Head of Security – Cyber GRC

About the role

The Head of Cyber Governance, Risk & Compliance (GRC) provides senior operational leadership for cyber GRC and assurance across NHS England’s national, highly federated technology landscape. Reporting to the Security Principal, the role ensures cyber risk is understood, governed and managed proportionately while supporting rapid digital transformation.

Key responsibilities

• Lead day‑to‑day delivery of the Cyber GRC function with delegated authority.
• Develop and maintain centralised cyber governance, policy and risk‑management frameworks.
• Ensure security policies, standards and controls remain fit for purpose and aligned to business risk.
• Oversee compliance and assurance activities against ISO 27001, the NCSC Cyber Assessment Framework and other national mandates.
• Produce high‑quality cyber risk and resilience reporting for senior leaders and governance forums.
• Embed security‑by‑design into services and programmes in partnership with technology and transformation teams.

Required profile

• Proven senior leadership experience in cyber governance, risk and compliance within large, complex organisations.
• Strong understanding of national critical infrastructure protection and public‑sector cyber requirements.
• Ability to lead specialist teams and influence matrixed stakeholders through change.
• Excellent communication skills to convey risk insights to senior decision‑makers.

Required skills

• ISO 27001
• NCSC Cyber Assessment Framework