CISO Expertise On Demand
Security leadership without a full-time hire.
Fractional and interim CISO engagements for SMEs, FinTech, and regulated businesses across the UK and Europe — ready to take security seriously without carrying a six-figure salary.
Book an introductory call See how I helpWho I work with
Practical security leadership for businesses that have outgrown ad hoc.
Most growing companies reach a moment where security stops being something IT can absorb on the side. A board starts asking pointed questions. An enterprise customer sends a 200-line security questionnaire. AI tools spread through the business and someone realises no one's governing them. Auditors arrive. The first time an incident lands, the absence of a plan becomes uncomfortably visible.
I help businesses navigate that transition. Whether you need a few days a month of senior oversight, a dedicated interim lead through a critical period, an AI governance programme stood up from scratch, or a certification delivered end to end, the engagement is shaped around what you actually need — not a generic retainer. The goal is always the same: leave you with security and governance that hold up to scrutiny, fit how your business actually works, and don't slow you down.
Services
Five ways I help.
Ongoing security leadership
A few days a month of senior security oversight: strategy, board reporting, programme governance, supplier and customer assurance, and an experienced ear for when something doesn't feel right. The cost-effective alternative to a full-time hire while you build internal capability — or for as long as you need it.
ISO 27001, SOC 2, DORA, GDPR, NIS2, PCI-DSS
End-to-end delivery of certification and regulatory programmes, from gap analysis through to passing the audit. I've taken organisations from a blank page to certified, and I've fixed programmes that stalled. I focus on what auditors will actually look for, not box-ticking, so the result is defensible, not just compliant.
Risk registers, policies, and board advisory
Risk frameworks that the board can use to make decisions, policies your people will actually follow, and audit-ready documentation that stands up to challenge. Built around the way your business operates rather than copied from a template.
Zero Trust, IAM, cloud security, SIEM/SOC build
Practical delivery of the technical controls that matter: identity and access, cloud security posture across AWS, Azure and GCP, Zero Trust architectures, DevSecOps pipelines, and detection and response capability sized for your business. Designed to work, not just to look good in a slide deck.
AI risk and governance, built from scratch
AI is rapidly becoming the next regulatory frontier — EU AI Act, ISO 42001, FCA expectations, and customer due-diligence questions about how your business uses and governs AI. As one of a small number of UK practitioners certified by the IAPP as an AI Governance Professional (AIGP), I help SMEs design AI governance from a blank page: policies people will actually follow, risk frameworks that scale with adoption, and the documentation that increasingly decides whether enterprise customers will buy from you.
About
Fifteen years building security programmes that hold up.
I'm Pete Smith — a CISSP-, CCSP- and CISM-certified security leader with fifteen-plus years across FinTech, financial services, and enterprise. Most recently I led information security at IFX Payments, and before that I was Chief Information Security Officer at Allica Bank, where I built and led the security function through the bank's most critical years of growth and regulatory scrutiny.
Earlier in my career I designed and ran network and security architecture at Hogarth Worldwide and IBM. I founded GuardianSmith in 2025 to bring that same standard of security leadership to businesses that need senior expertise but don't yet need — or can't yet justify — a permanent CISO on the payroll.
I'm based in Kent, work primarily with clients across the UK and Europe — and selectively with international companies where the regulatory expertise is the work — and I approach every engagement the same way: by listening first, understanding what the business is actually trying to do, and then making security work in service of that.
Credentials
Certified and accountable.
- CISSP Certified Information Systems Security Professional
- CCSP Certified Cloud Security Professional
- CISM Certified Information Security Manager
- AIGP IAPP AI Governance Professional
- GDPR DPO Certified Data Protection Officer (PECB)
- CompTIA Security+ Foundational security certification
How engagements work
Three ways to start.
Fractional retainer
A set number of days per month, typically two to six, providing ongoing CISO-level oversight and accountability. Best for businesses that need consistent senior presence over time.
Interim CISO
Full-time leadership for a defined period — covering a vacancy, leading through certification, or steering response to an incident. Typically three to nine months.
Defined project
End-to-end delivery of a specific programme: ISO 27001 certification, SOC 2 readiness, security architecture review, board paper. Fixed scope, fixed price where it makes sense.
Day rate is £750–£1,250 depending on scope and engagement model. Most engagements operate outside IR35.
Contact
Let's talk.
The best place to start is a thirty-minute call. No pitch, no obligation — just a conversation about what you're trying to do and whether I'm the right person to help. If I'm not, I'll usually know someone who is.
Location
Rochester, Kent — working with clients across the UK, Europe, and selectively beyond