Security Consultant / Operational Security & GRC

Overview

In this client-facing role, you translate business needs, threats and regulatory requirements into practical security decisions. You will provide governance, risk and compliance guidance to help clients improve security posture. You’ll oversee operational security, vulnerability management and threat response while ensuring controls are effective and aligned with standards. You’ll work with cross-functional teams to deliver pragmatic recommendations that fit the client’s risk appetite and context. This opportunity combines strategic oversight with hands-on consultancy in a global security services environment.

Pay / Benefits

• tailored benefits
• flexible work options
• learning and development opportunities
• focus on physical, emotional and financial wellbeing
• commitment to equal opportunities and inclusion
• interviewing accommodation for disabilities

Responsibilities

• Establish and improve security governance, policies, standards and control frameworks; provide independent oversight of performance and remediation
• Oversee day-to-day operational security across technology and service environments; manage vulnerabilities, threats, incidents and control weaknesses
• Review vulnerability and testing outputs; prioritise remediation based on asset criticality, threat intel and business impact
• Interpret threat intelligence and alerts; coordinate appropriate response and escalate material risks
• Facilitate risk identification, assessment, treatment plans and residual risk evaluation; ensure traceability from threats to controls
• Assess design and operating effectiveness of controls against ISO/IEC 27001, NIST CSF and regulatory requirements
• Plan and support audits; coordinate evidence and drive timely closure of findings
• Produce concise risk and compliance reporting for management; support risk-based decision making
• Engage with clients and stakeholders as a trusted adviser; translate complex issues into clear actions
• Lead or contribute to security assessments, governance reviews and control improvement programmes; drive pragmatic recommendations
• Identify opportunities to simplify governance and strengthen security practices through continuous improvement

Key requirements

• Five or more years in information security management, operations, GRC, consulting, risk, audit or compliance
• Professional certifications such as CISM, CISSP, CRISC, CISA or ISO/IEC 27001 Lead Auditor/Lead Implementer
• UK Cyber Security Council title advantageous
• Strong understanding of ISO/IEC 27001, NIST CSF and NIST 800-53 plus relevant legal/regulatory requirements
• Experience overseeing vulnerabilities, threats, incidents and remediation across enterprise or managed services
• Knowledge of vulnerability management, risk-based prioritisation and remediation closure
• Ability to translate findings into prioritized treatment plans; define security metrics and reporting
• Consulting experience including discovery, stakeholder interviews, reporting and client delivery
• Credibility with senior stakeholders and auditors; ability to challenge constructively
• Practical leadership style balancing independent oversight with hands-on problem solving
• Clear written and verbal communication for technical and non-technical audiences
• Attention to detail and ability to manage competing priorities in a client-facing environment
• Right to work in the UK and eligibility for UK Security Check clearance

• strong communication
• credible and confident stakeholder engagement
• ability to influence and challenge respectfully
• ISO/IEC 27001
• NIST CSF
• NIST 800-53

…