SC Cleared GRC Controls & Oversight Lead

Fortice Ltd; Warwick; Hybrid; GBP 70,000 - 90,000; Full time

Job summary

Fortice Ltd in Warwick seeks an experienced GRC Controls & Oversight Lead to support governance, assurance, and control environments across IT and OT. The role requires hands-on oversight, engaging with multiple stakeholders to drive assurance activities to completion.

The successful candidate will navigate complex processes, manage remediation backlogs, and ensure evidence-based control effectiveness while aligning with regulatory obligations.

Qualifications

• Experience in GRC, assurance, audit, or oversight functions.
• Strong understanding of security and technology control environments across IT/OT.
• Experience with control testing, assurance reviews, or audits.
• Ability to analyse complex processes and identify control weaknesses.
• Experience managing large volumes of actions, findings, risks, and remediation.
• Strong stakeholder management and communication skills.
• Ability to interpret policies, standards and control requirements.
• Proven ability to work independently and drive tasks to completion.
• Highly organised with strong attention to detail.

Responsibilities

• Lead and coordinate controls assurance and testing across IT/OT.
• Review and validate control effectiveness against policies and standards.
• Identify deficiencies and track remediation efforts.
• Manage assurance backlogs and prioritise actions.
• Maintain oversight of risks, audit observations, and remediation plans.
• Collaborate with security, engineering, and business teams for evidence.
• Support audits with evidence collection and stakeholder engagement.
• Produce governance reporting and senior stakeholder updates.
• Ensure controls align with risk appetite and regulatory obligations.
• Facilitate governance forums and risk reviews as needed.
• Drive continuous improvement of governance processes.

Skills

GRC

Audit

Controls testing

Stakeholder management

Policy interpretation

Independent worker

Detail oriented

Regulatory know-how

Education

Degree in Information Security / Risk Mgmt

CRISC / CISA (adv)

ISO 27001 Lead Auditor (adv)

Tools

GRC tools

Audit software

ISMS frameworks

Job description

GRC Controls & Oversight Lead

Location:Warwick Hybrid 50/50

Duration: 21/03/2027

MUST BE PAYE THROUGH UMBRELLA

Description

We are seeking an experienced GRC Controls & Oversight Lead to support the governance, assurance, and control environment across IT and Operational Technology (OT) domains. This role will play a key part in ensuring security and operational controls are effectively Embedded, monitored, and evidenced across the organisation.

The successful candidate will be a hands-on practitioner with strong organisational and analytical skills, capable of navigating complex processes, coordinating stakeholders, and driving assurance activities to completion. Rather than acting as a technical security specialist, the role focuses on the practical application of governance, risk, and control management principles, ensuring that control frameworks are operating effectively and that identified gaps are tracked through to resolution.

The role requires an individual who can work independently, manage competing priorities, and bring structure to large volumes of assurance, compliance, and remediation activities.

Key Responsibilities

• Lead and coordinate controls assurance and testing activities across IT and OT environments.
• Review, assess, and validate control effectiveness against defined policies, standards, and regulatory requirements.
• Identify control deficiencies, gaps, and areas for improvement, ensuring timely remediation and follow-up.
• Manage assurance backlogs, driving prioritisation and resolution of outstanding actions and findings.
• Maintain oversight of risks, audit observations, control exceptions, and remediation plans.
• Work closely with security, operational, engineering, and business teams to gather evidence and validate compliance.
• Support internal and external audits by coordinating responses, evidence collection, and stakeholder engagement.
• Produce governance reporting, assurance metrics, and management updates for senior stakeholders.
• Ensure control activities remain aligned to organisational risk appetites, regulatory obligations, and industry good practice.
• Facilitate governance forums, risk reviews, and oversight meetings as required.
• Support continuous improvement initiatives to strengthen governance processes and control effectiveness.

Skills & Experience

Essential

• Experience working within Governance, Risk & Compliance (GRC), assurance, audit, controls, or oversight functions.
• Strong understanding of security and technology control environments across IT and/or OT domains.
• Experience conducting or supporting control testing, assurance reviews, compliance assessments, or audit activities.
• Ability to analyse complex processes and identify control weaknesses or improvement opportunities.
• Experience managing large volumes of actions, findings, risks, and remediation activities.
• Strong stakeholder management and communication skills.
• Ability to interpret policies, standards, procedures, and control requirements.
• Proven ability to work independently and drive activities through to completion.
• Strong organisational skills with excellent attention to detail.

Desirable

• Experience working within critical national infrastructure, utilities, energy, manufacturing, or regulated environments.
• Understanding of OT security concepts and industrial control system environments.
• Familiarity with regulatory and control frameworks such as ISO 27001, NIST CSF, IEC 62443, NIS Regulations, or similar.
• Experience using GRC, audit, risk, or compliance management tools.

Personal Attributes

• Proactive and delivery-focused.
• Comfortable dealing with ambiguity and navigating complex organisational processes.
• Highly organised with the ability to prioritise effectively.
• Collaborative and able to influence stakeholders at all levels.
• Pragmatic, solutions-oriented, and able to balance governance requirements with operational realities.
• Strong sense of ownership and accountability.

Qualifications

• Degree or equivalent professional experience in Information Security, Risk Management, Business Management, Technology, or a related discipline.
• Industry certifications such as CRISC, CISA, ISO 27001 Lead Auditor, CISSP, or equivalent are advantageous but not essential.