and regulated financial services provider through large-scale cloud transformation.
Andrej Kurlovic – CISO & Data Protection Officer, Home Bargains
Andrej Kurlovic managed shipboard information systems for Carnival Cruise Line, overseeing data centres and satellite communications at sea. He went on to design a high-availability VoIP platform for the British Film Institute and audit networks for Honeywell, Verizon and ASDA at Servassure, then spent seven years as network security manager at Frontline, transforming it into a resilient managed services platform. Kurlovic became CISO and data protection officer of Home Bargains in 2017, building its security and privacy functions from the ground up to protect more than 27,000 colleagues while the company opened a new store nearly every week. He has built SOC and SIEM operations, rolled out zero trust, launched a public bug bounty programme, secured the OT systems behind its warehouses, and embedded a security culture through initiatives such as HackNights.
Asif Farooqi – Director Information Security GRC, Ocado Group
Asif Farooqi spent his early career in client support and service management at Sopheon, Logica, Philips Medical Systems and Fujitsu. At IntraLinks he directed client services, security and service assurance, and at Smart Communications he rose from compliance director to VP of governance, risk, compliance, security and global SaaS operations. After leading information security and GRC at British Sugar, he joined Ocado Group in 2019 as group information security manager and rose through head of information security governance to director of information security GRC in September 2025. His remit now also covers group data governance, and he has held budget accountability of up to $16.5 million. He holds CISA and CISM certifications.
James Turrell – Head of Information Security, River Island
James Turrell began as an Apple Mac engineer at the BBC before spending more than a decade at Aquent, rising from European engineer to information security officer and then global security officer across North America, EMEA and APAC. At John Lewis Partnership he served as business information security officer, information security architect and enterprise architect for security. He went on to lead security architecture and risk strategy at Le Creuset and to head information security at ME+EM. Turrell became head of information security at River Island in May 2026. He holds an MSc along with CISSP and CCSP certifications, and serves as a trustee of the Greensand Multi Academy Trust.
Ian Ballantyne – Head of IT & CISO, SPAR UK
Ian Ballantyne has more than 35 years in IT, starting as a systems manager at the Civil Aviation Authority in 1986. He managed systems at BAeSema, ING Barings and BP, worked as a technical project manager for HSBC and Compaq, and spent nearly eight years as head of IT for Serco’s US Department of Defense work. He later led campus technology across EMEA at BPP, headed infrastructure, telecommunications and IT operations at UK Power Networks, and led service delivery at Penguin Random House. Ballantyne has served as head of IT and CISO at SPAR UK since January 2020, and is pursuing a PhD on how agentic AI can help organisations respond to incidents faster and in a forensically defensible way.
Protecting the Nation’s Shop Floor
These nine leaders show how many paths lead into retail security. Bisiker, Price and Gray came up through operations, engineering and offensive security, while Grant, Boksh and Farooqi built their careers on risk, governance and data protection. Kurlovic, Turrell and Ballantyne brought experience from cruise ships, architecture and decades of IT leadership. Together they keep the tills, websites and warehouses of British retail running safely.
Discover more CISOs securing their organizations:
-
- Serving the States: Australia’s Government CISOs to Watch
- Code, Cloud, and Compliance: Sweden’s Cybersecurity Leaders to Watch
- Ports, Parcels, and Platforms: The Netherlands’ Logistics and Transportation CISOs to Watch
- From RSAC to DEF CON: The Conference Circuit’s CISOs to Watch
- Powering the North: Canada’s Energy and Utilities Cybersecurity Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.