GRC Audit & Assurance Consultant

Dimension Data Solutions Limited (Kenya); United Kingdom; Remote; GBP 70,000 - 100,000; Full time

Job summary

NTT DATA is seeking a Lead GRC Consultant to drive governance, risk and compliance activities across a complex cyber security programme. You will perform evidence-led assurance, gap assessment and remediation planning, coordinating with IT and OT stakeholders to ensure control effectiveness and traceability.

The role requires solid experience in structured GRC assessments, control design evaluation and reporting to senior management, with a focus on maintaining compliance and security maturity

Qualifications

• Current PriCSP (Audit) certification is mandatory.
• Strong practical experience in cyber security governance, risk and compliance, assurance, and maturity assessment.
• Experience delivering structured gap assessments against cyber security frameworks or regulatory requirements.
• Experience with NCSC CAF/eCAF assessments or similar control-based assurance frameworks.
• Strong evidence-assessment capability and traceability of evidence.

Responsibilities

• Lead GRC assessment and assurance across programme scope with multiple stakeholders.
• Review policies, standards, procedures, artefacts and risk information to verify controls.
• Consolidate findings into maturity, gap and readiness views for governance bodies.
• Develop remediation recommendations and support remediation planning.

Skills

PriCSP certification

Cyber security governance

Risk management

Compliance

Audit

Job description

Make an impact with NTT DATA

Join a company that is pushing the boundaries of what is possible. We are renowned for our technical excellence and leading innovations, and for making a difference to our clients and society. Our workplace embraces diversity and inclusion - it's a place where you can grow, belong and thrive.

The Lead GRC Consultant will lead and deliver governance, risk, compliance and assurance activities across a complex cyber security programme. The role combines structured GRC assessment with evidence-led assurance, control and process review, gap assessment, remediation planning and stakeholder engagement. The consultant will work across IT and OT environments, using frameworks such as the NCSC Cyber Assessment Framework (CAF) where applicable, while maintaining a broader focus on security governance, risk management, compliance and control effectiveness.

Key Responsibilities

• Lead GRC assessment and assurance activities across the agreed programme scope, coordinating inputs from cyber security, risk, compliance, architecture, IT and OT stakeholders.
• Perform evidence-led assurance by reviewing policies, standards, procedures, technical artefacts, operational records, risk information and other supporting evidence to determine whether stated controls and practices are demonstrably implemented.
• Conduct structured gap assessments against agreed regulatory, contractual and security-framework requirements, including NCSC CAF/eCAF where applicable.
• Review and challenge customer self-assessments, control assertions and supporting rationale, identifying supported, partially supported, unsupported or contradictory positions.
• Assess governance arrangements, risk-management processes, control ownership, policy frameworks, assurance processes, evidence management and compliance reporting.
• Facilitate interviews, workshops, walkthroughs and challenge sessions with business, technical and operational stakeholders.
• Maintain clear traceability between requirements, controls, evidence, findings, risks, recommendations and remediation actions.
• Distinguish between control deficiencies and evidence deficiencies, and clearly document assessment limitations or areas requiring further validation.
• Develop evidence-based findings with clear criteria, observed condition, supporting evidence, risk/impact and proportionate recommendation.
• Assess control design and, where sufficient evidence is available, operating effectiveness and sustainability of controls.
• Consolidate assessment findings into maturity, gap and readiness views for senior stakeholders and programme governance.
• Develop prioritised remediation recommendations, target control outcomes and evidence requirements, and support remediation planning and tracking.
• Review remediation evidence and determine whether findings can be validated as addressed, partially addressed or remain open.
• Contribute to executive reporting, audit/readiness reporting, regulatory preparation and management briefings.
• Apply internal quality assurance and peer-review expectations to ensure conclusions are consistent, evidence-based and defensible.

Leadership Responsibilities

• Provide day-to-day leadership and direction to GRC assessors and supporting consultants.
• Allocate assessment areas and review working papers, evidence mapping, findings and scoring for consistency and quality.
• Establish a consistent assessment and evidence-evaluation approach across the team.
• Challenge unsupported conclusions and ensure professional judgements are evidence-based and clearly documented.
• Coordinate with technical specialists so relevant IT/OT findings are appropriately incorporated into GRC and compliance assessments.
• Escalate material evidence gaps, scope limitations, dependencies and risks through the agreed governance route.
• Present findings, maturity positions, risks and recommendations to customer SMEs, management and executives.

Essential Experience

• Current PriCSP (Audit) certification/accreditation is mandatory for this role.
• Strong practical experience in cyber security governance, risk and compliance, assurance, audit or security maturity assessment.
• Demonstrable experience delivering structured gap assessments against recognised cyber security frameworks, standards or regulatory requirements.
• Experience with NCSC CAF/eCAF assessments or comparable control-based assurance frameworks.
• Strong evidence-assessment capability, including determining relevance, sufficiency, reliability, currency, consistency and traceability of evidence.
• Experience reviewing security policies, standards, procedures, risk registers, control evidence, architecture artefacts and operational records.
• Experience assessing control design and, where appropriate, control implementation and operating effectiveness.
• Strong stakeholder interviewing, workshop facilitation and challenge skills across technical, operational and senior-management audiences.
• Ability to write clear, defensible findings and recommendations