A self-paced, multi-topic leadership programme for security managers, IT leaders and senior practitioners preparing to lead a cybersecurity function. Eight lessons cover security strategy, governance and control frameworks, cyber risk management, building and running the security team, leading incident response, third-party and supply chain risk, metrics and board reporting, and building a security culture. Each lesson ends with a leadership exercise. The programme builds skills and does not promise a job, salary or certification outcome.
What you will learn
- Build a security strategy aligned to business goals
- Establish governance using recognised control frameworks
- Assess and treat cyber risk in business terms
- Structure, hire and develop a security team
- Lead incident response and crisis communication
- Manage third-party and supply chain risk
- Report security metrics to executives and the board
- Build a positive security culture
Lessons
- Security Strategy
- Governance and Frameworks
- Cyber Risk Management
- Building the Security Team
- Leading Incident Response
- Third-Party and Supply Chain Risk
- Metrics and Board Reporting
- Security Culture
Self-paced course from Tech Skills Library. Educational content only; it is not an accredited qualification, licence or credential.
Lessons
Security Strategy
Governance and Frameworks
Governance Define who sets security policy, who accepts risk, who owns controls and how decisions escalate. A security steering committee with business representation helps. Frameworks Recognised frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001 controls and CIS Critical Security Controls provide structure. Choose one primary framework and map others to it to avoid duplication. […]
Cyber Risk Management
Risk in business terms Describe risks as scenarios: “ransomware encrypts the order system, halting sales for a week”. Estimate likelihood and business impact. Risk register Record scenario, owner, existing controls, residual risk, treatment and review date. Treatment Mitigate, transfer through contracts or insurance, avoid or accept. Risk acceptance should be made by an accountable business […]
Building the Security Team
Capabilities Governance and risk, security architecture, security operations, identity, application security, vulnerability management and awareness. Structure Decide which capabilities to build in-house, which to share with IT and which to source from managed service providers. Hiring and development Define roles clearly, hire for aptitude and collaboration as well as skills, and fund training and rotation. […]
Leading Incident Response
Preparation Maintain an incident response plan with roles, severity levels, contact lists, legal and regulatory notification requirements and playbooks for likely scenarios. During an incident Appoint an incident lead, separate technical response from communications, keep a timeline and make decisions about containment with business owners. Communication Brief executives regularly with facts, impact and decisions needed. […]
Third-Party and Supply Chain Risk
Inventory List suppliers with access to your systems or data and classify them by risk. Due diligence Assess security proportionately: questionnaires for lower risk, evidence review and contractual controls for higher risk. Contracts Include security requirements, breach notification, audit rights and exit provisions. Monitoring Reassess critical suppliers periodically and monitor for incidents affecting them. Software […]
Metrics and Board Reporting
Useful metrics Coverage of key controls such as MFA and endpoint protection, patching times for critical vulnerabilities, phishing reporting rates, mean time to detect and respond, and progress on strategic initiatives. Board reporting Boards want to know: what are our top risks, are they within appetite, what are we doing about them and what decisions […]
Security Culture
Why culture matters Most incidents involve human actions. Culture shapes whether people report mistakes and follow secure practices. Building culture Make secure behaviour easy, explain reasons, reward reporting and involve leaders visibly. Awareness programmes Use short, relevant, role-based training and realistic phishing exercises handled supportively, not punitively. Security champions Build a network of champions in […]