GRC Audit & Assurance Consultant – PriCSP Audit certified

Overview

In this role you lead governance, risk, compliance and assurance across a complex cyber security programme. You will coordinate cross-functional inputs from cyber security, risk, compliance, architecture, IT and OT to deliver evidence-led assessments and remediation plans. You’ll apply frameworks like NCSC CAF/eCAF to judge control effectiveness and drive improvements. You’ll partner with senior stakeholders to shape governance, assurance reporting and regulatory readiness, making security a governing priority.

Pay / Benefits

• flexible work options
• learning and development opportunities
• tailored wellbeing support
• career growth opportunities
• equal opportunities and inclusive culture

Responsibilities

• Lead GRC assessment and assurance activities across the programme scope, coordinating inputs from cyber security, risk, compliance, architecture, IT and OT stakeholders
• Perform evidence-led assurance by reviewing policies, standards, procedures, artefacts, records and risk information to verify controls
• Conduct gap assessments against regulatory, contractual and security-framework requirements, including NCSC CAF/eCAF
• Review customer self-assessments and control assertions, identifying supported/partially supported/contradictory positions
• Assess governance, risk management, control ownership, policy frameworks, assurance processes, evidence management and compliance reporting
• Facilitate interviews, workshops and challenge sessions with business, technical and operational stakeholders
• Maintain traceability between requirements, controls, evidence, findings and remediation actions
• Differentiate between control and evidence deficiencies and document assessment limitations
• Develop evidence-based findings with criteria, evidence, risk and proportionate recommendations
• Assess control design and operating effectiveness and sustainability where possible
• Consolidate findings into maturity, gap and readiness views for senior stakeholders
• Develop prioritised remediation recommendations and support remediation planning and tracking
• Review remediation evidence and validate findings as addressed, partially addressed or open
• Contribute to executive reporting, audit readiness and regulatory preparation
• Apply internal QA and peer-review to ensure defensible conclusions
• Provide day-to-day leadership to GRC assessors and consultants
• Allocate assessment areas and review papers, evidence mapping and scoring for quality
• Establish a consistent assessment and evidence-evaluation approach across the team
• Challenge unsupported conclusions and document professional judgements
• Coordinate with technical specialists to incorporate IT/OT findings into GRC assessments
• Escalate evidence gaps and risks through governance routes
• Present findings, maturity positions, risks and recommendations to customer SMEs and executives

Key requirements

• PriCSP (Audit) certification mandatory
• Strong practical experience in cyber security governance, risk and compliance, assurance, audit or security maturity
• Experience delivering structured gap assessments against recognised cyber security frameworks
• Experience with NCSC CAF/eCAF assessments or comparable frameworks
• Strong evidence-assessment capability including relevance, sufficiency and traceability of evidence
• Experience reviewing security policies, standards, procedures and control artefacts
• Experience assessing control design and operating effectiveness
• Strong stakeholder interviewing, workshop facilitation and challenge skills
• Ability to write clear, defensible findings and executive-level recommendations
• Experience translating findings into prioritised remediation actions
• Experience operating in complex environments with IT and/or OT stakeholders

• Strong stakeholder engagement
• Facilitation and challenge skills
• Clear, concise written communication
• NCSC CAF/eCAF assessments
• GRC/assurance methodologies
• Evidence-based assessment and traceability

…