Chief Data Officer vs Chief Information Security Officer: Salary & Career Benchmarks in the UK

In the UK, Chief Data Officer roles typically command a higher median salary than Chief Information Security Officer positions. According to our 2026 live benchmark data, a mid-level Chief Data Officer earns a median salary of £143K, whereas a Chief Information Security Officer brings in roughly £117K (a gap of £26K at the median).

Seniority, tech stack, and location all move this gap. Senior practitioners in either discipline can exceed the upper range through specialist skills. See the skills premium section below for the specific certifications and tools that push offers to the top of the range.

While both positions are vital to a modern tech organisation, Chief Data Officer and Chief Information Security Officer have fundamentally different daily workflows.

Chief Data Officer focuses primarily on setting enterprise data strategy, governing data as a strategic asset, leading data platform and analytics capability, and ensuring GDPR and AI Act compliance at board level. Day-to-day work revolves around setting enterprise data strategy and presenting to the board, governing data quality and master data management frameworks, overseeing data platform and analytics engineering teams, managing GDPR and data compliance programmes, building executive buy-in for data investments, partnering with the CISO on data security, and driving AI and analytics adoption.

Chief Information Security Officer focuses on defining and executing information security strategy, managing cyber risk, ensuring GDPR, DORA, and NIS2 compliance, and overseeing security operations at board level. Their time is spent presenting cyber risk and threat landscape to board and executive team, overseeing SOC and incident response capability, managing ISO 27001, GDPR, and DORA compliance programmes, directing zero-trust security architecture, managing security vendor relationships, leading major incident response, and building security culture across the organisation.

Transitioning between these two paths is achievable but requires targeted upskilling.

Moving from Chief Data Officer to Chief Information Security Officer: Head of Information Security, Director of Cybersecurity, VP of Security Operations, and security architects with 10 or more years of progressive security leadership experience.

Moving from Chief Information Security Officer to Chief Data Officer: Head of Data, Director of Analytics, Data Engineering Directors, and senior enterprise architects with data specialisation most commonly transition into CDO roles.

Neither path requires starting from scratch. Professionals in both roles share underlying technology fluency; the gap is usually domain knowledge and specific tooling rather than core engineering fundamentals.

In the UK in 2026, both roles are seeing demand, but with different drivers.

Chief Data Officer demand is very high, particularly in Insurance and asset management modelling teams, led by employers such as HSBC and Barclays. Chief Information Security Officer demand is extreme, concentrated in Telecoms and defence-adjacent security functions, led by employers such as HSBC and Barclays.

Workspace flexibility significantly impacts total compensation value in the UK.

Chief Data Officer roles score 55% on our remote-friendliness index (Hybrid). This is because Strategic planning, team leadership, and stakeholder management can be conducted remotely. CDOs are typically in executive communities with distributed leadership teams, which is why remote and hybrid listings remain common among UK scale-ups and remote-first employers. Where in-office attendance is required, it is typically driven by Board and executive committee attendance, building organisational trust and cultural change around data, and leading large-scale data governance programmes are most effective with regular presence, with UK-headquartered enterprises more likely than scale-ups to formalise this into a fixed office schedule.

Chief Information Security Officer roles score 45% (Predominantly Office). Security monitoring, strategy planning, and policy development can be conducted remotely with appropriate secure access controls, and UK employers outside financial services have generally left this flexibility in place through 2026 is the primary driver of flexibility. When office days are required, it is usually for Board and executive committee engagement, incident response war rooms, physical security oversight, and the need to build organisational security culture require consistent in-person presence, plus the three- or four-day office mandates now standard at the large UK banks and insurers.