Senior Cyber Risk Advisory Consultant | Cyber GRC & Transformation

You’ll work across a broad range of private-sector clients, including organisations operating critical national infrastructure (CNI) and those with operational technology (OT) environments, bringing variety and exposure to complex business and security challenges.

You’ll become a trusted extension of your clients’ teams, helping them strengthen governance, manage cyber risk and navigate frameworks, audits and compliance within a wider improvement programme.

owning delivery and stakeholder relationships, with experienced specialists and other consultants available to support you.

This is an opportunity to take clients beyond identifying gaps: helping them implement recommendations, embed sustainable processes and demonstrate progress over time.

• Lead substantial GRC programmes for enterprise clients, taking responsibility for scope, planning, delivery and outcomes across multiple work streams.
• Build trusted relationships with senior security, technology and business stakeholders, acting as the main contact for your engagements.
• Deliver risk assessments, maturity reviews and improvement programmes, drawing on ISO 27001, NCSC CAF, NIST and other relevant frameworks.
• Support ISMS development, audit readiness and ongoing compliance, guiding implementation and coordinating contributions from other consultants where required.

• Proven experience personally leading large GRC or cyber risk consulting engagements for enterprise organisations, with accountability for delivery and client outcomes.
• The judgement and confidence to work independently, manage competing priorities and navigate complex stakeholder environments.
• Strong practical ISO 27001 knowledge and broader experience across governance, risk and assurance, including taking recommendations through to implementation.
• Strong client-facing consulting skills, with the ability to challenge constructively and communicate clearly with senior stakeholders.

Experience with CNI, OT environments, third-party risk or wider resilience programmes would be valuable. UK right to work and eligibility for UK Security Check (SC) clearance are required.

The consultancy is working towards NCSC Assured Cyber Security Consultancy (ACSC) status, making this an attractive time to join a business developing its risk and assurance capability.

For someone looking to deepen their risk management expertise or work towards Chartered Cyber Security Professional status, the role offers opportunities to build relevant experience through substantial client programmes and contribute to the development of the practice.

The business will fund relevant qualifications, including CISSP, CISM and ISO 27001 Lead Implementer or Lead Auditor, supporting your professional development alongside your client work.