GRC & Information Security Lead — Gov’t Risk & Compliance

Cabinet Office; Norwich; On-site; GBP 70,000 - 90,000; Full time

Job summary

The Cabinet Office is seeking an Information Security Governance, Risk & Compliance (GRC) Manager to lead the GRC team and shape the department's cyber governance strategy. You will ensure GovS 007 alignment, oversee GovAssure, and embed Secure by Design across digital initiatives.

You'll provide risk guidance to SIROs, represent security on governance boards, manage budgets and GRC tooling, and drive continuous improvement in cyber risk management across complex digital transformation

Qualifications

• Subject matter expert on cyber risk management, security policy, and enterprise assurance.
• Leads and develops the GRC team to drive the departmental cyber governance strategy.
• Provides risk advice to System Owners, SIROs, and Risk Committees.

Responsibilities

• Drive the departmental cyber security governance strategy in line with GovS 007 and the NCSC CAF.
• Manage GovAssure across the Cabinet Office and support service owners.
• Embed Secure by Design across the lifecycle of departmental digital and data projects.
• Represent Cyber Security on governance boards and present risk trade-offs to leadership.
• Manage budgets and act as contract manager for GRC tooling and security education platforms.
• Own the cyber risk framework and mature the Cyber Risk Register.
• Drive third-party and supply chain assurance and deliver risk intelligence to senior leadership.
• Lead cyber compliance efforts and align with CIS Controls and MITRE ATT&CK.

Job description

The Cabinet Office is seeking an Information Security Governance, Risk & Compliance (GRC) Manager to lead the GRC team and shape the department's cyber governance strategy. You will ensure GovS 007 alignment, oversee GovAssure, and embed Secure by Design across digital initiatives.

You'll provide risk guidance to SIROs, represent security on governance boards, manage budgets and GRC tooling, and drive continuous improvement in cyber risk management across complex digital transformation