Risk & Governance Consultant

CDS Defence & Security; Cheltenham; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

CDS Defence & Security is seeking a Risk & Governance Consultant to deliver security risk, governance and assurance work for Defence and UK Government clients. You will own your work from start to finish, and contribute to knowledge sharing and method development within the team.

You will provide guidance on risk, governance, data protection and compliance, building strong client relationships and creating robust governance documentation. Travel across the UK is expected as part of engagements.

Qualifications

• Experience delivering security risk, governance or assurance consultancy within Defence, wider UK Government or regulated sectors.
• Good knowledge of cyber security risk and governance (SFIA Level 4 or equivalent) and related standards.
• Experience carrying out security risk assessments, gap analyses or compliance reviews.
• Ability to manage workload across multiple tasks or engagements.
• Excellent written and verbal communication for reports to technical and non-technical readers.

Responsibilities

• Provide security advice and guidance on risk, governance and assurance.
• Deliver workstreams or engagements independently, ensuring quality from start to finish.
• Manage scope of work, flag changes, and raise risks with engagement lead.
• Monitor utilisation and time recording to support service performance.
• Create and review security policies and governance docs meeting requirements.
• Build rapport with client stakeholders during delivery.

Skills

Security risk

Governance

Assurance consultancy

Cyber security

Communication

Microsoft Office

Travel flexibility

Education

Degree in cyber security or related field

Intermediate-level security certifications (e.g., CISMP)

Tools

Microsoft Office

Job description

## Job Details: Risk & Governance ConsultantFull details of the job.| | || --- | --- || | || | || --- | --- || | Risk & Governance Consultant || | VN060 || | Full-Time || | Cheltenham || | | | | --- | | Cyber, National Security & Intelligence (CNSI) business unit, CDS Defence & Security About the Role As a Consultant in our Risk & Governance team, you will deliver security risk, governance and assurance work for clients across Defence and wider UK Government to a high standard. You will own the quality of your work from start to finish and build strong working relationships with the clients you support. You will also contribute to the wider team: sharing knowledge with colleagues, suggesting better ways of working and helping to capture the case studies and methods that help us grow. Our Risk & Governance services cover: * Leadership and governance support. * Risk management and assurance across IT, OT and supply chains. * Risk culture, awareness and training. * Data protection and privacy. * Government and Defence-specific services, covering areas such as Secure by Design, CSMv4, FSC and IPSA support. You will bring depth in one or more of these areas and experience of others. What You Will Do * Provide security advice and guidance to clients on security risk, governance and assurance. * Deliver workstreams or smaller engagements largely independently, owning the quality of your work from start to finish. * Manage the scope of your own work, flagging changes before they become issues, and raise risks with the engagement lead promptly and honestly. * Monitor your own utilisation and time recording, and understand how your work contributes to the service line's performance. * Carry out risk assessments, gap analyses and compliance activity, identifying control gaps and recommending pragmatic, risk-based remediation. * Create and review security policies, procedures and governance documentation that meet client and regulatory requirements. * Build rapport with client stakeholders during delivery. * Share knowledge with colleagues through informal coaching, and suggest practical improvements to how things are done and help put them into practice. * Contribute to methodology development and case study capture where the opportunity allows. | || | CDS DS will offer you a competitive salary, pension and package to reflect your knowledge, skills and experience, together with support for training and professional certification. CDS DS is a Defence Employer Recognition Scheme Gold Award winner. Where This Role Can Lead Consultants who want to progress can work towards Senior Consultant through our internal promotion process. That means leading engagements day to day, managing client stakeholders, line managing Consultants and Junior Consultants, and contributing to bids and new methodologies, supported through personal development planning and our internal career framework. || | We do not expect anyone to meet every point below. If this role excites you but you do not tick every box, we would still encourage you to apply. Essential Experience delivering security risk, governance or assurance consultancy within Defence, wider UK Government or other regulated sectors. Good knowledge of cyber security risk and governance (capability at SFIA Level 4 or equivalent), with working knowledge of several, and application of some, of the standards, frameworks and legislation listed below. Experience carrying out security risk assessments, gap analyses or compliance reviews, and creating or reviewing security policies and procedures. The ability to manage your own workload across several tasks or engagements, balancing client and business priorities. Excellent written and verbal communication skills, including writing clear reports for technical and non-technical readers. High proficiency in Microsoft Office applications. Flexibility to travel and work throughout the UK. Desirable Experience in one or more specialist areas, for example operational technology and industrial control systems, integrated safety and cyber security (such as STPA), supply chain assurance, data protection and privacy, or Secure by Design. Relevant Standards, Frameworks & Legislation The list below is not exhaustive, but it covers the standards, frameworks and legislation we encounter most often. We would expect a Consultant to have a good working knowledge of several of them and to have applied some of them in client work. HMG and NCSC information assurance policy and guidance, such as the Cyber Assessment Framework and Cyber Essentials MOD security assurance approaches, including JSP 440, Secure by Design and CSMv4 ISO/IEC 27001 and NIST frameworks FSC, IPSA and List N ONR Security Assessment Principles (SyAPs) UK GDPR, the Data Protection Act 2018, the Computer Misuse Act, the Official Secrets Act and the NIS Regulations Qualifications, Certifications & Clearance We would expect you to hold intermediate-level certifications, or be working towards them. Examples include: BCS CISMP or ISO/IEC 27001 Lead Implementer or Lead Auditor. Associate Membership of CIISec and/or Associate Cyber Security Professional (ACSP) with the UK Cyber Security Council, working towards Practitioner (PraCSP), or equivalent. A degree in cyber security, information assurance or a related subject (desirable). You will also need to hold security clearance, or be willing and eligible to undergo and maintain it. |