Information Security Governance, Risk & Compliance Manager (GRC)

Government Recruitment Service; Greater London; On-site; GBP 59,000 - 71,000; Full time

Job summary

Government Recruitment Service is seeking an Information Security Governance, Risk & Compliance Manager (GRC) to lead the department's cyber governance program in London. You will drive risk-based decision making, align security policy with GovS 007, CAF, ISO 27001 and NIST CSF, and lead the central GRC function across the department.

You will provide expert risk advice to senior leaders and system owners, manage a GRC toolkit, and oversee assurance activities across the enterprise, ensuring

Qualifications

• Experience in cyber risk management and enterprise governance.
• Knowledge of GovS 007, CAF, ISO 27001 and NIST CSF.
• Experience leading a GRC team and providing risk guidance to senior stakeholders.

Responsibilities

• Drive the department's cyber security governance strategy and ensure alignment with GovS 007 and CAF.
• Lead the GovAssure programme and embed Secure by Design across initiatives.
• Own the cyber risk framework, policies, standards and risk thresholds for the department.
• Manage third-party and supply chain cyber risk assurance and engage with governance boards.

Skills

Risk management

Governance

Security policy

Stakeholder management

Leadership

Job description

Information Security Governance, Risk & Compliance Manager (GRC)

Cabinet Office Digital sits at the heart of UK government, delivering user-centred digital services, robust technology infrastructure, and progressive digital capability across the Cabinet Office and beyond. Our mission is to make government work better for citizens by modernising legacy systems, championing innovative technologies including secure cloud and AI, and embedding world-class security into every phase of service delivery. We foster an inclusive, collaborative, and agile environment where technical excellence and public value go hand in hand.

The Role:

As the Information Security Governance, Risk & Compliance (GRC) Manager, you will serve as the departmental subject matter expert on cyber risk management, security policy, and enterprise assurance. Reporting directly to the Head of Information Security, you will lead and develop the GRC team to drive the departmental cyber governance strategy, ensuring critical systems and digital services remain resilient against evolving threats.

Bridging the gap between executive strategy and technical implementation, you will provide authoritative risk advice to System Owners, Senior Information Risk Owners (SIROs), and Risk Committees. You will oversee central compliance with the Government Functional Standard for Security (GovS 007), lead the GovAssure programme across the department, and embed Secure by Design (SbD) principles across all digital initiatives, while leveraging frameworks such as the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001, and NIST.

This role offers an exceptional opportunity to shape cyber resilience at the centre of government, leading high-impact assurance initiatives and fostering a culture of proactive risk management across dynamic digital transformation programmes.

Strategic Delivery & Governance

Drive the delivery of the departmental cyber security governance strategy, establishing frameworks that support the organisational risk appetite while ensuring direct alignment with GovS 007 and the NCSC CAF.

Manage GovAssure across the Cabinet Office, directing the central programme for the whole department and providing practical support and guidance to service owners.

Embed Secure by Design (SbD), ensuring security is integrated across the entire lifecycle of departmental digital and data projects.

Represent Cyber Security on key governance boards (e.g., Departmental Risk Committee), presenting complex risk trade-offs to non-technical leadership.

Manage commercial requirements, owning the allocated budget and acting as the contract manager for all GRC tooling and security education platforms.

Own the cyber risk framework, defining and maintaining the methodologies, standards, and thresholds that departmental teams must work within.

Lead GRC platform engineering, driving the administration, configuration, and continuous maturity of the central GRC tool to automate workflows and improve risk visibility.

Mature the departmental Cyber Risk Register, ensuring risk owners accurately identify, accept, or treat exposures in a timely manner.

Drive third-party and supply chain assurance, establishing cyber risk protocols across the enterprise and high-value procurement contracts.

Provide actionable risk intelligence, delivering regular insights on threat trends and control effectiveness to the Head of Information Security and senior leadership.

Facilitate risk workshops, leading regular sessions with technical and business leads to identify emerging threats and maintain high-quality risk data.

Compliance, Policy & Assurance.

Author and enforce departmental cyber security policies, ensuring they remain practical and mapped against GovS 007, CAF, ISO 27001, and NIST CSF.

Track and integrate audit findings, working closely with operational security teams to record outputs from IT Health Checks (ITHCs), penetration tests, and external audits, ensuring remediation is tracked.

Govern cyber compliance and threat frameworks, leading on cyber-specific legislation and enterprise vulnerability management standards. Work alongside Data

Privacy to support UK GDPR/DPA 2018, ensuring operational alignment with CIS Controls and MITRE ATT&CK.

Lead the security awareness programme, ensuring staff understand current threats and secure data handling practices through effective, metrics-driven education.

Team Leadership & Stakeholder Management

Line manage and mentor a team of security specialists, supporting continuous technical development and professional growth.

Build strategic partnerships with external bodies, including the Government Security Group, DCMS, the NCSC, and partner agencies.

Practice inclusive leadership, building a culture of shared accountability and continuous improvement in security outcomes.

Proud member of the Disability Confident employer scheme

Information Security Governance, Risk & Compliance Manager (GRC)

Company: Government Recruitment Service Salary: £59,207 to £70,958 a year Hours: Full-time Location: London Job type: Permanent Posting date: 21 Oct 2026 Closing date: 2 Nov 2026

Summary

About Cabinet Office Digital:

Cabinet Office Digital sits at the heart of UK government, delivering user-centred digital services, robust technology infrastructure, and progressive digital capability across the Cabinet Office and beyond. Our mission is to make government work better for citizens by modernising legacy systems, championing innovative technologies including secure cloud and AI, and embedding world-class security into every phase of service delivery. We foster an inclusive, collaborative, and agile environment where technical excellence and public value go hand in hand.

The Role:

As the Information Security Governance, Risk & Compliance (GRC) Manager, you will serve as the departmental subject matter expert on cyber risk management, security policy, and enterprise assurance. Reporting directly to the Head of Information Security, you will lead and develop the GRC team to drive the departmental cyber governance strategy, ensuring critical systems and digital services remain resilient against evolving threats.

Bridging the gap between executive strategy and technical implementation, you will provide authoritative risk advice to System Owners, Senior Information Risk Owners (SIROs), and Risk Committees. You will oversee central compliance with the Government Functional Standard for Security (GovS 007), lead the GovAssure programme across the department, and embed Secure by Design (SbD) principles across all digital initiatives, while leveraging frameworks such as the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001, and NIST.

This role offers an exceptional opportunity to shape cyber resilience at the centre of government, leading high-impact assurance initiatives and fostering a culture of proactive risk management across dynamic digital transformation programmes.

Strategic Delivery & Governance

Drive the delivery of the departmental cyber security governance strategy, establishing frameworks that support the organisational risk appetite while ensuring direct alignment with GovS 007 and the NCSC CAF.

Manage GovAssure across the Cabinet Office, directing the central programme for the whole department and providing practical support and guidance to service owners.

Embed Secure by Design (SbD), ensuring security is integrated across the entire lifecycle of departmental digital and data projects.

Represent Cyber Security on key governance boards (e.g., Departmental Risk Committee), presenting complex risk trade-offs to non-technical leadership.

Manage commercial requirements, owning the allocated budget and acting as the contract manager for all GRC tooling and security education platforms.

Risk Assessment & Management

Own the cyber risk framework, defining and maintaining the methodologies, standards, and thresholds that departmental teams must work within.

Lead GRC platform engineering, driving the administration, configuration, and continuous maturity of the central GRC tool to automate workflows and improve risk visibility.

Mature the departmental Cyber Risk Register, ensuring risk owners accurately identify, accept, or treat exposures in a timely manner.

Drive third-party and supply chain assurance, establishing cyber risk protocols across the enterprise and high-value procurement contracts.

Provide actionable risk intelligence, delivering regular insights on threat trends and control effectiveness to the Head of Information Security and senior leadership.

Facilitate risk workshops, leading regular sessions with technical and business leads to identify emerging threats and maintain high-quality risk data.

Compliance, Policy & Assurance.

Author and enforce departmental cyber security policies, ensuring they remain practical and mapped against GovS 007, CAF, ISO 27001, and NIST CSF.

Track and integrate audit findings, working closely with operational security teams to record outputs from IT Health Checks (ITHCs), penetration tests, and external audits, ensuring remediation is tracked.

Govern cyber compliance and threat frameworks, leading on cyber-specific legislation and enterprise vulnerability management standards. Work alongside Data

Privacy to support UK GDPR/DPA 2018, ensuring operational alignment with CIS Controls and MITRE ATT&CK.

Lead the security awareness programme, ensuring staff understand current threats and secure data handling practices through effective, metrics-driven education.

Team Leadership & Stakeholder Management

Line manage and mentor a team of security specialists, supporting continuous technical development and professional growth.

Build strategic partnerships with external bodies, including the Government Security Group, DCMS, the NCSC, and partner agencies.

Practice inclusive leadership, building a culture of shared accountability and continuous improvement in security outcomes.

Proud member of the Disability Confident employer scheme

About Disability Confident Disability Confident is a government scheme. It encourages employers to recruit and retain disabled people and those with long term health conditions.

Related jobs

Technology and Cybersecurity Assurance and Risk Manager

£56,582 to £69,740 per year

Government Recruitment Service

Temporary Full time

Risk & Compliance Analyst

£36,000 to £54,500 per year

The Opportunity Hub UK Ltd

London

Permanent Full time

486616-Commercial Security and Information Assurance Lead

£59,207 to £70,958 per year

Government Recruitment Service

Hybrid Permanent Full time

Browse more jobs