Security leadership · London & South East
ZenOps is the practice of Kent Hawkins, a security leader who has worked in regulated financial services for two decades. Providing fractional CISO cover, programme delivery and answers to the tough questions: what is the actual cost of this risk, and can we continue operating when it occurs?
Many consultancies will draw up a policy set for you. What narrows the field is twenty years' experience in regulated finance — banking, insurance and reinsurance — where board papers, regulators, second-line challenges and audit findings are familiar ground rather than a research exercise. Three capabilities build on that foundation.
Securing models and the pipelines around them, and building the governance to match — ISO 42001, the NIST AI Risk Management Framework and EU AI Act obligations.
Risk expressed in pounds and probabilities rather than colours, so control spend can be defended, sequenced and reported on consistently.
Important business services, impact tolerances, severe-but-plausible scenarios and the testing evidence that DORA and the PRA and FCA rules expect.
Engagements are usually a mix of these rather than one in isolation. A resilience review turns up governance gaps; an AI assessment ends up as a delivery programme; a quantified risk exercise changes what the roadmap should have been. Work is scoped around the outcome you need rather than a fixed product, and the same person stays with it from the first assessment to the board paper that closes it out.
Executive security leadership at the days per month you need it — covering a vacancy, standing in during a transition, or giving a growing firm a credible security voice at board level before a full-time hire makes sense.
Taking a security programme from a slide deck to something that ships. Scoping, sequencing, running the delivery, and keeping the sponsors honest about dependencies and cost.
For firms adopting AI faster than their control environment can absorb. Establishing what is in use, what the real exposure is, and the governance that lets the business keep moving without failing a client questionnaire or a regulator's first question.
Loss exceedance modelling for the scenarios that matter, so investment decisions rest on expected financial impact rather than a workshop consensus. Useful for insurance placement, capital discussions and prioritising a crowded roadmap.
Mapping what the business genuinely cannot afford to lose, setting tolerances that survive contact with reality, and proving through testing that recovery works — under DORA, the UK operational resilience regime, or plain commercial pressure.
A control framework that stands up to audit without burying the people who have to live with it. Built on the standards your clients and regulators already recognise, and sized to the organisation rather than to the template.
Three shapes cover most of it. Rates are day-based and quoted before work starts.
A defined look at one area — resilience, AI exposure, control maturity — ending in findings, a costed roadmap and a board-ready summary. A good first engagement.
Owning delivery of a defined outcome: certification, remediation, an integration, a resilience uplift. Fixed scope, agreed milestones, a named person accountable.
Continuous CISO cover for firms that need the seniority but not the salary. Board attendance, regulator and client engagement, and support for the internal team.
Kent Hawkins has spent over twenty years in senior security and architecture roles, most of it inside regulated financial services, alongside energy and professional services. The work has ranged from global security programmes to standing up governance from scratch.
ZenOps Ltd is a London-based practice serving clients across the capital and the South East, remotely and on site.
If you have a security problem with a deadline attached, a first call costs nothing and usually clarifies whether there is a fit within twenty minutes.