Information Security GRC Lead

Good Energy; Chippenham; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Work from home allowance £500

Travel allowance £500

Development allowance £500

15% annual bonus

25 days annual leave

Ethical pension with Aviva

Job summary

Good Energy is looking for an Information Security GRC Lead to strengthen its security and control environment. You will link IGRC with Technology Teams, turning security requirements into actionable evidence and controls.

You will coordinate assurance over IT security controls, support risk and compliance activities, and drive remediation while avoiding day-to-day admin tasks. Hybrid role based in Chippenham, with weekly office attendance.

Qualifications

• Experience in information security risk and control management.
• Ability to coordinate IT security controls, vulnerability management, incidents, DR or change governance.
• Awareness of ISO27001, Cyber Essentials, NCSC CAF and PCI-DSS.

Responsibilities

• Maintain IT security risk and control oversight with Governance, Risk and Compliance.
• Coordinate evidence and assurance of information security controls across people, process, premises and technology.
• Interpret standards and translate requirements into practical actions for technical owners.
• Support security incident governance and evidence collection, aiding root cause analysis.
• Coordinate IT disaster recovery oversight, testing, and remediation tracking.
• Support IT change governance and advise on security and resilience impacts.
• Coordinate PCI-DSS control activity and testing, tracking remediation.
• Coordinate and oversee penetration testing activities with third parties.
• Develop and maintain technology security policies and guidance.

Skills

IT risk management

Information security governance

Control assurance

Communication skills

Regulatory awareness

Education

ISO27001 Foundation

CISSP / CISA (certs)

Tools

PCI-DSS

ISO27001

NIST CSF

Job description

No day will be the same - here are some of the highlights

Reporting into the Head of IGRC, this role provides information security GRC oversight, coordination and assurance across IT security, resilience and control governance, working closely with Technology Teams who retain ownership of technical implementation and day-to-day system administration.

We are seeking a practical and technically capable Information Security GRC Lead to help strengthen Good Energy’s security and control environment. This role will act as a key link between IGRC and Technology Teams; identifying security and compliance requirements, coordinating activity, providing guidance and challenge, evidencing controls, and tracking remediation. The role is not expected to perform day-to-day technical administration but will need sufficient technical understanding to work effectively with the Technology Teams who implement and operate the controls.

Key Responsibilities include:

• IT Security Governance: Maintain oversight of IT security risks, controls, policies and standards, helping define what good control looks like and working with Technology Teams to ensure ownership, implementation and evidence are clear.
• Security Control Assurance: Coordinate and evidence regular assurance over information technology security controls across people, process, premises and technology, working with Technology Teams to validate control operation, elevate gaps and track remediation.
• Information Security Risk and Compliance: Support information security risk and compliance activity by interpreting relevant standards and good practice frameworks, translating requirements into practical actions, and working with Technology Teams to support proportionate implementation.
• Security Incident Support: Support security incident response by helping assess governance, risk and compliance impacts, coordinating evidence, supporting root cause analysis and ensuring lessons learned are tracked with the relevant technical owners
• IT Disaster Recovery and Resilience: Coordinate oversight and challenge of IT disaster recovery arrangements, working with Technology Teams to maintain plans, schedule testing, evidence outcomes, identify dependencies and track remediation of weaknesses.
• IT Change Management: Support effective IT change governance, including chairing or supporting the Good Energy Change Advisory Board, and ensuring security and resilience impacts are considered and that technical owners complete agreed actions before implementation where required.
• PCI-DSS Compliance: Coordinate and support PCI-DSS control activity, evidence gathering, control testing and remediation tracking where technology controls are in scope.
• Penetration Testing and Vulnerability Management: Coordinate penetration testing and support vulnerability management oversight, working with Technology Teams and third parties to risk assess findings, agree ownership and monitor remediation without taking ownership of technical remediation activity.
• Technology Policy and Awareness: Develop, review and maintain technology security policies, standards and guidance, supporting employee awareness of key security responsibilities.

What you'll need to succeed

As the Information Security GRC Lead, you will be a proactive, practical and technically aware individual who can work confidently between IGRC, Technology Teams and wider business teams.

You will be able to translate technical security concepts into clear business language, provide proportionate guidance and challenge, and coordinate practical security activity without needing to be the person who directly configures or administers the underlying technology.

You will be comfortable working independently, influencing across teams and maintaining focus on practical risk reduction, strong evidence and continuous improvement.

• Good understanding of information technology security, information security risk and control management.
• Experience supporting, coordinating or assuring IT security controls, vulnerability management, incident response, IT disaster recovery or IT change governance, ideally while working alongside technical teams who own implementation.
• Awareness of recognised security standards or frameworks such as ISO27001, Cyber Essentials, NCSC CAF and PCI-DSS.
• Strong verbal and written communication skills, with the ability to explain technical matters clearly to non-technical audiences.
• Demonstrable attention to detail and ability to produce clear, evidence-based documentation.
• Ability to interpret technical workflows, risks and controls and translate them into practical procedures, policies, or assurance activity and clear actions for technical owners.
• Confident working with stakeholders across technology, governance and business teams to agree actions and track remediation.
• Experience working in a regulated sector, ideally energy, with exposure to Smart Metering security obligations, governance or assurance requirements.
• Experience coordinating CREST-accredited penetration testing, reviewing findings, agreeing remediation plans and tracking closure with technical owners.
• Relevant qualification or certification such as ISO27001 Foundation or Implementer, CISMP, SSCP, Security+, CISA or equivalent experience.
• Working knowledge of data protection requirements where they intersect with technology security controls.

Hybrid working explained: When and where you’ll be in the office

Our office is based in Chippenham, Wiltshire. For this role, we're looking for candidates who can come in to our Chippenham office, once a week.

We offer both formal and informal flexible working options. Full-time hours are 37.5 per week, Monday to Friday.

The office is fully accessible, allowing everyone to participate fully in their working lives regardless of any mobility challenges. We promote work-life balance and flexibility through hybrid working, which combines both remote and office work.

Benefits you can rely on

Great allowances for hybrid working:

£500 work from home allowance - an annual allowance paid monthly alongside your salary to support with working from home costs.

£500 travel allowance - an annual allowance paid monthly alongside your salary to support with travelling to work costs.

£500 annual development allowance: to spend on your chosen development area, whether that’s in your current role, or future roles.

15% annual bonus: company-wide bonus scheme designed to reward collective teamwork and delivery of results across the whole business.

Holiday: 25 days annual leave, a day off for your birthday, additional days leave for long service, plus bank holidays. You’ll also have the option to buy additional leave, allowing for a better work-life balance.

Ethical Pension with Aviva: Good Energy offers an ethical pension plan provided by Aviva, with employer-matched contributions up to 7.5% of your base salary.

About Good Energy

Good Energy has been driving the UK’s renewable energy revolution since 1999, helping homes and businesses become greener and more self-sufficient through clean power and green technology.

We supply 100% renewable electricity from over 3,000 independent British generators and support more than 180,000 customers producing their own energy through the Feed-in Tariff scheme. Beyond supply, we design and install solar panels systems, batteries, heat pumps and EV chargers, with fair tariffs and export rates that reward people for the energy they share.

As a Which? Eco Provider, certified B Corp, and Friends of the Earth–recommended supplier, we’re proud to set the bar high for sustainability, fairness, and customer care. We’re rated ‘Excellent’ on Trustpilot and recognised as a World Class Employer by Best Companies, a reflection of both our customers’ trust and our inclusive, values-driven workplace.

Now part of the Esyacasoft Group, we’re connected to a global network of expertise in energy management and smart technology. With an exciting period of growth ahead, we’re expanding across all areas of the business. At our core, we believe in fairness, inclusivity, and innovation, and we’re looking for people who share our mission to tackle the climate crisis and power a cleaner, greener future.

Our Commitment

We’re a Committed Member of Inclusive Employers and value people’s differences – we recognise the strength that they give us. We work hard to be a supportive community where everyone has equal opportunities and we encourage applications from people irrespective of background, circumstances, age, disability, ethnicity, religion or belief, gender identity or sexual orientation.