Graham Rutt
Basingstoke,Hants
Summary
A seasoned professional with over 20 years of experience in Cyber Security, ISO 27001/2 and PCI DSS programmes, complemented by extensive expertise in the UK telecoms sector, including MVNOs. Demonstrates strong stakeholder management and programme/contract governance skills, alongside proficiency in risk and issue management. Adept at project and programme management, with a creative approach that is both innovative and adaptable. Possesses presentation and facilitation skills, as well as experience in recruiting, training, supervising, and mentoring staff. Holds a strong understanding of the UK pensions and finance industries and the UK retail sector, with three years of experience in the gaming and gambling industries. Security cleared (expired), aiming to leverage comprehensive industry knowledge to drive strategic initiatives forward.
Overview
37
37
years of professional experience
11
11
years of post-secondary education
1
1
Certification
Work history
Director
Rumour Solutions Ltd
2012.12 - 2026.04
- Graham became a self–employed contractor in 2012: Making full use of his many years of experience, in Business Analysis, Project Management and Programme Management, setting up Rumour Solutions Ltd. Graham's talents were spotted immediately and he began his first “Contract Role” at Everything Everywhere.
Information Security Project Manager
SGN Ltd
Portsmouth, Hants
2025.02 - 2026.03
- Working within SGN's GD Cyber programme, Graham led 3 key projects through initiation to closure. Working on a broad range of subject area, all concerned with strengthening SGN' cyber security posture.
- Data Security Strategy sought to provide reviews, analysis and reports into SGN's security posture in respect of data. Was SGN's current data security strategy effective or were other measures required to further enhance data loss prevention (DLP), security of data when disposing of assets, etc.
- Another of Graham's projects was focused on SGN's Threat Detection and response capability, where working with a cyber threat subject matter expert, the project implemented, what the senior stakeholder described as a remarkable new capability to stay ahead of threats and threat groups.
- Finally Graham implemented the ServiceNow Certificate Inventory and Management module, establishing a single pane view of all security certificates across SGN's estate. Which when coupled with the new AWS Private Certificate Authority established by the project, created a new level of visibility and agility, placing SGN in a much more favourable position to meet the threat of quantum computing and the growing threat to encryption algorithms.
Information Security Project Manager
Carnival UK Ltd
2021.12 - 2024.12
- Project Manager for the Carnival UK IAM Project. The IAM project was the integration of the SailPoint Identity Now tool, and the establishment of the new processes and resources required to enable effective Identity and Access Management in Carnival UK.
- Whilst the IAM project was already in flight (requirement phase), when I joined the team, I believe I played a critical role in ensuring the successful delivery of such a complex and challenging project. Taking the project through Design, Build, Test and Implementation. Working within the confines a much larger global program, lead out of North America, managing a configuration team in India, and ensuring the needs of customer in the UK were met, and most importantly managing the business change, and ensuring the UK was in a position to make optimal use of the new tool and adopt the new IAM processes.
- In addition to the successful implementation of SailPoint, my role included the delivery of the PAM Project, the integration of the CyberArk tool to enable the implementation an effective privileged access management tool. CyberArk is now installed to the CUK Data Centres (ship and shore) and working across 11 separate environments and platforms, initially targeting high risk privilege access users, but steadily migrating across all internal and external administrator user groups and teams.
Information Security Programme Manager
Le Creuset Ltd
2020.09 - 2021.07
- Established and managed the Le Creuset Information (Cyber) Security Programme. The programme began by establishing Risk Management and setting up a senior Security Board to focus on and address all InfoSec related issues. Then once the baseline set of risks was documented, the programme moved forward and identified the core programme workstreams and defined the full Cyber programme. The cyber programme covered the broadest range of cyber topics and set out to assess & quantify the different levels of maturity of each component. The programme included the creation and dissemination of a whole suite of security policies. The set-up of internal Security Awareness campaigns. A review of all Cyber Incident Management practices. The enabling of Information Security as a function within the organisation. The embedding of tooling to facilitate cyber due diligence in respect Third Party (supplier) reviews.
PCI DSS Project / Cyber Programme Manager
Travelex Ltd
2018.09 - 2020.04
- Initially engaged as a project manager, focusing on the delivery of PCIDSS compliant solutions onto the Call Centre and eCommerce platforms. The successful delivery of which eliminated payment card data from the “payments environment” entirely and shifted the risk card data breach risk out to the “Payment Service Providers”. After which I then project managed the annual PCIDSS Audit (March 2019). From April 2019, I have been leading the Cyber Security Program. A broad range of initiatives to further improve the Travelex security posture. Which began with producing the Cyber Security Strategy, defining the program work-streams, and driving initiatives such as Security Awareness program, PCI DSS Control ownership across the business, refocusing the Travelex audit footprint by producing the Global ROC and AOC Strategy, and working on other numerous initiatives to embed security behaviours and culture.
GDPR Program Manager
Harsco Ltd
2018.03 - 2018.06
- GDPR Programme Manager leading a team of 9, working across 5 core workstreams. Awareness – delivering online training modules to heighten staff awareness of the new data protection regulation. Business Process Risk Assessment – Mapping and documenting all business processes, and more importantly identifying data processing risks and creating the Report on Processing Activities (ROPA). Data Processor Contract Review - discovery all significant processes of Harsco PII data, and working with Procurement teams to ensure a suitable contract is in place. Governance – Defining the Data Management Strategy including setting up of DPO roles across multiple countries, creating local data champions, enabling a Data governance board, and defining the processes (Risk Management, Change Management, etc) to ensure good governance is in place to protect the company's PII data. IT Infrastructure – beginning with a suite of quick win activities such as rolling out laptop encryption across the entire estate; working towards mapping the IT Architecture and different ways in which data flows through the architecture, in order to address areas of vulnerability and ensure critical systems holding PII data are secure.
GDPR Program Manager
Rank Group Ltd
2017.06 - 2018.03
- GDPR Programme Manager leading a team working on 9 separate projects or workstreams all designed to assist Rank in its goal to become compliant ahead of the May 18 deadline. Reinterpreting the ICO's 12 step model to work across Rank's business. Including Security Awareness Training, Business Data Processing Risk Assessments, Critical Systems Reviews, Supplier Contract Reviews, and building Rank's DPO centric future operating model. The programme was unique in that it combined Information Security (ISO27001) with Personal Information Management System (PIMS), to enable the changes to systems, processes, governance and culture, to ensure the confidentiality, availability and integrity of Rank's systems, services and data.
Digital Security Project / Program Manager
GAME Retail Ltd
2016.01 - 2017.06
- Security Project Manager initially responsible for monitoring and managing Vulnerabilities identified during ASV Scanning and PEN Testing. Working closely with the Head of Technology Security Graham was able to help define and set up the Technology Security Programme and drive the range of specific changes necessary to improve the Security Posture at GAME. In addition to driving the Security Programme (which was aligned to ISO 27001 Controls), Graham played an active part in the PCI DSS Compliance Programme, as well as owning and leading the GDPR Compliance Programme and driving GAME's Business continuity Programme.
Digital Security Project Manager
Vodafone UK Ltd
2015.01 - 2015.12
- Digital Security Project Manager responsible for monitoring and managing Vulnerabilities identified during ASV Scanning, as well as those picked up in regular release PEN Testing.
- With priority given to Vulnerabilities that might undermine the PCI DSS Compliance goal for the Online channel. And helping to develop a BAU process for the effective management Security related Defects and Vulnerabilities going forwards.
PCI DSS Program/Project Manager
Order Dynamics Ltd
2014.09 - 2014.12
- PCI DSS Program Manager at Order Dynamics. Responsible for investigating and documenting all relevant in-scope systems and processes (Card Data Environment). This was followed up by a Gap Analysis carried out with the support of the externally appointed Qualified Security Assessor (QSA). The outcome of the Gap Analysis being a report into the areas of non-compliance. This report then converted into the Order Dynamics PCI DSS Strategy. The strategy defines Order Dynamics priorities and focus for remediating the areas of non-compliance and is the basis for the PCI DSS Programme 2014-15.
PCI Project Manager
Everything Everywhere
2012.12 - 2014.08
- Graham worked closely with the Head of Technology Security & Risk Management to develop EE's overall strategy for Security Assurance. The ultimate objective to provide a single co-ordinated strategy to maintain compliance (ISO, PCI, PSN, etc) and ensure that EE not only had the best 4G network in the UK, it could continue to provide assurance to its customers that it was the most secure as well.
- Working as “Security Projects Consultant”. Led the PSN (Public Sector Network) programme on behalf of Technology Security and Risk Management. This involved working with representatives from Public Sector (PSN-GB), Third Party PSN/CAS-T specialists (CLAS Consultants) and the EE PSN “Stakeholders” in Technology Security, Corporate Marketing and Networks. The major focus being to carry out a CAS-T Gap Analysis and identify the areas for “Remediation” that would help ensure EE continues to operate successfully in the PSN marketplace.
- Graham was originally contracted to Project Manage the EE/TMUK PCI Audit 2013, and tasked with planning and ensuring a structured approach to the 2013 Audit. Working closely with the PCI Manager at EE, the audit was completed successfully and on time, in spite of the very challenging timelines involved.
- In addition to helping define the audit structure, Graham then played an active role within the PCI Audit Team (which included the externally appointed QSA), going out to EE/TMUK sites and conducting the PCI Audit Review. This involved interviews with key stakeholders in the business, gathering in of evidence of Compliance, and more importantly documenting areas of non-compliance. The Areas of non-compliance were then vigorously reviewed with appropriate Remediation activities carried out, ahead of Re-assessment, prior to the final write-up/report on Compliance (ROC), which was then delivered to the acquiring bank at the end of March.
- In parallel, Graham's role has expanded into Programme Management. Firstly this involved the documenting and helping to shape the “Remediation” activities identified within the Audit. Graham then went on to work closely with the PCI Manager to develop the 2014/2015 PCI Strategy for EE. The strategy is a cross functional change programme, targeting all the brands within the EE family and defining the Roadmap by which EE would become compliant, in line with the target dates set by the acquiring bank.
Senior Project Manager
Vodafone UK
2008.08 - 2012.11
- Now a Senior Project Manager, Graham has been managing projects for over 10 years. Successfully managing to completion, a number of different project types. Project ranging from significant, high profile “Compliance” related deliveries whilst working as the Project Manager responsible for delivery on the Vodafone PCI DSS Programme. To large commercial projects, driven by the need to provide significant return on investment. And delivery a wide number of lower level projects, “keeping the lights on” type project, such as system upgrades.
- In addition to possessing a good delivery track record, there is also evidence of good cost/benefit management & governance, and successfully managing a number of projects to “closure”, the tough process of ensuring a clear and effective decision is made to realign scarce resource to higher priority activities.
- Major deliveries:
- PCI Zone Project, which enables the removal of PAN (Credit Card) data from Vodafone's core systems and effectively taking Vodafone's Payment systems “out of scope” for PCI DSS by setting up TLG as Payment Service Provider.
- PCI Prepay Tokenisation Project, which brought the upstream payment systems into the PCI Zone. Effectively enabling them to take TOKENs instead of PANs and ensuring the removal of sensitive customer Card Data.
- Universe Returns and Repair Management Tool Project, working closely with Vodafone Terminals (Handset) Management Team to identify requirements for the tool, working with suppliers to identify the “best in market” and finally taking that solution into “Pilot” providing evidence by with which Management could make a decision to buy. Seeking to reduce down the ever increasing cost (>£50m/year) in respect of the Repair and Return of faulty handsets, particularly Smart phones, which are getting ever more complex and difficult to manage Smart phones.
- IPT Telephony Project, working with the Vodafone Customer Management team to identify Vodafone's requirements, for what on the face of it was the simple transition of Voice over internet or IP Network (Internet Protocol). This proved a great deal more complex than at first thought, requiring the replacing of a great many different components that had evolved over a period through acquisition, as well as having to manage the change as it impacted into a contact centre network of more 6000 seats, across internal departments and external suppliers.
- Retail J (Torex) Upgrade Project, managing the upgrade of the core “front-end, Vodafone Retail system. Ensuring the successful test and deployment, minimizing the impact on Retail.
- Lesser deliveries:
- Registration Free Top Ups Project, taking the project through the Operational Acceptance phase post implementation. Ensuring that all stakeholders signed off delivery and that the service would be managed on a Business as Usual basis.
- Networks Demand Management Project, the set-up of strong and effective governance process within the Vodafone Networks Team. Enabling good visibility of the Networks “Roadmap” and creating a Governance forum to provide timely and effective decision making, in respect of continuous challenge of assessing priorities against resource limitations.
Project Manager
T-Mobile UK
2003.01 - 2008.01
- Graham first became a project manager at T-Mobile. What began as a development role or opportunity, developed over 4 years and Graham has proven his worth as a PM delivering a number of different projects and has in this period between promoted from Junior Project Manager to that of a fully fledged PM operating with T-Mobile Program Management Team Successfully managing to completion to a number of major projects as well as managing lower level projects.
- Major deliveries:
- Project Edison, this was the first bespoke project carried out by T-Mobile on behalf of its (£50m/year) business partner Virgin Mobile (MVNO). Delivering much need text and voice bundle functionality to Virgin Mobile and allowing them to compete with the other operators in this market space.
- CCOS Project, this is by far the biggest project Graham worked on whilst at T-Mobile, but also the biggest project managed by T-Mobile. The project is a major CRM led activity encompassing 8 separate Technical Delivery lasting approximately 2 years. Graham inherited the project at Design phase, took it through realization and as far as concession clearing.
- Lesser deliveries:
- COCI (XP Rollout) – managed XP roll across 30 separate TMUK cell sites.
- Lifecycle Loyalty Delivery project - Managed multi phased User Acceptance Testing across 4 separate channels.
- Projects Managed to Close Down:
- NSBR – Graham inherited this particularly difficult project and managed it through a series of integration and User in what was it's final phase of Integration and User Acceptance Test. At the end of each phase of test the challenge was to maintain the limited resource and ensure delivery of what proved finally to impossibly to delivery. A number of problems, not least of which was the quality of the source code and the fact the supplier went bust, lead to the eventual closure of the project.
- BPCU – Best Price Plan Check Up. This was by far the toughest project to close. Whilst the project enjoyed the highest level of management support there was no justifiable business case to warrant the expenditure. It took three months working within the boundaries of the Corporate Governance process to finally get management to recognize that there was no Business Case and that the project should not be “Realized”.
Senior Business Analyst
T-Mobile UK
2002.04 - 2003.08
- As a Senior Business Analyst within the CSD Solutions Design Team, Graham has played a significant part in a wide range of T-Mobile projects over an 18 month period. These included data projects such as UMTS PCB, International Projects like PWLAN and Video Messaging, as well as projects using external suppliers such as “Accept Rates” and “Behavioural Scoring”. This ever increasing range of projects has not only helped Graham to develop a broad knowledge base of T-Mobile systems and processes; it has helped him fine tune his Analyst skills and enabled him to become one of the most senior members of the Business Analysis team.
IT Consultancy
CTG (UK) Ltd
2000.09 - 2002.04
- As a consultant working for CTG, Graham learnt the importance of delivering a service or product both on time and to cost. Graham was soon able to develop a rapport with his colleagues and gained the trust of the Solution Design Management team and eventually converted to become a permanent member of the Business Analyst Team.
- Placed into One2One (Now T-Mobile (Sept 2000-Apr 2002 as an IT Business Analyst, within Business Requirements & Analysis team, Graham has successfully completed three large projects as an external consultant working at One2One.
- Fix the Basics Project Mar – Jul 2001. Project reviewing issues and concerns with existing One2One systems and processes with the aim to produce a detailed plan of activities to “Fix the Basics” based on clearly defined priorities. Graham was responsible for coordinating all aspects of the project and ensuring the successful delivery of the agreed deliverables and in effect Project Managed In all but name.
- Evaluation of the One2One Project Management Tool (Dec – Mar 2001). Purpose of which was to gather all the One2One user requirements in terms of a Project Management Facility and provide a list of potential “Quick wins” en route to implementing such a tool.
- Reference Data Integrity Project (Sep-Dec 2000). Project to review the existing process of upgrading/maintaining the “Billing” Reference Tables and ensuring integrity of the data held therein.
Business Systems Analyst
Safeway Stores Plc
1999.08 - 2000.08
- Business Systems Analyst in Safeway's IT department, Graham was a key first point of contact for the Marketing and Retail departments. Working closely with Business Users and IT Developers it was Graham's responsibility to carry out the initial feasibility study leading to the production of a Business Case/Project Proposal for presentation to the Operational Board in order to approve the use of IT Development resource. Specific achievements included:-
- ABC Customer History/Data Management Project, a brief development designed to ensure Safeway continued to remain Data Compliant in respect of the ABC customer database, and more importantly could successfully respond to the challenging of providing this data “on Request”.
- Remote Shopping, a wide ranging program of activities designed to enable the Safeway customer to shop remotely using the access platform most suited to their personal needs. e.g. Internet, PDA, WAP Phone, Digital TV, Telephone or Fax. The most exciting moment for me whilst working on the program was acting a Company liaison to the BBC and being invited to demonstrate the Safeway Remote shopping product for BBC's Food and Drink Program.
- Till Prompts for Age Restricted products, a vital systems development work designed to support the sale of Age Restricted products (e.g. Knives, Tobacco, videos) with a view to ensuring full compliance with Trading Standards regulations. Specific interest being to ensure that Till Staff were provided with the support they needed to avoid the heavy fines imposed by the regulator.
- Chart Information Networks, an exciting and high profile project designed to provide up to the minute sales data on videos, CDs and books for the purpose of feeding that information to the companies that create the “Top 20” music, book and video charts.
Process Analyst
Sun Life of Canada
1999.04 - 1999.08
- Graham was the Business Analyst responsible for the creation of a procedure manual designed to support the requirement for continuous and on-going staff training, within the specialist area set up to support the Sun Life of Canada Demutualisation process.
Telephony Analyst
Winterthur UK Ltd
1998.08 - 1999.03
- As a Business Analyst working as the Telephony expert within a wider Change Management team, it was Graham's responsibility to find ways in which to improve the “Pensions Helpdesk”. Responsibilities included:-
- Project managed Call Centre “Telephony” upgrade designed to meet increased customer demand.
- Set up consistent and effective Call Centre Management Information/Reporting processes.
- Introduced service Standards and Performance Measurement at team and individual level.
- Re-engineered Winterthur's PPA Call Centre into a more effective customer-facing unit.
Multiple Roles
Prudential Assurance Co Ltd
1989.01 - 1998.01
- Graham benefited from a variety of roles in his career with the Prudential, each one offering different responsibilities and challenges.
- Business Analyst (1997-1998). Business Analyst responsible for the Benefit Measurement aspect of the Conservation Project (Prudential National Sales Ops), capturing, analysing and reporting upwards in respect of Customer Retention data.
- Project Analyst (1996-1997). Project Analyst working on the £3.8m Retail Telephony program: with the objective, to simplify customer contact. To reduce contact route options from more than 80 down to 1.
- Call Centre Supervisor (1995-1996). Working in the second Call Centre to be set up by the Prudential, specifically set up to manage calls re-routed from Local branches. Leading a team of 10 Contact Centre Agents, as well as being responsible for the Contact Centre Management Information and Analysis.
- Pension Tele-Consultant (1993-1995). Tele-Consultant on the first ever Contact Centre in the Prudential. This high-profile project provided Graham with a platform to develop his communications skills. More importantly by playing an active role in internal projects designed to gain a fuller understanding of the Call Centre environment (e.g. Tele-appointing and Call Diversion), Graham quickly developed a good understanding of this new business phenomenon.
- Pensions Administrator (1989-1993). Pensions Administrator dealing with both customer and sales force queries, Graham developed a strong understanding of the UK Pensions and Finance industries.
Education
A-Levels - French Literature
BTEC
Basingatoke 1990.01 - 1991.01
A-Levels - International Relations, Economics
Queen Mary's College
Basingstoke 1983.01 - 1986.01
GCSEs - Maths, English, International Relations, Economics
BTEC
Basingstoke, Hampshire 1983.01 - 1984.01
GCSEs - French Language
BTEC
Basingstoke, Hampshire 1989.01 - 1990.01
GCSEs - Physics, Chemistry, Geography,
Fort Hill Secondary School
Basingstoke, Hampshire 1978.01 - 1983.01
Skills
- Stakeholder Management and Programme
- Project and Programme Management
- Risk & Issue Management
- Managing Third Party Teams & Contract Management
- 20 years working on Cyber Security Programmes
- Project manager who is innovative and adaptable
- Presentation and Facilitation Skills
- Recruiting /Training / Mentoring staff
- Security Cleared (expired)
- Extensive experience of UK Telecoms sector including MVNOs
- Strong understanding of UK Pensions and Finance Industries & UK Retail sector
- And 3 years of experience in the Gaming and Gambling industries
Certification
- GDPR Foundation May 2017
- Member of BCS, The Chartered Institute for IT
- Business Case Development (2012)
- Planview a Project Management Tool (2011)
- Stakeholder Management and Communications (2011)
- Change Management Capability (2010)
- Effective Presentations (2010)
- SAP User & Enterprise Buyer (Refreshed as part of Vodafone's EVO Program 2010)
- Introduction to NLP (Updated in 2009)
- Understanding VF Retail (2009)
- Influencing with Integrity (2008)
- Managing Risk (2007)
- PRINCE 2 Foundation & Practitioner (Passed)
- Facilitation Skills (2003 Refreshed in 2007)
- Dynamic Systems Development Method (DSDM 2000)
- MS Project (Advanced) (2000 and refreshed in 2006)
- Organisation Methods (Process Analysis) Harry Mitchell College (1997)
Personal Data
- Status: Married with two grown children
- Driving licence: Full
- Nationality: British
Areas of Expertise
- Organisational
- Working with dedicated project resources, including recruitment and formation of project teams with defined roles, responsibilities and accountabilities.
- Working in a matrix management environment ensuring clear definition of roles, deliverables and timescales.
- Commercial & Financial
- Excellent financial control operating with budgets
- Proven track record when securing the best from external suppliers such as Accenture, Amdocs, Avaya, Detica, HP, TLG, Tech Mahindra, Sysnet, PTP Consulting and NCC.
- As well as successfully delivery when operating as “supplier”, delivering into Partner & MVNO organisations such as Virgin Mobile, Carphone Warehouses.
- Interpersonal
- Successfully developed relationships with both internal and external customers and suppliers to ensure expectations were matched with real requirements and achievable solutions and timescales.
- Numerous examples of successful matrix and direct management by motivation and management by objectives, rewards and target setting.
- Operational
- Successful implementation of new PCI Compliant Payments Service, responding to the all the unique “operational” challenges of setting up and bringing a new service “on-line” for the first time.
- Directed the development and implementation of an information security intranet site for TMUK.
Timeline
Information Security Project Manager
SGN Ltd
2025.02 - 2026.03
Information Security Project Manager
Carnival UK Ltd
2021.12 - 2024.12
Information Security Programme Manager
Le Creuset Ltd
2020.09 - 2021.07
PCI DSS Project / Cyber Programme Manager
Travelex Ltd
2018.09 - 2020.04
GDPR Program Manager
Harsco Ltd
2018.03 - 2018.06
GDPR Program Manager
Rank Group Ltd
2017.06 - 2018.03
Digital Security Project / Program Manager
GAME Retail Ltd
2016.01 - 2017.06
Digital Security Project Manager
Vodafone UK Ltd
2015.01 - 2015.12
PCI DSS Program/Project Manager
Order Dynamics Ltd
2014.09 - 2014.12
Director
Rumour Solutions Ltd
2012.12 - 2026.04
PCI Project Manager
Everything Everywhere
2012.12 - 2014.08
Senior Project Manager
Vodafone UK
2008.08 - 2012.11
Project Manager
T-Mobile UK
2003.01 - 2008.01
Senior Business Analyst
T-Mobile UK
2002.04 - 2003.08
IT Consultancy
CTG (UK) Ltd
2000.09 - 2002.04
Business Systems Analyst
Safeway Stores Plc
1999.08 - 2000.08
Process Analyst
Sun Life of Canada
1999.04 - 1999.08
Telephony Analyst
Winterthur UK Ltd
1998.08 - 1999.03
A-Levels - French Literature
BTEC
1990.01 - 1991.01
GCSEs - French Language
BTEC
1989.01 - 1990.01
Multiple Roles
Prudential Assurance Co Ltd
1989.01 - 1998.01
A-Levels - International Relations, Economics
Queen Mary's College
1983.01 - 1986.01
GCSEs - Maths, English, International Relations, Economics
BTEC
1983.01 - 1984.01
GCSEs - Physics, Chemistry, Geography,
Fort Hill Secondary School
1978.01 - 1983.01