Security Governance Audit Lead

The Football Association; Wembley; Hybrid; GBP 85,000 - 120,000; Full time

Benefits offered by this job

Hybrid working model

Private medical cover

Pension scheme

25 days annual leave

Job summary

The Football Association (The FA) is actively seeking an experienced Security Governance Audit Lead to own ISMS development, ISO 27001 compliance roadmaps and audit management across its Digital Technology function.

You will collaborate with Risk, Legal, Procurement and business teams to mature governance, report to senior leaders and drive continuous improvement while operating in a hybrid model at Wembley/St. George's Park.

Qualifications

• Significant experience in Information Security Governance, Risk, Compliance, Audit or Security Assurance roles.
• Demonstrable experience implementing or maturing an ISO 27001 ISMS.
• Strong knowledge of ISO 27001 controls, requirements and audit processes.
• Experience planning and coordinating internal and external audits.
• Experience creating governance reporting, dashboards and KPIs for senior stakeholders.
• Excellent written communication and executive briefing skills.
• Strong presentation and stakeholder management abilities.
• Proven ability to manage multiple priorities with minimal supervision.

Responsibilities

• Lead development and maturity of The FA's ISMS.
• Own ISO 27001 compliance roadmap and certification readiness.
• Chair governance forums and stakeholder meetings for ISO 27001 and security assurance.
• Manage internal and external security audit programme across multiple stakeholders.
• Drive governance, compliance and assurance across Digital Technology.
• Develop security KPIs, KRIs and reporting for risk and compliance.
• Produce high-quality reporting for technical and non-technical audiences.
• Review policies, standards and controls and recommend improvements.
• Assess compliance with information security requirements with technical teams.
• Support supplier assurance and procurement security reviews.

Skills

Information Security

ISO 27001

Audits

Stakeholder management

Reporting

Policy writing

Risk management

Tools

NIST CSF

ISMS

Job description

Digital Technology plays a critical role in protecting The FA's people, platforms, products and data. As our Technology landscape continues to evolve, we're looking for an experienced Security Governance Audit Lead to strengthen our governance, assurance and compliance capabilities.

This is a newly created role that will take ownership of Information Security governance, audit management and compliance across The FA's Digital Technology function. Acting as the focal point for security governance activities, you'll lead our ISO 27001 programme, coordinate internal and external audits, drive continuous improvement initiatives, and provide meaningful reporting that enables better decision-making across the organisation.

This role offers a unique opportunity to shape and mature The FA's security governance framework while working with a broad range of stakeholders across Technology, Risk, Legal, Procurement and the wider business. We're looking for someone who can operate independently, build credibility quickly and act as a trusted advisor on governance, risk and compliance matters.

What will you be doing?

• Lead the ongoing development, implementation and maturity of The FA's Information Security Management System (ISMS).
• Own and manage The FA's ISO 27001 compliance roadmap, ensuring the organisation maintains certification readiness and continues to improve security maturity.
• Chair governance forums and quarterly stakeholder meetings relating to ISO 27001 and security assurance activities.
• Manage the internal and external security audit programme, coordinating activities across multiple stakeholders and ensuring successful audit outcomes.
• Drive governance, compliance and assurance activities across Digital Technology, ensuring effective controls are in place and operating as intended.
• Develop, maintain and communicate meaningful security KPIs, KRIs and management information that provide insight into organisational risk and compliance performance.
• Produce high-quality reporting and presentations for technical and non-technical audiences, including senior leadership forums.
• Review security policies, standards and controls, recommending improvements where required.
• Partner with technical teams to assess compliance with information security requirements, including access management, monitoring, vulnerability management and related controls.
• Support supplier assurance and governance activities, including security due diligence, control reviews and procurement assessments.
• Support security awareness and culture initiatives, helping to embed positive security behaviours across the organisation.
• Oversee the governance of security incidents, ensuring lessons learned, remediation actions and improvement activities are appropriately tracked and delivered.
• Support business continuity and resilience governance activities, identifying risks, gaps and opportunities for improvement.
• Build strong relationships across internal teams and external partners, acting as a trusted subject matter expert on governance and compliance matters.

What are we looking for?

Essential for the role

• Significant experience working in Information Security Governance, Risk, Compliance, Audit or Security Assurance roles.
• Demonstrable experience implementing, managing or maturing an ISO 27001 Information Security Management System.
• Strong knowledge of ISO 27001 controls, requirements and audit processes.
• Experience planning, coordinating and managing internal and external audits.
• Experience creating governance reporting, dashboards, KPI packs and management information for senior stakeholders.
• Excellent written communication skills, including the ability to produce policies, reports, recommendations and executive briefings.
• Strong presentation and stakeholder management skills, with the ability to tailor messages to technical and non-technical audiences.
• Proven ability to build strong relationships and influence stakeholders across multiple levels of an organisation.
• Experience managing multiple priorities and driving actions through to completion with minimal supervision.
• Highly organised, self-motivated and capable of operating independently in a standalone specialist role.
• Strong analytical and problem-solving skills, with the ability to identify risks and implement pragmatic solutions.
• Experience working with third-party suppliers and managing compliance or assurance activities.

Beneficial to have

• Lead Auditor, Lead Implementer or equivalent ISO 27001 certification.
• Experience working with NIST Cybersecurity Framework or related control frameworks.
• Experience supporting supplier assurance, procurement security reviews and third-party risk management.
• Knowledge of business continuity, resilience and incident management governance.

What's in it for you?

This is an opportunity to build and shape a critical capability within one of the most recognisable organisations in sport.

You'll be given the autonomy to lead The FA's security governance and audit agenda, influence senior stakeholders, and drive improvements that strengthen how we protect our systems, services and data. Working across the organisation, you'll play a key role in ensuring security remains a business enabler while supporting the future ambitions of English football.

We are committed to ensuring everyone can flourish in their roles. To achieve this, we have unique office spaces under the arch of the iconic Wembley National Stadium, which is the home of English Football. We are also delighted to offer a world-class, Elite Performance Centre, St. George's Park in Staffordshire, which is an exceptional setting to develop and inspire high-performing England teams and leaders.

We pride ourselves on offering a competitive salary as well as great opportunities to develop and grow in your role. But that is not all; we also have a range of exciting benefits, some of which can be found below:

• Access to event day tickets at Wembley Stadium, alongside a host of regular internal events throughout the season, encourages you to connect and learn with your colleagues and look after your mental health and well-being.
• Free, nutritious lunches at Wembley Stadium and St. George's Park.
• Private medical cover funded by The FA.
• A contributory pension scheme.
• An additional 'Thank You' day's leave, volunteering days, as well as 25 days of annual leave (based on a full-time, permanent contract)
• A hybrid working model which offers greater flexibility.

For more information on what it is like to work at The FA, please visit our FA Careers page, https://www.thefa.com/about-football-association/careers

Currently, we are working within a hybrid working model whereby the expectation is to work from your contractual location for part of the week, and as and when required by the team. The remaining days can be worked remotely. We will continue to monitor this model, and it may be adjusted in future if deemed necessary. The contractual location of this role can be found on the FA Careers page.

We are a diverse workplace, aspiring to represent football across the country. The Football Association actively promotes inclusion and diversity, encouraging you to be the best version of yourself at work.

We welcome applications from everyone and are proud to be an equal opportunities employer. If you have any particular requirements in respect of the recruitment or interview process, please mention this during your application.

As part of the FA's commitment to ensuring a safe environment for everyone in football, every employee will be required to complete a DBS check. The level of the check required will be based on the activity of the specific job role and in line with legislation and government guidance.