Lead Information Security & GRC Specialist

About the role

This is a hands‑on, senior‑level position within a well‑established organisation that is expanding its technology and information security capabilities. You will own the governance, risk and compliance (GRC) function, driving the maturity of the Information Security Management System (ISMS) while working closely with technology, infrastructure and business teams.

Key responsibilities

• Lead the continuous development and improvement of the ISMS.
• Drive ISO 27001 implementation, certification and ongoing compliance.
• Conduct security risk assessments and maintain enterprise risk registers.
• Develop, review and maintain security policies, standards and procedures.
• Coordinate internal and external audits, prepare evidence and manage remediation actions.
• Lead third‑party supplier assurance, vendor risk assessments and ongoing governance.
• Embed security controls into projects, operational processes and supplier relationships.
• Support compliance with ISO 27001, NIST and NIS2 frameworks.
• Produce governance reporting and communicate risks and recommendations to senior stakeholders.

Required profile

• Experienced Information Security and GRC professional who enjoys delivering tangible security improvements.
• Proven track record of leading or contributing significantly to an ISO 27001 certification programme.
• Ability to work collaboratively with technology, engineering and business teams.

Required skills

• ISO 27001
• NIST framework
• NIS2
• Information Security Management System (ISMS)
• Security risk assessment
• Vendor risk assessment
• Security policy development
• Governance, Risk & Compliance (GRC) processes