Cyber Governance, Risk & Compliance Lead (GRC)

Fruition Group; Leeds; Remote; GBP 36,000 - 60,000; Full time

Benefits offered by this job

Car allowance

Package

Job summary

Fruition Group seeks a Cyber Governance, Risk & Compliance Lead to shape the Group's cyber governance framework across subsidiaries. The Leeds-based role includes a remote element with travel, focusing on risk assessment, policy development and audit readiness to support ISO 27001 across the portfolio.

You will work with IT, legal, privacy and operations to implement controls, review risk registers and coordinate audits as the Group grows through acquisitions.

Qualifications

• Experience across cyber security governance, risk and compliance.
• Strong knowledge of ISO 27001 with audit/certification experience.
• Practical experience with NIST and CIS security frameworks.
• Experience conducting cyber risk assessments and security maturity reviews.
• Experience managing cyber risk registers and audit readiness.
• Ability to coordinate internal/external security audits.
• Strong stakeholder management across multiple business units.
• Ability to translate security risks for technical and non-technical audiences.
• Pragmatic, flexible approach working across organisations with varying maturity.

Responsibilities

• Act as main point of contact for cyber governance, risk and compliance.
• Maintain and challenge IT and cyber risk registers with remediation plans.
• Support subsidiaries with ISO 27001 compliance and audits.
• Carry out cyber risk and maturity assessments using recognised frameworks.
• Assist integration of acquired businesses into governance and security frameworks.
• Develop and maintain information security policies and procedures.
• Manage the Group Cyber Incident Response Plan.
• Collaborate with IT, legal, privacy and business teams to implement controls.
• Review vulnerabilities and recommend mitigations.
• Support third-party and supplier security assurance activities.
• Produce cyber risk and assurance reporting for senior stakeholders.
• Build relationships with subsidiary IT teams as trusted governance contacts.

Skills

Cyber governance

Risk management

ISO 27001

NIST

CIS Controls

Audit readiness

Stakeholder management

Security risk assessments

Communication of security risks

Flexible / pragmatic approach

Job description

Cyber Governance, Risk & Compliance Lead

Salary: Up to £60k + car allowance + package
Location: Leeds (Remote role with some travel)

Why Apply?

This is an opportunity to join a stable and growing organisation in a key Group-level cyber security role, working across a diverse portfolio of subsidiary businesses.

As Cyber Governance, Risk & Compliance Lead, you will play a central role in maintaining and developing the Group's cyber governance framework, supporting subsidiaries with security compliance, audit readiness and risk management.

You will also play an important role in integrating newly acquired businesses into the Group's cyber governance framework, building relationships with subsidiary IT teams and helping to establish consistent standards across the organisation.

Cyber Governance, Risk & Compliance Lead Responsibilities

Reporting to the Group Information Security Officer, you will act as a key point of contact for cyber governance, risk and compliance activity across the Group.

Responsibilities will include:

• Acting as the main point of contact for cyber security audits and audit readiness across the Group.

• Maintaining, reviewing and challenging IT and cyber risk registers, ensuring appropriate remediation and risk treatment activity is in place.

• Supporting subsidiaries with ISO 27001 compliance, audits and ongoing certification requirements.

• Carrying out cyber risk assessments and security maturity assessments using recognised frameworks including NIST and CIS Controls.

• Supporting the integration of newly acquired businesses into the Group's cyber governance and security frameworks.

• Developing, reviewing and maintaining information security policies, standards and procedures.

• Managing and maintaining the Group Cyber Incident Response Plan.

• Working with IT, infrastructure, architecture, legal, privacy and business teams to ensure appropriate security controls are implemented.

• Reviewing vulnerabilities and cyber risks, articulating their potential impact and recommending appropriate controls and mitigations.

• Supporting third-party and supplier security assurance activity.

• Producing cyber risk, compliance and assurance reporting for senior stakeholders.

• Building strong relationships with subsidiary IT teams and acting as a trusted point of contact for cyber governance matters.

Required Skills/Experience

We are looking for an experienced Cyber GRC professional who can operate independently and quickly become a trusted point of contact across the Group.

You should have:

• Strong practical experience across cyber security governance, risk and compliance.

• Good knowledge of ISO 27001, including experience supporting or leading audit and certification activity.

• Practical experience working with NIST and CIS security frameworks.

• Experience conducting cyber risk assessments, control assessments or security maturity reviews.

• Experience reviewing and managing cyber or technology risk registers.

• Experience coordinating internal or external security audits and managing audit readiness.

• The ability to assess cyber security risks and vulnerabilities and recommend appropriate mitigation.

• Strong stakeholder management skills with the ability to build relationships across multiple business units.

• The ability to translate technical security risks into clear information for technical and non-technical audiences.

• A pragmatic and flexible approach to working across organisations with different levels of cyber maturity.

What's in it for me?

This is a varied Group-level role offering the opportunity to work across multiple subsidiary businesses and influence cyber governance standards across a growing organisation.

You will join an established security environment, with several Group businesses already operating to ISO 27001 standards, while having the opportunity to further mature cyber governance, support new acquisitions and develop consistency across the wider Group.

Fruition are an equal opportunities employer and welcome applications from all suitably qualified persons regardless of their race, sex, disability, religion/belief, sexual orientation or age.