Transformation Risk & Assurance Lead

The Citation Group; Wilmslow; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

25 days holiday

Birthday leave

Healthcare

Pension contributions

Gym membership discount

Childcare vouchers

Extra leave purchase

Job summary

Citation is seeking an embedded governance, risk and compliance partner to support transformation programmes impacting business systems and AI capability. You will work with programme leads, architects, and delivery managers to ensure risk is understood and addressed as changes are designed.

You will provide real-time visibility to InfoSec and legal, translating complex risk into actionable insights for decisions up to the CISO and board.

Qualifications

• Substantial experience in Information Security, information assurance, GRC, or technology risk.
• Practical understanding of data protection principles and AI use cases.
• Experience assessing third-party and vendor security risk, including AI partners.
• Strong stakeholder management with ability to influence senior technical and delivery professionals.
• Excellent written and verbal communication; translate technical risk for non-technical audiences.

Responsibilities

• Build direct, trusted relationships with Programme leads, Tech Leads, and Architects.
• Identify new technology and AI initiatives early in programme design for risk assessment.
• Review access scope, credentials, and data residency for system integrations before go-live.
• Map data touched by initiatives and lead DPIA involvement as needed.
• Translate security findings into risk language for governance and exec decisions.

Skills

InfoSec

GRC

Risk assessment

Vendor risk

Data protection

Stakeholder management

Executive communication

Independent working

Job description

Citation runs a portfolio of transformation programmes involving significant change to business systems, processes, and increasingly AI and agentic capability. This role is the embedded governance, risk and compliance partner across these programmes. It will be essential to work directly with programme leads, architects, and delivery managers to understand what is being built, ask the right questions early, and make sure risk is understood and communicated as solutions develop and escape.

The role exists to give InfoSec and legal functions real-time visibility and influence across fast-moving change, so that risk is identified and addressed as part of design rather than discovered after build. It carries the trust and seniority to work as a peer to senior technical and delivery stakeholders, and the communication skill to translate technical risk into language that supports good decisions at every level, up to and including the CISO and board.

Key Responsibilities

Stakeholder relationship and influence

• Build direct, trusted working relationships with Programme/Pod Leads, Tech Leads, Business Analysts, Enterprise Architects, Solution Architects, and AI Architects across active transformation programmes
• Establish a presence as an embedded partner in programme design discussions, not a checkpoint encountered only at formal gates

Tech and AI initiative identification

• Identify new technology initiatives early in programme design, including new supplier or vendor tools being introduced, new technology being adopted, and solutions being built in-house
• Identify planned AI and agentic initiatives specifically, including where solutions are given configuration, administration, or development access to core business systems, or where an ontology or semantic layer is proposed across multiple data sources
• Identify shadow IT arising from transformation activity such as tools, SaaS trials, or AI services adopted by programme teams outside standard procurement or InfoSec channels, and route them into the appropriate assessment process
• Articulate these initiatives clearly to the relevant stakeholders, providing enough context on scope, data involved, and system access for assessment to begin without delay

Business systems integration

• Review access scope, credential and service account handling, and data residency for new system-to-system integrations before go-live
• Watch for change control being bypassed under programme time pressure, and raise this where it occurs

Data and vendor risk

• Map which initiatives touch sensitive personal, financial, or audit data, and identify where Data Protection Impact Assessment involvement is required
• Conduct risk assessments, such as DPIAs, for in-scope programme initiatives, own recommended risk treatment, and lead security due diligence for programme delivery and AI partners

Communication and escalation

• Translate technical and security findings into risk language that supports decisions at pod, programme, and executive level
• Identify what needs to be escalated immediately and what can be handled through standard programme cadence
• Apply an agreed risk framework to treat low-risk items directly, escalating only where the framework requires it
• Escalate data protection risks to the Group DPO and security/architecture risks to the CISO
• Represent Information Security and legal interests in programme governance and steering forums

Required Experience and Skills

• Substantial experience in Information Security, information assurance, GRC, or technology risk, ideally including exposure to a fast-moving transformation or change programme
• Working understanding of technology and AI/agentic system risk, sufficient to recognise and flag emerging initiatives, new suppliers, and in-house builds for detailed assessment by the relevant specialist function
• Experience assessing third-party and vendor security risk, including in the context of AI delivery partners
• Practical understanding of data protection principles, including how purpose limitation and lawful basis apply to data aggregation and AI use cases
• Strong stakeholder management skills, with a demonstrated ability to build trust and influence senior technical and delivery professionals without formal authority over them
• Excellent written and verbal communication, with the ability to translate technical risk for non-technical and executive audiences
• Comfortable operating independently and at pace in a PE-backed, multi-entity environment

About Us

We are Citation. We are far from your average service provider. Our colleagues bring their brilliant selves to work every day and we create an environment where they can shine. We are a nice bunch. We don't do office politics or “that's not my job”. We listen, support and take ownership.

We have been proudly delivering valuable HR and Health and Safety services to SME's across the UK for over 20 years. Passionate about service, we're on a mission to revolutionise our colleague's and client's experience by employing brilliant people who are experts at what they do and smile whilst they are doing it.

Working for Citation you will have access to 25 days holiday, plus your birthday off work, gym membership discount, healthcare, childcare vouchers, the opportunity to purchase extra leave, pension contributions and more.

It's a great place to work because of the people we employ. Fun and professional, we want likeminded individuals who love to love their job (no ‘mood hoovers’ here thanks!) and want the Company to succeed.