Cyber Security Governance & Assurance Specialist

BT Group; Greater London, Salford; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

10% bonus on target

Private GP 24/7

Carers leave

Parental leave 18 weeks

BT product discounts

Pension scheme

Holiday purchase scheme

Job summary

BT Group is seeking a Cyber Security Governance & Assurance Specialist to lead governance, risk and compliance across customer platforms, embedding secure design and assurance into architecture and delivery pipelines. You will champion security controls, drive audits, and partner with engineering teams to reduce information risk while meeting regulatory obligations.

The role requires experience in security governance, risk management and GRC tooling, with the ability to translate risk into

Qualifications

• Security Assurance & Governance Experience (e.g. assurance reviews, control testing, audit support, governance forums)
• Governance, Risk Management, Compliance & GRC Tooling (e.g. risk assessments, remediation activities, compliance reporting, governance platforms/GRC tools)
• Policy, Standards & Control Framework Design (e.g. ISO27001, NIST, CIS)

Responsibilities

• Identifies, evaluates and reports on cyber security risks in a manner that meets the Group's internal, regulatory and other compliance requirements.
• Collaborates with internal departments and organisations to implement practices that meet the Group's defined policies and standards for information risk management.
• Delivers the rigorous assessment of internal compliance, informing and advising on data protection obligations, acting as a contact point for data subjects.
• Contributes to the ongoing development and management of frameworks pertaining to Information Governance (IG), Cyber Security and Data Protection.
• Ensures the adherence to policies and procedures to support requirements to enable the group to meet its legal, contractual and statutory obligations while reducing the cyber security and information risk exposure.
• Executes activities in support of cyber security owned programs and related teams including security policies, vendor risk and compliance management, regulatory audits and compliance management, metrics, risk and performance indicators, executive and board reporting, security awareness and training, security integration and assessment of M&A and related ventures.
• Supports lines of business to perform security assessments and ensures timely execution of projects and programs while mitigating any security risks.
• Executes the evaluation of cyber security controls to ensure effectiveness, compliance and adherence to key controls and policies and drive its remediation efforts.
• Implements analysis of key GRC risk information, including the cyber risk register, policy exceptions, audit findings and data security reviews and the preparation of reporting and dashboards as necessary to satisfy the Group's cyber reporting requirements at both a management and executive level.
• Monitors cyber compliance portals and acts as the liaison with communication groups driving awareness and adoption of cyber policies and standards across the BT Group.
• Leads liaison for cyber audits and maturity assessments assisting with reviews and providing artefacts as needed.
• Mentors other Cyber Security Governance & Assurance professionals, helping to improve the team's abilities by acting as a technical resource.
• Champions, continuously develops and shares with team knowledge on emerging trends and changes in Cyber Security Governance & Assurance.

Skills

Security governance

GRC tooling

Policy & standards

Tools

GRC tools

Job description

Job Description

Job Title: Cyber Security Governance & Assurance Specialist

Req ID: 59973

Job Function: Cyber Security

Posting Start Date: 26/10/2026

Posting End Date: 01/11/2026

Division: Digital

Job Location: GBR-London-BTHQ One Braham, GBR-Manchester-New Bailey

Advertised Salary: Competitive + Benefits

Location

This role can be based out of our New Bailey Manchester office, or our One Braham London office. We have a hybrid working model of 3 days together and 2 days wherever.

Due to the nature of the work, you will need to be elegible for security clearance+.

About the role

BT Business provides large scale multi-year contracts to government departments. The Secure Engineering team, Digital is accountable for ensuring the development, connectivity, and maintenance of multiple Service Management Platforms to recover revenue of more than £400m per annum.

This role supports the delivery and assurance of cyber security controls for UK Government customers, ensuring the protection of sensitive data and systems is embedded as a core principle within solution design. You will ensure that security requirements, risk considerations, and compliance obligations are integrated into architecture and design decisions from the outset, aligned to relevant government and industry security standards.

As a Cyber Security Governance & Assurance Specialist, you will be responsible for establishing, maintaining, and assuring the effectiveness of security governance frameworks, risk management processes, and control environments across customer platforms. This includes defining and enforcing security policies, standards, and baselines aligned to recognised frameworks such as ISO27001, NIST, and CIS.

You will lead risk identification and assessment activities, perform control validation and assurance testing, and support internal and external audit processes. Working closely with infrastructure, cloud, and engineering teams, you will ensure security controls are embedded by design across architectures and delivery pipelines, with clear traceability to risk and compliance requirements.

You will also act as a key interface between technical teams and business stakeholders, translating complex security risks into measurable business impact, and driving remediation through structured governance forums. Your focus will be on continuous improvement of the control landscape, ensuring security posture is measurable, auditable, and aligned to both regulatory obligations and customer expectations.

What you’ll be doing

• Identifies, evaluates and reports on cyber security risks in a manner that meets the Group's internal, regulatory and other compliance requirements.
• Collaborates with internal departments and organisations to implement practices that meet the Group's defined policies and standards for information risk management.
• Delivers the rigorous assessment of internal compliance, informing and advising on data protection obligations, providing advice regarding Data Protection Impact Assessments, acting as a contact point for data subjects.
• Contributes to the ongoing development and management of frameworks pertaining to Information Governance (IG), Cyber Security and Data Protection.
• Ensures the adherence to policies and procedures to support requirements to enable the group to meet its legal, contractual and statutory obligations while reducing the cyber security and information risk exposure.
• Executes activities in support of cyber security owned programs and related teams including security policies, vendor risk and compliance management, regulatory audits and compliance management, metrics, risk and performance indicators, executive and board reporting, security awareness and training, security integration and assessment of M&A and related ventures.
• Supports lines of business to perform security assessments and ensures timely execution of projects and programs while mitigating any security risks.
• Executes the evaluation of cyber security controls to ensure effectiveness, compliance and adherence to key controls and policies and drive its remediation efforts.
• Implements analysis of key GRC (governance, risk and compliance) risk information, including the cyber risk register, policy exceptions, audit findings and data security reviews and the preparation of reporting and dashboards as necessary to satisfy the Group's cyber reporting requirements at both a management and executive level.
• Monitors cyber compliance portals and acts as the liaison with communication groups driving awareness and adoption of cyber policies and standards across the BT Group.
• Leads liaison for cyber audits and maturity assessments assisting with reviews and providing artefacts as needed.
• Mentors other Cyber Security Governance & Assurance professionals, helping to improve the team's abilities by acting as a technical resource.
• Champions, continuously develops and shares with team knowledge on emerging trends and changes in Cyber Security Governance & Assurance.

Essential Skills / Experience

• Security Assurance & Governance Experience (e.g. assurance reviews, control testing, audit support, governance forums)
• Governance, Risk Management, Compliance & GRC Tooling (e.g. risk assessments, remediation activities, compliance reporting, governance platforms/GRC tools)
• Policy, Standards & Control Framework Design (e.g. ISO27001, NIST, CIS)

Desirable Skills / Experience

• Certifications relevant to cyber security, governance, or risk management (e.g. CISSP, CISM, CRISC, ISO27001 Lead Implementer/Auditor or equivalent)
• Experience in regulated industries (e.g. telecoms, finance, public sector)
• Exposure to audit management and external certification processes
• Knowledge of cloud security governance and modern security practises (DevSecOps, Zero Trust)
• Experience influencing security culture and driving awareness across teams
• Familiarity with BT or similar large-scale enterprise environments

Our Package

• 10% on target annual bonus
• Access to an online private GP 24/7 for you and your immediate family
• Market-leading paid carers leave with up to 2 weeks off
• Equalized maternity, paternity, and adoption leave – 18 weeks’ full pay and 8 weeks’ half pay
• Discounted EE and BT products, including mobile and broadband
• Market leading Pension scheme – 5% from you and 10% from us
• Holiday purchase scheme

You can select additional benefits, including healthcare, dental, gym memberships and more when you’re ready.

BT Group is the UK’s leading communications group and the holding company behind some of the country’s most recognised brands – including BT, EE, Openreach and Plusnet. Our purpose is as simple as it is ambitious: we connect for good. Our customers include consumers, small, medium and large businesses, public sector organisations and other communications providers.

BT Group’s role is about setting direction, unlocking value and creating the conditions for our brands and businesses to thrive.

Having come through the most capital-intensive phase of our fibre investment, our focus now is on what comes next – simplifying how we operate, using technology and AI to work smarter, and organising ourselves to serve customers better and grow sustainably. Group teams shape strategy, policy, brand, capital allocation and transformation, helping the whole organisation perform at its best.

We have a singular culture that unites all our people: we are customer‑first challengers, who are committed, clear and connected. These behaviours unite us as one team to deliver for our colleagues, our customers, our stakeholders and the country. Joining BT Group means working at the heart of a business that matters to the UK, with the opportunity to shape decisions, influence outcomes and help set the future course of one of the country’s most important companies.