Lead Cyber Security Risk Manager

UK Home Office; Glasgow; Hybride; GBP 63 000 - 67 000; Plein temps

Avantages offerts par ce poste

Civil Service Pension

25 days annual leave

8 public holidays + 1 privilege day

Hybrid office/work arrangement (60% in

Résumé du poste

UK Home Office is seeking a Lead Cyber Security Risk Manager to oversee risk-based assurance across projects and live services. You will lead the development of risk management processes, challenge risk assessments, and advise senior stakeholders on risk mitigation throughout the service lifecycle.

You will join a team of cyber security professionals focused on reducing exposure to cyber-attack of critical digital systems.

Qualifications

• Essential skills include information or cyber security with threat and risk analysis for complex, high-risk systems.
• Ability to lead and oversee cyber security risk/assurance practitioners with professional judgment.
• Experience in implementing security policies in large organisations balancing security and business needs.
• Capability to champion cyber security risk and ensure ongoing practices.
• Proven track record implementing risk, assurance, or governance processes.
• Familiarity with NIST, ISO27001, COBIT and NCSC guidelines.

Responsabilités

• Independently undertake risk management activities within governance structures and lead risk assessments and assurance practices.
• Lead proportionate, risk-based second‑line cyber security assurance across projects and services with clear, evidence-based opinions.
• Develop and assure organisation-wide risk management policies, embedding Secure by Design principles where appropriate.
• Communicate with senior stakeholders to convey risk implications and provide independent challenge.
• Manage risk processes, review controls after incidents and oversee remediation and assurance findings.
• Ensure risks are managed in line with Home Office risk management policies and remediation activity.

Connaissances

Threat and risk analysis

Leadership of cyber risk/assurance

Policy development

Communication with senior stakeholders

Risk management governance

Cyber risk frameworks (NIST ISO27001,

Description du poste

Location: Croydon | Salford | Sheffield | Glasgow (hybrid with 60% office attendance)

Salary: £62,732 (national), £66,732 (London) plus skills allowance of up to £17,668

Advert Close: Monday 23rd November 2026 at 11:55pm

As a Lead Cyber Security Risk Manager in the Compliance and Assurance team, you will lead proportionate, risk-based cyber security assurance across Home Office projects and live services, identifying, assessing and helping mitigate cyber risks to critical national infrastructure and business-critical systems. Drawing on a range of evidence and your expertise, you will provide independent challenge and advice throughout the service lifecycle, enabling stakeholders, including senior leaders, to make informed, auditable decisions about cyber risk.

You’ll be joining an expert team of cyber professionals, committed to reducing the exposure to cyber-attack of new and existing digital systems. You’ll be aided in your role by a diverse and supportive organisational culture, and a commitment to further your continuous development.

Job description

The Lead Cyber Security Risk Manager supports, plans and develops the implementation and management of organisation-wide processes and procedures for the management, assurance or governance of cyber risk. They will provide tailored expert support and advice that highlights cyber security risks to a range of stakeholders, projects, business teams and service owners, helping them to remedy identified risks by enabling well-informed and auditable decisions, using published guidance and standards, and drawing on a range of experts as well as personal expertise.

Person specification

As a Lead Cyber Security Risk Manager, your main responsibilities will be;

• Independently and impartially undertaking risk management activities within a given area of practice or expertise, usually within established security and risk management governance structures. You will lead the independent derivation and analysis of security needs including assuring, evaluating and challenging the adequacy of risk assessments, controls and evidence, while retaining the ability to undertake targeted assurance activity where necessary.
• Lead and prioritise proportionate, risk-based second-line cyber security assurance across an assigned portfolio of projects, live services and product areas, ensuring assurance effort is focused on the areas of greatest material risk and formulate clear, evidence-based assurance opinions, identifying material control weaknesses, residual risks, dependencies and limitations, and provide recommendations to support informed and auditable risk decisions.
• Developing risk management-related policy and assure the ongoing appropriateness of policy in accordance with regulation and wider organisational and government policies, embedding Secure by Design principles where appropriate.
• Communicating effectively with senior stakeholders to ensure they recognise the importance of security considerations and advising senior stakeholders on their approach to risk assessment in the context of their organisational outcomes, providing independent constructive challenge where appropriate.
• Managing risk management processes, reviewing their efficiency and effectiveness, and leading recommendations for continuous improvement. This includes reviewing internal controls following any security breach, providing advice on how to remediate any vulnerabilities discovered, and agreeing and overseeing remedial solutions, controls and safeguards, including tracking assurance findings where appropriate.
• Assessing reviews and risk assessments and ensuring identified risks are managed in accordance with Home Office risk management policies, including assurance outcomes and remediation activity where applicable.

Essential Skills

• Information or cyber security including threat and risk analysis for complex, high-risk and/or mission critical systems, preferably involving the Home Office, Cabinet Office, NCSC or within industry Security Operations Centres (SOCs) and departments.
• Proven ability to lead, develop and provide professional oversight to cyber security risk or assurance practitioners, setting standards for quality, consistency and professional judgement.
• Proficiency analysing or implementing technical or security policies in a large organisation. Skilled in balancing security requirements with business impact to ensure practicality and effectiveness.
• Ability to champion cybersecurity risk and ensure ongoing appropriateness or practices.
• Proven track record in implementing cybersecurity risk, assurance or governance processes and procedures.
• Cyber risk and controls frameworks such as NIST, ISO27001, COBIT, BS EN 31111, Cyber Essentials, CAF and general wider NCSC guidelines.

Why work for us...

Find out more information at: Benefits - Home Office Careers, but some of the primary ones are:

• A Civil Service Pension with employer contribution rates of at least 28.97%.
• In-year reward scheme for one-off or sustained exceptional personal or team achievements.
• 25 days annual leave on appointment, rising with service.
• 8 days of public holidays, plus 1 additional privilege day.
• Where business needs allow, some roles may be suitable for a combination of office and home-based working. This is a non-contractual arrangement where all employees will be expected to spend a minimum of 60% of their working time in an office.