Risk & Assurance Manager - IT/Infosec

Altum Consulting; Manchester; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A leading technology services organisation in the UK is seeking an experienced professional for a hybrid role focused on IT and Information Security risk oversight. You will play a key role in enhancing risk and control frameworks and must have a strong background in IT risk management, ideally with consulting experience. Your responsibilities include ensuring alignment with regulatory expectations and managing IT Risk & Control Matrices. This role requires a confident stakeholder manager capable of influencing outcomes across various teams.

Qualifications

• Minimum of 5 years' experience in IT/security risk or internal audit.
• Background in consulting or professional services is advantageous.
• Proven experience leading IT risk/audit initiatives.

Responsibilities

• Strengthen how technology and cyber risks are identified and managed.
• Shape and enhance IT and info sec risk/control frameworks.
• Manage IT Risk & Control Matrices to ensure they are audit-ready.

Skills

Stakeholder management

IT Risk management

Project management

Tools

ISO 27001

NIST

ITIL

ISO 22301

CIS Controls

Job description

About the business

This is a £1bn+ UK technology services organisation experiencing continued organic growth. It also has a strong reputation as an employer, regularly recognised as one of the top UK businesses for work-life balance.

About the role

The position sits within the second line and is focused on IT and Information Security risk oversight. Reporting into the Head of Risk & Assurance, you'll play a key role in strengthening how technology and cyber risks are identified, managed and communicated across the organisation.

You’ll be responsible for shaping and enhancing IT and infosec risk and control frameworks, working with standards such as ISO 27001, ITIL, ISO 22301 and NIST to ensure alignment with regulatory expectations and business priorities. The role also includes ownership of IT Risk & Control Matrices (RCMs), ensuring they remain robust, up to date and audit‑ready.

About you

• At least 5 years' experience in second‑line risk or internal audit, with a clear IT / Information Security focus
• Background in consulting or professional services would be advantageous, particularly where you've supported transformation or change programmes
• Proven experience leading IT risk or audit initiatives, managing deliverables and influencing outcomes
• Strong understanding of recognised frameworks and regulations, including ISO 27001, NIST, CIS Controls and GDPR
• Confident stakeholder manager, able to build credibility and challenge effectively across IT, security and the wider business

This is a hybrid role, with an expectation of three days per week in the office.