Information Security Governance, Risk and Assurance Lead

Overview

In this role you lead UKRI’s enterprise information security governance, risk and assurance across a federated environment. You provide independent challenge, set assurance standards, and deliver an evidence-based view of risk and control effectiveness to senior stakeholders. You will help shape and sustain a scalable governance framework aligned to NIST CSF, ISO 27001 and the Government Cyber Assessment Framework. This is a chance to enable secure delivery of UKRI’s strategic objectives in a federated, fast-paced research setting.

Pay / Benefits

• defined benefit pension
• 30 days leave plus 10.5 public and privilege days
• employee discounts and offers
• employee assistance programme
• flexible working options
• wellbeing initiatives

Responsibilities

• Own the effectiveness and development of UKRI’s enterprise security governance, risk and assurance framework
• Provide independent challenge and oversight of risk, control design and effectiveness
• Set enterprise assurance standards and evidence expectations aligned to risk and frameworks
• Ensure risk-based, proportionate assurance across the federated environment and maintain accountability of owners
• Challenge risk and control owners, drive remediation, and escalate material concerns through governance forums
• Deliver an authoritative, evidence-based view of risk and control status for senior decision-makers
• Advance transparency and decision-quality reporting through meaningful assurance measures and trend analysis
• Influence future security operating models by embedding sustainable governance and assurance for strategic objectives

Key requirements

• Substantial experience leading information security governance, risk and assurance in complex/federated organisations
• Experience establishing enterprise security assurance frameworks across technology and supplier environments
• Experience providing independent challenge to senior risk and control owners
• Experience assessing control design and effectiveness using technical, procedural and audit evidence
• Experience setting remediation expectations, tracking delivery, escalating concerns through governance routes
• Strong knowledge of NIST CSF, ISO 27001 and the Government Cyber Assessment Framework
• Ability to communicate an authoritative view of enterprise security risk to CIO/CISO/governance audiences
• Strong leadership, influence and analytical skills across organisational boundaries

• leadership
• influence
• analytical thinking
• NIST CSF
• ISO 27001
• Government Cyber Assessment Framework

…