ISMS & GRC Specialist – Security & Audits (Hybrid)

Maxwell Bond; Reading; Hybrid; GBP 55,000 - 57,000; Full time

Job summary

Maxwell Bond is partnering with a technology distribution business to recruit an Information Security Officer for GRC and compliance. The role focuses on hands-on implementation of ISMS and security controls, working with auditors, suppliers and customers to demonstrate risk managed and controls operating effectively.

The role requires building security assurance across ISO 27001, PCI-DSS, NIST/CIS, with vendor risk management and cloud security in Microsoft 365, Azure, AWS or Google Cloud.

Qualifications

• 3+ years in information security, GRC, or security consultancy.
• Hands-on ISMS implementation and ISO 27001 management.
• Experience with security audits, control testing, risk assessments and remediation.
• Knowledge of ISO 27001/27002, NIST, CIS Controls, PCI-DSS and Cyber Essentials Plus.
• Experience in third‑party/vendor risk management and security assurance.
• Strong stakeholder management skills across technical and business teams.
• Security qualifications (CISSP, CISM, CISA, CCSP) advantageous.

Responsibilities

• Maintain and improve the organisation's ISMS, including policies, procedures and controls.
• Support the implementation and management of ISO 27001, Cyber Essentials Plus, PCI-DSS, NIST/CIS Controls.
• Conduct security assessments across infrastructure, networks, endpoints, applications and data.
• Identify, assess and manage information security risks; maintain risk registers.

Skills

Stakeholder management

GRC experience

Security auditing

Risk assessment

ISMS implementation

Policy development

Education

Security qualification (CISSP/CISM/CISA/CCSP)

Tools

Microsoft 365

Azure

AWS

Google Cloud

Job description

Maxwell Bond is partnering with a technology distribution business to recruit an Information Security Officer for GRC and compliance. The role focuses on hands-on implementation of ISMS and security controls, working with auditors, suppliers and customers to demonstrate risk managed and controls operating effectively.

The role requires building security assurance across ISO 27001, PCI-DSS, NIST/CIS, with vendor risk management and cloud security in Microsoft 365, Azure, AWS or Google Cloud.