Security Governance Audit Lead

The FA; Greater London; Hybrid; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Hybrid working model

Private medical cover

Contributory pension

25 days annual leave

Event tickets & engagement

Job summary

The FA is seeking a Security Governance Audit Lead to own information security governance, audit management and compliance across its Digital Technology function. You will lead the ISO 27001 programme, coordinate audits, and drive improvements with a broad set of stakeholders including Risk, Legal, Procurement and the wider business.

You will operate independently, build credibility quickly and act as a trusted advisor on governance, risk and compliance matters, shaping a mature security

Qualifications

• Significant experience in Information Security Governance, Risk, Compliance, Audit or Security Assurance roles.
• Experience implementing or maturing an ISO 27001 ISMS.
• Strong knowledge of ISO 27001 controls, requirements and audit processes.
• Experience planning, coordinating and managing internal and external audits.
• Experience producing governance reporting, dashboards and executive briefings.
• Excellent written communication and stakeholder management skills.
• Ability to work independently and influence across multiple levels.

Responsibilities

• Lead development, implementation and maturity of The FA's ISMS.
• Own ISO 27001 compliance roadmap and certification readiness.
• Chair governance forums and stakeholder meetings on ISO 27001 and security assurance.
• Manage internal and external security audits across multiple functions.
• Drive governance, compliance and assurance across Digital Technology.
• Develop security KPIs, KRIs and management information for risk reporting.
• Produce high-quality reports and presentations for technical and non-technical audiences.
• Review security policies and controls and recommend improvements.
• Partner with technical teams to assess information security controls.
• Support supplier assurance, due diligence and procurement security reviews.
• Support security awareness and culture initiatives across the organisation.
• Oversee governance of security incidents and remediation actions.
• Support business continuity and resilience governance activities.
• Build relationships and act as subject matter expert on governance and compliance.

Skills

ISO 27001 governance

Audit management

Stakeholder management

Policy & reporting

Risk assessment

Third-party risk

Independent working

Job description

Digital Technology plays a critical role in protecting The FA's people, platforms, products and data. As our Technology landscape continues to evolve, we're looking for an experienced Security Governance Audit Lead to strengthen our governance, assurance and compliance capabilities.

This is a newly created role that will take ownership of Information Security governance, audit management and compliance across The FA's Digital Technology function. Acting as the focal point for security governance activities, you'll lead our ISO 27001 programme, coordinate internal and external audits, drive continuous improvement initiatives, and provide meaningful reporting that enables better decision-making across the organisation.

This role offers a unique opportunity to shape and mature The FA's security governance framework while working with a broad range of stakeholders across Technology, Risk, Legal, Procurement and the wider business. We're looking for someone who can operate independently, build credibility quickly and act as a trusted advisor on governance, risk and compliance matters.

What will you be doing?

• Lead the ongoing development, implementation and maturity of The FA's Information Security Management System (ISMS).
• Own and manage The FA's ISO 27001 compliance roadmap, ensuring the organisation maintains certification readiness and continues to improve security maturity.
• Chair governance forums and quarterly stakeholder meetings relating to ISO 27001 and security assurance activities.
• Manage the internal and external security audit programme, coordinating activities across multiple stakeholders and ensuring successful audit outcomes.
• Drive governance, compliance and assurance activities across Digital Technology, ensuring effective controls are in place and operating as intended.
• Develop, maintain and communicate meaningful security KPIs, KRIs and management information that provide insight into organisational risk and compliance performance.
• Produce high-quality reporting and presentations for technical and non-technical audiences, including senior leadership forums.
• Review security policies, standards and controls, recommending improvements where required.
• Partner with technical teams to assess compliance with information security requirements, including access management, monitoring, vulnerability management and related controls.
• Support supplier assurance and governance activities, including security due diligence, control reviews and procurement assessments.
• Support security awareness and culture initiatives, helping to embed positive security behaviours across the organisation.
• Oversee the governance of security incidents, ensuring lessons learned, remediation actions and improvement activities are appropriately tracked and delivered.
• Support business continuity and resilience governance activities, identifying risks, gaps and opportunities for improvement.
• Build strong relationships across internal teams and external partners, acting as a trusted subject matter expert on governance and compliance matters.

What are we looking for?

Essential for the role

• Significant experience working in Information Security Governance, Risk, Compliance, Audit or Security Assurance roles.
• Demonstrable experience implementing, managing or maturing an ISO 27001 Information Security Management System.
• Strong knowledge of ISO 27001 controls, requirements and audit processes.
• Experience planning, coordinating and managing internal and external audits.
• Experience creating governance reporting, dashboards, KPI packs and management information for senior stakeholders.
• Excellent written communication skills, including the ability to produce policies, reports, recommendations and executive briefings.
• Strong presentation and stakeholder management skills, with the ability to tailor messages to technical and non-technical audiences.
• Proven ability to build strong relationships and influence stakeholders across multiple levels of an organisation.
• Experience managing multiple priorities and driving actions through to completion with minimal supervision.
• Highly organised, self-motivated and capable of operating independently in a standalone specialist role.
• Strong analytical and problem-solving skills, with the ability to identify risks and implement pragmatic solutions.
• Experience working with third-party suppliers and managing compliance or assurance activities.

Beneficial to have

• Lead Auditor, Lead Implementer or equivalent ISO 27001 certification.
• Experience working with NIST Cybersecurity Framework or related control frameworks.
• Experience supporting supplier assurance, procurement security reviews and third-party risk management.
• Knowledge of business continuity, resilience and incident management governance.

What's in it for you?

This is an opportunity to build and shape a critical capability within one of the most recognisable organisations in sport.

You’ll be given the autonomy to lead The FA's security governance and audit agenda, influence senior stakeholders, and drive improvements that strengthen how we protect our systems, services and data. Working across the organisation, you’ll play a key role in ensuring security remains a business enabler while supporting the future ambitions of English football.

We are committed to ensuring everyone can flourish in their roles. To achieve this, we have unique office spaces under the arch of the iconic Wembley National Stadium, which is the home of English Football. We are also delighted to offer a world-class, Elite Performance Centre, St. George's Park in Staffordshire, which is an exceptional setting to develop and inspire high-performing England teams and leaders.

We pride ourselves on offering a competitive salary as well as great opportunities to develop and grow in your role. But that is not all; we also have a range of exciting benefits, some of which can be found below:

• Access to event day tickets at Wembley Stadium, alongside a host of regular internal events throughout the season, encourages you to connect and learn with your colleagues and look after your mental health and well-being.
• Free, nutritious lunches at Wembley Stadium and St. George's Park.
• Private medical cover funded by The FA.
• A contributory pension scheme.
• An additional 'Thank You' day's leave, volunteering days, as well as 25 days of annual leave (based on a full-time, permanent contract)
• A hybrid working model which offers greaterflexibility.