Lead Security Consultant

55 Exec Search, incorporated; Greater London; Teletrabalho; GBP 63 000 - 77 000; Tempo integral

Resumo da oferta

55 Exec Search is a growing UK cyber security consultancy seeking a Senior GRC Consultant to lead engagements across governance, risk and assurance. You will own longer-term programmes, build trusted client relationships and drive practical improvements across organisations.

Frameworks such as ISO 27001, NCSC CAF and NIST will inform your approach, with a delivery-focused, autonomy-driven role and opportunities to broaden your expertise as the team expands.

Qualificações

• A proven track record of leading substantial GRC or cyber risk engagements for large organisations.
• Experience guiding engagements from discovery to delivery with clear client impact.
• Ability to connect cyber risk with business objectives and governance.

Responsabilidades

• Lead long-term GRC and cyber risk programmes for enterprise clients.
• Develop risk improvement roadmaps aligned to business priorities.
• Build relationships with senior security and business stakeholders.
• Coordinate multi-workstream delivery and governance structures.
• Support ISMS development and align with ISO 27001, NCSC CAF, NIST.

Conhecimentos

GRC experience

Cyber risk consulting

Stakeholder management

Programme leadership

ISO 27001 knowledge

NCSC CAF knowledge

NIST familiarity

Descrição da oferta de emprego

Senior GRC Consultant | Cyber Risk Advisory

Up to £70,000 base + up to 10% bonus

Remote-first UK | Occasional client and office travel

Lead longer-term cyber risk programmes. Build trusted client relationships. Help complex organisations make lasting improvements.

Have you led substantial GRC engagements for large, complex organisations? Are you looking for the autonomy to shape programmes, advise senior stakeholders and see your recommendations through to implementation?

55 Exec Search is working with a growing UK cyber security consultancy looking for a Senior GRC Consultant to lead engagements across cyber risk, governance and assurance.

The focus is on longer-term strategic programmes, helping clients understand their current position, establish priorities and embed improvements across their organisations. You’ll combine strategic advice with practical delivery, taking ownership of client relationships and the work required to move programmes forward.

The opportunity

You’ll work with enterprise clients to strengthen how they govern and manage cyber risk, connecting security priorities with business objectives and translating them into achievable plans.

Your involvement will extend from initial discovery and programme scoping through to implementation and ongoing improvement. This offers the opportunity to develop a deeper understanding of your clients, build lasting stakeholder relationships and see the impact of your work over time.

Frameworks such as ISO 27001, NCSC CAF and NIST will inform your approach, with the emphasis on applying them to each client’s risks, priorities and operating environment.

This is a delivery-focused consulting role with meaningful ownership, support from experienced specialists and opportunities to broaden your expertise as the team grows.

What you’ll do

• Lead substantial, longer-term GRC and cyber risk programmes for enterprise clients, owning scope, planning, delivery and outcomes.
• Help clients develop and deliver cyber risk improvement roadmaps, prioritising activity around business objectives, risk exposure and organisational maturity.
• Build trusted relationships with senior security, technology and business stakeholders, providing advice throughout the engagement.
• Manage programmes spanning multiple business units, workstreams and stakeholder groups, keeping priorities, dependencies and delivery on track.
• Develop and embed governance structures, risk management processes, policies and reporting that support effective decisions.
• Use risk assessments, maturity reviews and gap analyses to shape programme priorities and guide practical improvements.
• Support the implementation and development of ISMS and wider governance capabilities, drawing on ISO 27001, NCSC CAF, NIST and other relevant frameworks.
• Present progress, risks and recommendations to senior stakeholders, helping them understand trade-offs and agree next steps.
• Coordinate and review contributions from other consultants, supporting junior colleagues while remaining actively involved in delivery.

What we’re looking for

• A proven track record of personally leading substantial GRC or cyber risk consulting engagements for large, complex organisations.
• Experience supporting clients through sustained programmes of improvement, from defining priorities and roadmaps to implementing change.
• Clear accountability for engagement delivery, stakeholder relationships and client outcomes.
• The ability to connect cyber risk and governance requirements with business objectives and translate strategic recommendations into practical action.
• Experience navigating multiple stakeholders, competing priorities and established governance structures.
• Broad, practical GRC expertise, including strong knowledge of ISO 27001 and experience across areas such as NCSC CAF, NIST, cyber risk management or third-party risk.
• Strong consulting judgement, with the confidence to challenge constructively, manage expectations and recognise when specialist input is needed.
• Experience coordinating other consultants and maintaining consistent delivery quality.
• UK right to work and eligibility for UK Security Check (SC) clearance.

We’re particularly interested in the scale and complexity of the programmes you’ve led, the decisions you owned and the improvements you helped clients embed.

Useful additional experience

• Cyber strategy, governance design or security transformation programmes.
• Advising senior leadership on cyber risk, investment priorities and programme progress.
• Exposure to DORA, NIS2, incident response tabletop exercises or operational resilience programmes.
• ISO 27001 Lead Auditor or Lead Implementer certification.
• Professional qualifications such as CISM, CISSP or CISA.
• Experience with ISO 42001 and AI governance, or ISO 9001.
• Cyber Essentials delivery or assessment experience; certified assessor status is not essential.