Head of Information Security GRC & Awareness

Tria; Greater London; On-site; GBP 150,000 - 200,000; Full time

Job summary

A leading security consulting firm is seeking a Head of InfoSec GRC & Awareness to oversee governance, risk, compliance, and security awareness initiatives. The ideal candidate will have extensive experience in information security and strong professional certifications. Responsibilities include leading security policy development, managing third-party assurance processes, and ensuring audit readiness. This pivotal role is crucial for maintaining security resilience as the organization undergoes significant modernization.

Qualifications

• Professional certifications such as CISSP, CISM, ISO27001 Lead Auditor, CLAS.
• Extensive experience in information security or IT governance.
• Strong knowledge of security frameworks (e.g., ISO/IEC 27001, NIST CSF).

Responsibilities

• Lead the development and enforcement of information security policies.
• Drive security governance and cyber maturity through compliance.
• Manage audit readiness and support internal/external audit activities.

Skills

CISSP

CISM

ISO27001 Lead Auditor

CLAS

Risk management

Policy development

Security awareness initiatives

Communication skills

Leadership skills

Third party due diligence

Job description

Location: London (onsite 2 days per week) Duration: 6 months

Rate: Inside IR35, rate to be discussed

Are you an experienced Head of Information Security Governance, Risk and Compliance looking for your next opportunity to make an impact within an evolving and fast paced environment? Do you have strong experience of leading 3rd party security assurance processes? If so, apply now.

We are seeking an experienced Head of InfoSec GRC & Awareness to lead governance, risk, compliance, and security awareness initiatives across an organisation at a time of significant modernisation. This pivotal role ensures a robust security posture by developing and enforcing policies, standards, and training programmes aligned with business objectives and regulatory requirements.

Key Responsibilities

• Lead the development and enforcement of enterprise–wide information security policies and standards.
• Drive security governance and cyber maturity through compliance, assurance reviews, and gap analysis.
• Oversee the Information Security Risk Management process
• Conducting in depth supplier due diligence / third party assurance processes
• Manage audit readiness and support internal/external audit activities.
• Own and deliver the organisation's security awareness programme, including campaigns and tailored training.
• Depending on the candidate, you would also be involved in developing and implementing an Operational Technology (OT) Security Assurance Framework.

Qualifications & Skills

• Professional certifications such as CISSP, CISM, ISO27001 Lead Auditor, CLAS etc
• Extensive experience in information security or IT governance within large, complex environments.
• Strong knowledge of security frameworks (ISO/IEC 27001, NIST CSF, CIS Controls, Cyber Essentials).
• Proven track record in risk management, policy development, and security awareness initiatives.
• Excellent communication, leadership, and influencing skills.
• Very strong experience of driving 3rd party due diligence
• Any experience of driving Technical Assurance, Operational Technology (OT) Security Assurance and Penetration Testing would be a bonus

This is an excellent opportunity to lead a critical function within a dynamic organisation, ensuring security resilience and cultural change across the enterprise.

The rate is competitive and we can discuss this directly. For further information, please apply and I will be in touch.

Head of InfoSec GRC & Awareness