GRC Audit & Assurance Consultant – PriCSP Audit certified

Overview

As Lead GRC Consultant, you will drive governance, risk, compliance and assurance across a complex cyber security programme. You will work with IT and OT teams to apply frameworks like NCSC CAF/eCAF and maintain a clear focus on governance, risk management and control effectiveness. You will lead evidence-led assessments, challenge assertions, and shape remediation across multiple stakeholders. You will partner with senior teams to produce actionable findings and support regulatory and audit readiness. This role offers impact at scale within a global technology services leader.

Pay / Benefits

• tailored benefits supporting wellbeing
• Learning and Development opportunities
• flexible work options
• global employer recognition

Responsibilities

• Lead GRC assessment and assurance activities across the programme, coordinating cyber security, risk, compliance, architecture, IT and OT stakeholders
• Perform evidence-led assurance by reviewing policies, standards, procedures, artefacts and risk information to verify controls are implemented
• Conduct structured gap assessments against regulatory, contractual and security framework requirements (NCSC CAF/eCAF where applicable)
• Review customer self-assessments and control assertions, identifying supported/partially supported/unsupported positions
• Assess governance arrangements, risk-management, policy frameworks, assurance processes and compliance reporting
• Facilitate interviews, workshops and challenge sessions with business, technical and operational stakeholders
• Maintain traceability between requirements, controls, evidence, findings, risks, recommendations and remediation actions
• Develop evidence-based findings with clear criteria and remediation recommendations
• Assess control design and operating effectiveness, and sustainability of controls
• Consolidate findings into maturity, gap and readiness views for senior stakeholders
• Develop prioritised remediation recommendations and support remediation planning and tracking
• Review remediation evidence to validate addressed or open findings
• Contribute to executive, audit/readiness reporting and regulatory preparation
• Apply internal quality assurance to ensure defensible conclusions
• Provide day-to-day leadership to GRC assessors and consultants
• Establish consistent assessment and evidence-evaluation approaches across the team
• Challenge unsupported conclusions and document professional judgments clearly
• Coordinate with technical specialists to incorporate IT/OT findings into GRC assessments
• Escalate material evidence gaps and dependencies through governance routes
• Present findings and recommendations to customer SMEs and executives

Key requirements

• PriCSP (Audit) certification/accreditation is mandatory
• Strong experience in cyber security governance, risk and compliance, assurance, audit or security maturity assessment
• Proven ability to deliver structured gap assessments against cyber security frameworks or regulatory requirements
• Experience with NCSC CAF/eCAF assessments or similar control-based assurance frameworks
• Strong evidence-assessment capability (relevance, sufficiency, reliability, currency, consistency, traceability)
• Experience reviewing security policies, standards, procedures and risk registers
• Experience assessing control design, implementation and operating effectiveness
• Excellent stakeholder interviewing, facilitation and challenge skills across technical, operational and senior audiences
• Ability to write clear, defensible findings and executive-ready recommendations
• Experience translating findings into remediation actions and evidence requirements
• Experience operating in complex business, IT and OT environments
• Desirable: regulated-sector experience, NIS compliance, audit readiness, or independent quality reviews
• Desirable: certifications such as CISSP, CISM, CRISC, GICSP, ISO 27001 Lead Auditor/Lead Implementer

• stakeholder facilitation
• strong communication
• challenge and critical thinking
• NCSC CAF/eCAF
• GRC/assurance frameworks
• policy and evidence management

…