UK Head of IT Risk & Compliance

Priory; West of England; Hybrid; GBP 72,000 - 88,000; Full time

Benefits offered by this job

Car allowance

Private Medical Insurance

Life Assurance

25 days Annual Leave + bank holidays

Employee Assistance Programme

IPD / professional development support

Cycle to work scheme

Job summary

Priory Group seeks a UK Head of IT Risk & Compliance to lead our information security strategy across the UK. You will own risk governance, regulatory compliance and the ISMS, coordinating with senior leaders and our CIO to strengthen controls and posture.

Reporting to UK IT leadership, you will drive risk identification, remediation planning and assurance activities, including audits and third‑party risk management, while guiding senior stakeholders on strategic security decisions.

Qualifications

• Significant IT risk, compliance or audit experience.
• Strong knowledge of information security standards and regulatory requirements.
• Experience building or leading ISMS programs and security controls.

Responsibilities

• Develop and deliver UK information security strategy aligned to Group policies.
• Oversee IT risk assessment, governance and compliance processes.
• Lead ISMS development, audits and improvements.
• Manage third-party IT risk assessments and due diligence.
• Lead incident response and reporting to senior stakeholders.

Skills

IT risk management

Governance & compliance

ISMS management

ISO 27001

NIST

GDPR

Stakeholder management

Information security

Education

Bachelor's degree in IT/Security

Tools

ISO 27001

Cyber Essentials

Job description

UK Head of IT Risk & Compliance

Application Deadline: 13 November 2026

Department: Senior Management and Leadership

Employment Type: Permanent - Full Time

Location: Priory IT Offices

Compensation: £80,000 / year

Description

We are recruiting a UK Head of IT Risk & Compliance to join our IT Senior Leadership Team in Bristol. This is a newly created role, offering the opportunity to shape and lead our UK information security strategy, strengthening how we manage IT risk, governance and compliance across the business.

Reporting directly to our UK Chief Information Officer, you'll take ownership of our UK information security approach, ensuring our systems, data and technology services are secure and meet regulatory requirements. You'll work closely with senior stakeholders and our Group Chief Information Security Officer to strengthen our security controls, improve risk management and contribute to our wider Group information security strategy. This is a hybrid role with at least 2 days per week required in the Bristol office.

What you'll be doing

You'll be responsible for developing and delivering our UK information security strategy, ensuring we have effective governance, risk management and compliance processes in place. You'll lead the ongoing development of our Information Security Management System (ISMS), helping to embed a proactive, risk-based approach to information security across the business.

Key responsibilities include:

• Information security strategy: Develop and deliver our UK information security strategy, ensuring alignment with Group policies, regulatory requirements and business priorities.
• Risk management: Oversee the identification, assessment and management of IT risks, maintaining effective risk registers and driving improvements to reduce exposure.
• Governance and compliance: Lead the development and continuous improvement of our ISMS, ensuring alignment with ISO 27001, Cyber Essentials and relevant healthcare regulatory requirements.
• Audit and assurance: Lead internal and external IT security audits, coordinating compliance assessments, certifications and improvement plans.
• Third-party risk: Oversee IT supplier risk assessments, due diligence and ongoing assurance, ensuring third-party systems and services meet our security requirements.

You’ll also lead our response to significant information security incidents, working closely with IT, Legal and other business teams to manage risks and drive improvements. As a senior leader, you’ll provide guidance on information security matters, oversee the UK IT Risk & Compliance budget and report on our security and compliance position to senior stakeholders.

What you'll bring to the role

You’ll be an experienced IT risk and compliance professional with a strong understanding of information security, regulatory requirements and risk management frameworks. You’ll combine strategic thinking with practical experience, bringing the ability to influence senior stakeholders, improve governance and embed effective risk management across a complex organisation.

We’re looking for someone with:

• Risk and compliance experience: Significant experience in IT risk, compliance or audit roles, with a proven ability to develop and deliver information security or governance strategies.
• Information security expertise: Strong knowledge of information security frameworks and regulatory standards, including ISO 27001, NIST, Cyber Essentials and GDPR.
• ISMS management: Hands-on experience implementing, managing and continuously improving an Information Security Management System.
• Risk management: Experience conducting IT risk assessments, identifying compliance gaps and developing effective mitigation plans.
• Audit and assurance: Experience planning and delivering internal and external audits, managing compliance assessments and reporting on findings.
• Technical understanding: A good understanding of IT infrastructure, cybersecurity and technology environments, with the ability to assess associated risks.
• Stakeholder management: Experience working with senior leaders, technical teams and external partners, translating complex security and compliance requirements into practical business actions.

You’ll also bring strong communication, organisational and analytical skills, with the confidence to challenge existing processes and influence decision-making. A recognised qualification in risk management, compliance, audit or a related field, or a willingness to work towards one, is important.

Experience working within a regulated industry, particularly healthcare, would be advantageous, alongside an understanding of healthcare‑specific information security requirements.

This position is a leadership role at Priory and during the interview process we will be assessing candidates against our leadership behaviours. These are a set of ten values driven behaviours that define great leadership at Priory. They are integral to driving a positive high performing culture where we strive to deliver the best care and outcomes for the people we support. You can find out more about our interview approach and our leadership behaviours here.

What we will give you in return

We want you to succeed at Priory and thrive in your role. You will be well supported with regular career conversations. We also offer full training and numerous pathways into leadership and qualified clinical positions to help you shape your career with us.

• £5,200 Car Allowance
• Private Medical Insurance
• Life Assurance
• 25 days Annual Leave + Bank Holidays + additional day’s leave for your Birthday!
• Annual leave entitlement increases based on length of service: 27 days after 5 years’ service and 30 days after 10 years’ service
• Length of service recognition awards – every 5 years
• Employee Assistance Programme
• Initial Disclosure Check Cost covered, if applicable to role
• ‘My Possible Self’ App and health-related benefits
• Online discounts and cashback rewards – Priory Perks
• Smart Technology scheme (qualifying period)
• Cycle to work scheme (qualifying period)
• Smart Holidays (qualifying period)
• Gym Flex (qualifying period)
• Healthcare Cash Plan – Simply Health Scheme
• Eye Care Vouchers
• ‘Cash for Colleagues’ – Employee referral scheme
• Access to development opportunities
• Sponsorship of professional qualifications through our Individual Professional Development (IPD) panel
• Leadership & management development
• Parental Leave Gift

Please take the time to familiarise yourself with the full job description attached prior to making an application.

Shortlisting may begin upon receipt of applications, and the Recruiting Manager may close the vacancy early if enough suitable candidates are identified.