Security Assurance & GRC Lead

Abound; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Abound is formalising its security assurance function to provide governance for auditors, funders, and the regulator. You will own the recurring assurance cycle end to end, run third-party security, and turn evidence into materials for due diligence and certification.

You will build controls, gather evidence, and challenge suppliers, while coordinating penetration tests, access reviews, DR tests and policy reviews to maintain ISO 27001 readiness.

Qualifications

• Three or more years in information security assurance, GRC or security compliance.
• Hands-on experience with ISO 27001, whether operating an ISMS or taking one through certification.
• Demonstrable experience running third-party security assessments and inbound security due diligence.

Responsibilities

• Own the third-party security assurance program including due diligence for new suppliers and ongoing reassessment.
• Build and maintain reusable trust packs: evidence, certifications, attestations, pre-filled questionnaires.
• Maintain an annual assurance calendar with tests, reviews and remediation tracking.
• Administer risk and control processes: risk register, exceptions, treatment plans and expiries.
• Consolidate vulnerability findings across sources into a single remediation view and track progress.
• Lead security awareness initiatives: training, phishing simulations and pre-employment screening coordination.

Skills

Information security

Vendor security assessments

Security due diligence

Written communication

Education

Bachelor's degree or equivalent in information security or related field

Tools

ISO 27001 knowledge

Cloud security (AWS) knowledge

Job description

Abound is formalising its security assurance function to provide governance for auditors, funders, and the regulator. You will own the recurring assurance cycle end to end, run third-party security, and turn evidence into materials for due diligence and certification.

You will build controls, gather evidence, and challenge suppliers, while coordinating penetration tests, access reviews, DR tests and policy reviews to maintain ISO 27001 readiness.