Senior Risk & Governance Consultant

CDS Defence & Security; Cheltenham; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Competitive salary

Pension

Training & certification support

Job summary

CDS Defence & Security is seeking a Senior Risk & Governance Consultant to lead security risk, governance and assurance engagements across Defence and UK Government clients. You will manage scope, surface risks early and mentor Consultants while contributing to new methodologies and bids.

You will bring extensive experience in governance, cyber security risk, data protection and privacy, with ability to communicate clearly to technical and non-technical audiences and travel across the UK as

Qualifications

• Significant experience delivering security risk, governance or assurance consultancy within Defence, wider UK Government or other regulated sectors.
• Experience leading engagements day to day and reporting to senior client audiences.
• Willingness to undergo and maintain security clearance.

Responsibilities

• Act as trusted advisor to client stakeholders on security risk, governance and assurance.
• Lead engagements day to day, managing scope and pace, surfacing risks early.
• Line manage Consultants and Junior Consultants, including one-to-ones and development plans.
• Develop and own elements of new methodologies, toolkits and service offerings.
• Contribute to bids, proposals and client development, building relationships for future work.

Skills

Security risk governance

Stakeholder management

Line management

Communication

MS Office proficiency

Education

Degree in cyber security / information assurance

CISSP / CISM / CRISC (study or hold)

Job description

| | Senior Risk & Governance Consultant || | VN059 || | Full-Time || | Cheltenham || | | | | --- | | **About the Role** As a Senior Consultant in our Risk & Governance team, you will be an experienced and trusted practitioner in security risk, governance and assurance, working with client stakeholders across Defence and wider UK Government. You will lead engagements day to day and produce work that needs minimal review. You will also help to grow the practice: line managing Consultants and Junior Consultants, contributing to new methodologies and toolkits, and supporting bids and client development. Our Risk & Governance services cover: * Leadership and governance support. * Risk management and assurance across IT, OT and supply chains. * Risk culture, awareness and training. * Data protection and privacy. * Government and Defence-specific services, covering areas such as Secure by Design, CSMv4, FSC and IPSA support. You will bring strong experience in one or more of these areas and breadth across the others. **What You Will Do** * Act as a trusted advisor to client stakeholders on security risk, governance and assurance, leading client conversations with confidence. * Lead engagements day to day, managing scope and pace, surfacing risks early in writing and engaging stakeholders honestly. * Deliver within agreed scope, recording your time accurately, and understand how delivery efficiency affects margin. * Deliver technical assurance and risk management work to a high standard across enterprise IT, operational technology and supply chain environments, producing work that needs minimal review. * Hold yourself and your peers to a high quality bar, reviewing colleagues' deliverables and giving constructive feedback. * Line manage Consultants and Junior Consultants, including regular one-to-ones and input to their personal development plans. * Develop and own elements of new methodologies, toolkits and service offerings. * Contribute to bid responses and proposals, and build client relationships that lead to further work. * Propose specific improvements to how the practice delivers, and help implement them across the team. * Build your profile in the security community, for example through case studies, articles or industry events. | || | What We Offer CDS DS will offer you a competitive salary, pension and package to reflect your knowledge, skills and experience, together with support for training and professional certification. CDS DS is a Defence Employer Recognition Scheme Gold Award winner. Where This Role Can Lead Senior Consultants who want to progress can work towards Principal Consultant through our internal promotion process. That means taking on our most complex engagements, leading the development of new service offerings and helping to drive the growth of the business unit, supported through personal development planning and our internal career framework. || | What We Are Looking For We do not expect anyone to meet every point below. If this role excites you but you do not tick every box, we would still encourage you to apply. Essential • Significant experience delivering security risk, governance or assurance consultancy within Defence, wider UK Government or other regulated sectors, including leading engagements day to day. • Strong knowledge of cyber security risk and governance (capability at SFIA Level 5 or equivalent), with strong knowledge of most of the standards, frameworks and legislation listed below, and application of many of them in client work. • Experience managing client stakeholders and reporting clearly to technical and non-technical audiences. • Experience of line management or formal supervision of other consultants. • Excellent written and verbal communication skills, including presenting to senior client audiences. • High proficiency in Microsoft Office applications. • Flexibility to travel and work throughout the UK. Desirable • Experience contributing to new services, methodologies or toolkits. • Experience contributing to proposals, bids or client development. • Specialist depth in an area that broadens our offer, for example operational technology and industrial control systems, integrated safety and cyber security (such as STPA), supply chain assurance, data protection and privacy, or Secure by Design. • Involvement in the security community, for example through professional bodies, events or working groups. • An understanding of how consultancy engagements are scoped and priced. Relevant Standards, Frameworks & Legislation The list below is not exhaustive, but it covers the standards, frameworks and legislation we encounter most often. We would expect a Senior Consultant to have a strong working knowledge of most of them and to have applied many of them in client work. • HMG and NCSC information assurance policy and guidance, such as the Cyber Assessment Framework and Cyber Essentials • MOD security assurance approaches, including JSP 440, Secure by Design and CSMv4 • ISO/IEC 27001 and NIST frameworks • FSC, IPSA and List N • ONR Security Assessment Principles (SyAPs) • UK GDPR, the Data Protection Act 2018, the Computer Misuse Act, the Official Secrets Act and the NIS Regulations Qualifications, Certifications & Clearance We would expect you to hold intermediate-level certifications and professional recognition, and to be working towards expert level. Examples include: • BCS CISMP or ISO/IEC 27001 Lead Implementer or Lead Auditor, and ideally holding, or actively studying for, ISC2 CISSP, ISACA CISM or CRISC. • Associate Membership of CIISec, working towards Full, and/or Practitioner Cyber Security Professional (PraCSP) with the UK Cyber Security Council, working towards Principal (PriCSP), or equivalent. • A degree in cyber security, information assurance or a related subject (desirable). You will also need to hold security clearance, or be willing and eligible to undergo and maintain it. |