GRC Consultant

identifi Global Resources; Reading; Hybrid; GBP 94,000 - 127,000; Part time

Job summary

identifi Global Resources is seeking experienced GRC and Risk & Assurance consultants to support a major Defence programme in Reading. You will embed Secure by Design, conduct risk assessments, and provide ongoing assurance across the delivery lifecycle.

Ideal candidates will have strong cyber security risk and governance experience, familiarity with NIST/ISO 27001/CAF, and the ability to engage with technical teams and senior stakeholders. Hybrid working with UK sites is offered.

Qualifications

• Extensive experience in Cyber Security Risk, Assurance, GRC or Information Assurance.
• Practical knowledge of Secure by Design.
• Strong risk assessment and risk management experience.
• Familiarity with security frameworks such as NIST, ISO 27001, CAF.
• Ability to review technical solutions from a security risk perspective.
• Excellent stakeholder management with senior stakeholders.
• Active security clearance.

Responsibilities

• Embed Secure by Design throughout the programme and delivery lifecycle.
• Conduct security risk assessments and assurance reviews.
• Identify, assess, document and manage information security risks.
• Maintain risk registers, treatment plans and assurance documentation.
• Develop security policies, standards and governance docs.
• Assess security controls and identify gaps and remediation.
• Collaborate with security architects and project teams.
• Support security governance forums and risk reviews.
• Gather evidence to demonstrate controls are implemented.

Skills

Cyber security risk

GRC

Information assurance

Secure by Design

Risk management

Stakeholder management

Security governance

Security controls

Security clearance

Job description

GRC / Risk & Assurance Consultants – Secure by Design (MOD)

Circa £600/day | Outside IR35 | Hybrid – Reading (1–2 days onsite)

We are looking for experienced GRC, Risk & Assurance Consultants to to join a specialist consultancy delivering a major Defence programme in Reading.

As a consultancy they work extensively with UK Government and Defence organisations, supporting the transformation of their operations, digital infrastructure and security capabilities. They are currently leading a number of high-profile cyber risk programmes, helping embed effective security risk management and assurance across complex digital and technology environments.

As part of this engagement, you will work closely with security, architecture, engineering, delivery and governance stakeholders to embed Secure by Design principles, identify and manage cyber security risks, and provide assurance throughout the delivery lifecycle.

WHAT WILL YOU DO?

• Embed Secure by Design principles throughout the programme and delivery lifecycle.
• Conduct security risk assessments and assurance reviews.
• Identify, assess, document and manage information security risks.
• Maintain Risk registers, treatment plans and Security assurance documentation.
• Develop Security policies, standards and supporting governance documentation.
• Assess security controls and identify assurance gaps and remediation requirements.
• Work closely with security architects, technical teams, programme stakeholders and assurance functions.
• Support security governance forums, risk reviews and assurance activities.
• Gather and assess evidence to demonstrate that security requirements and controls have been implemented effectively.

WHAT YOU NEED TO BE SUCCESFUL?

• Strong experience within Cyber Security Risk, Assurance, GRC or Information Assurance.
• Practical knowledge and experience of Secure by Design (SbD).
• Strong security risk assessment and risk management experience.
• Good understanding of security controls, governance and assurance processes.
• Familiarity with recognised security frameworks and standards such as NIST, ISO 27001, Cyber Assessment Framework (CAF)
• Ability to review technical solutions from a security risk and assurance perspective.
• Strong stakeholder management skills with the ability to engage effectively with technical teams, architects, delivery teams and senior stakeholders.
• Active security clearance

NICE TO HAVE, BUT NOT ESSENTIAL

• Previous experience within Defence, Government, Critical National Infrastructure or other highly regulated environments.
• Previous experience with UK Government security principles, guidance and assurance approaches.
• Relevant certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor or equivalent.

WHAT IS ON THE OFFER?

• Onsite Requirement: Typically visits 1–2 days per week
• Contract Duration: until the end of the year, with probability to extend through 2027