Principal GRC Consultant

SCC; Birmingham; On-site; GBP 85,000 - 120,000; Full time

Benefits offered by this job

Hybrid working

2 volunteering days a year

Career development

Job summary

SCC is seeking a Principal GRC Consultant to build and lead a dedicated GRC practice from the Birmingham office. You will shape services, run risk assessments, and translate complex regulatory requirements into practical roadmaps for clients across sectors.

Hybrid working, with core hours and a permanent contract, and a benefits package including volunteering days. The role demands board-level engagement and mentoring of junior consultants to grow the practice.

Qualifications

• Experience in Governance, Risk and Compliance, especially cyber/technology risk.
• Knowledge of ISO 27001, NIST, NCSC CAF and related schemes.
• Experience leading risk assessments, control reviews and audits.
• Ability to advise senior stakeholders and translate requirements into actions.
• Consulting or client-facing delivery experience is highly beneficial.
• Strong written and verbal communication, including executive briefings.
• Comfortable operating at both strategic and practical levels.
• Security clearance (SC) achieved or willingness to obtain.

Responsibilities

• Lead GRC engagements from scoping to board-ready outputs.
• Design governance frameworks and control environments for clients.
• Support compliance programmes, audits and certification prep.
• Work with sales and architecture to shape opportunities.
• Mentor and grow the GRC capability and future consultants.
• Engage with senior stakeholders and explain cyber risk clearly.

Skills

GRC

ISO 27001

Risk assessments

Stakeholder communication

Consulting

Communication

Security clearance

Certifications

Job description

About The Role

We are actively building diverse teams and welcome applications from everyone.

Role: Principal GRC Consultant

Location: Birmingham (SCC operate hybrid working, which comprises of a mix of office and home working)

Contract Type: Permanent

Salary Package: Competitive plus large company benefits, a broad flexible benefits scheme, and 2 paid-for volunteering days a year

Hours: 9.00 am – 5.30 pm Monday – Friday

Interview Process: 2-stage process

Why SCC?

• An inclusive workplace
• Excellent package: solid basic and company benefits
• Hybrid working & core hours in line with role requirements
• Career development and life-long learning opportunities
• Opportunity to join Europe's largest privately-owned IT Company

Role purpose:

SCC is building a serious GRC consulting capability not a bolt-on, but a practice designed to last. We want someone who can shape it from the inside: influence how we work, who we hire, and what we stand for in the market.

The challenge is real. Clients are navigating rapidly evolving regulatory environments, boards that need cyber risk explained in business terms, and a threat landscape that AI is making harder to predict. Frameworks and controls matter but what clients actually need is someone who can think clearly under complexity and lead others to better decisions.

This is a principal-level role in the truest sense. The work is advisory, often ambiguous, and always consequential.

You will lead GRC engagements with clients across sectors — from initial scoping through to board-ready outputs. That means running risk assessments and maturity reviews, designing governance frameworks and control environments, supporting compliance programmes, and translating regulatory complexity into practical roadmaps.

You will also work alongside SCC's sales and architecture teams to shape opportunities and strengthen proposals. Over time, you will help define the practice itself: its methods, its talent, and how it grows.

The day-to-day will move between board-level risk discussions and detailed control planning. You need to be equally comfortable in both.

Key responsibilities:

• Help define and shape SCC’s GRC go-to-market strategy, including future service offerings, client propositions and delivery approach
• Lead GRC consulting engagements for clients across a range of sectors, ensuring high-quality outcomes and practical recommendations
• Act as a subject matter expert across recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF and Defence Cyber Certification requirements
• Design and implement governance frameworks, policies, processes and controls that help clients manage cyber risk effectively
• Lead cyber risk assessments, maturity reviews and gap analyses, translating findings into clear improvement plans and business-aligned roadmaps
• Support compliance programmes, audit readiness activity and certification preparation for clients
• Provide expert input into bids, proposals, client presentations and solution design
• Help define the future growth and hiring strategy for the GRC capability, including mentoring and supporting future consultants
• Engage confidently with senior stakeholders, explaining cyber risk and compliance issues clearly, with relevance and actionable

Skills and experience:

• Strong experience in Governance, Risk and Compliance, ideally within cyber security, information security or technology risk
• Good working knowledge of recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF, Cyber Essentials and related assurance or certification schemes
• Experience leading risk assessments, control reviews, audit preparation, compliance programmes or security maturity assessments
• Ability to advise senior stakeholders and translate technical or regulatory requirements into practical business actions
• Previous consulting, advisory or client-facing delivery experience would be highly beneficial
• Strong written and verbal communication skills, including the ability to produce clear reports, recommendations and executive-level briefings
• Confidence working at both strategic and practical levels, from board-level risk discussions through to detailed control improvement planning
• To have already achieved SC (Security Clearance) or willingness to undergo the process for SC Clearance.
• Ideally hold or be working towards recognised Information Security qualifications (e.g., CISSP (Certified Information Systems Security Professional), CISM, ISO 27001 Lead Implementer, CISSP ISSAP), NCSC Practitioner.

About Us

SCC is Europe's largest privately-owned IT business, based out of the new £7m HQ office in Birmingham and we help clients succeed through IT transformation and exceptional customer experiences. We are a business where innovation is greater as we combine unique ideas, people and disciplines. We are a global company that is passionate about IT and where we look to simplify the complex.

We are an equal opportunities employer

SCC is committed to providing equal opportunities and a proactive and inclusive approach to equality and diversity in employment. No applicant or employee will be treated less favourably than another on the grounds of a protected characteristic which are defined as sex, sexual orientation, age, disability, gender reassignment, trade union membership or non-membership, marriage and civil partnership, pregnancy and maternity, race and religion or belief.

If you are selected for interview, and need any reasonable adjustments made for your interview, please let the SCC Talent Acquisition team know, at the point of scheduling.

Diversity & Inclusion at SCC - https://www.scc.com/diversity-and-inclusion/

Sustainability at SCC - https://www.scc.com/sustainability-at-scc/

Life at SCC - https://www.linkedin.com/company/scc/life