Law firms hold some of the most sensitive information in the economy, from merger plans and litigation strategy to the private affairs of wealthy clients, which makes them prime targets for criminals and state-backed attackers alike. The five cybersecurity leaders below protect some of the UK’s best-known firms, and their routes into the role are strikingly varied. One started as an analytical chemist in Sydney. Another trained to be an architect before discovering a talent for making sense of disconnected data. A third began as a computer engineer at Anglian Water in 1987, and a fourth managed the Metropolitan Police’s largest IT outsourcing contracts before becoming a global CISO.
Phil Gough – CISO, Pinsent Masons
Phil Gough began as an analytical chemist and computer systems validation specialist at Merck Sharp & Dohme in Sydney, then worked in quality and IT compliance across the pharmaceutical industry at Novartis, Pfizer, Norgine, and Johnson & Johnson, where he led security and compliance for a $4 million SAP project. He joined Nuffield Health in 2011 as IT quality, risk and compliance lead and spent nine years as its head of information security. Gough became CISO of Pinsent Masons in May 2025. In July 2026 he spoke in two sessions at AKJ Associates’ Securing the Law Firm conference in London, including a panel on cyber insurance for law firms.
Andrew Powell – CIO, Macfarlanes
Andrew Powell planned to be an architect but found he was drawn more to problem-solving than to the profession itself. His first technology role was data analysis for a hospital trust, where he brought together paper records from several hospitals for the first time and showed that one immunosuppressive drug therapy was saving lives while another was causing harm. He went on to lead IT at Crutes, Brodies, and Nabarro before joining Macfarlanes in 2016 as head of IT. Powell has served as CIO since 2019, sitting on the firm’s executive committee, leading a team of 40, and setting its IT and information security strategies. A Chartered Engineer and Chartered Fellow of the BCS, he serves as executive vice president on the board of the International Legal Technology Association and co-chaired the ILTACON Europe conference for four years.
Martyn Styles – CISO, Bird & Bird
Martyn Styles began as a computer engineer at Anglian Water and rose to technical support manager at A.T.M. Technology Management. Over more than a decade at smart metering business IMServ Europe, he managed networks as the company grew from 100 to more than 1,500 staff and led it to BS 7799 certification in 1998 and ISO 27001 in 2007, before working as an IT security specialist for Invensys. At Allen & Overy he spent 12 years leading information security, managing patching across more than 2,000 servers and 6,000 workstations and later serving as information security architect. Styles joined Bird & Bird as head of information security in 2020 and became CISO in October 2023. He holds BSc, MSc, and MPhil degrees and is an ISO 27001 Lead Auditor. He is also a committed supporter of the Alzheimer’s Society, running the Harwich and Royal Parks half marathons a week apart in 2026 to raise funds.
Allan Campbell – CISO, Withers
Allan Campbell spent more than six years as IT technical security manager at Camelot, operator of the National Lottery, then managed information security at GUS. He served as group data protection officer at British Sky Broadcasting, covering 12,000 employees and five call centres, and as head of information security and data protection at Prudential, leading a team of eight. At Barclays he managed international privacy compliance and group information risk, and at LCH.Clearnet he spent seven years protecting critical infrastructure serving major international exchanges. Campbell has served as CISO of Withers since April 2017. He has built a long list of certifications since 2000, including CISSP, CISM, CISA, CRISC, C|CISO, and CDPSE.
Yolande Young – CISO, A&O Shearman
Yolande Young began in IS service delivery at PwC Consulting and spent several years in IT contract and supplier management at Diageo, IBM, and Inspired Gaming before becoming a managing consultant in PA Consulting’s sourcing and outsourcing practice. As ICT procurement director at the Metropolitan Police, she oversaw its largest IT outsourcing contracts, worth around £100 million a year. At SABMiller she moved from global head of commercial management to Global CISO, briefing the audit committee and ExCom, bringing privacy and security policies together under one global framework, and establishing cyber incident rehearsals. She went on to serve as CISO for McKesson’s European businesses across 14 countries, as SVP of digital security and Group CISO at bp, and as CISO of Bupa. Young became CISO of A&O Shearman in November 2024, and sits on the audit, risk and compliance committee at King’s College London.
Guarding Client Confidence
These five leaders bring very different strengths to legal sector security. Gough and Campbell built their careers on compliance, privacy, and risk in heavily regulated industries, while Styles has protected law firms for nearly two decades. Powell brings technology leadership from the heart of a firm’s executive, and Young carries global CISO experience from brewing, energy, and healthcare. Together they protect the confidentiality on which every client relationship depends.
Discover more CISOs securing their organizations:
-
- From Paddock to Pour: Australia and New Zealand’s Food and Beverage Cybersecurity Leaders to Watch
- Securing the Frontier: The EU’s AI Cybersecurity Leaders to Watch
- From Field to Fork: The EU’s Food and Beverage CISOs to Watch
- Securing the Integrators: The EU’s IT Services Cybersecurity Leaders to Watch
- Formula for Security: The EU’s Pharmaceutical CISOs to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.