Information Security GRC Lead

Information Security GRC Lead

Final date to receive applications: 4 October 2026

Department: Information Governance

Employment Type: Permanent - Full Time

Location: Chippenham, Wiltshire

Reporting To: Carrie Coles

Compensation: £50,000 - £60,000 / year

Reporting into the Head of IGRC, this role provides information security GRC oversight, coordination and assurance across IT security, resilience and control governance, working closely with Technology Teams who retain ownership of technical implementation and day-to-day system administration.

We are seeking a practical and technically capable Information Security GRC Lead to help strengthen Good Energy’s security and control environment. This role will act as a key link between IGRC and Technology Teams; identifying security and compliance requirements, coordinating activity, providing guidance and challenge, evidencing controls, and tracking remediation. The role is not expected to perform day-to-day technical administration but will need sufficient technical understanding to work effectively with the Technology Teams who implement and operate the controls.

Key Responsibilities include:

• IT Security Governance: Maintain oversight of IT security risks, controls, policies and standards, helping define what good control looks like and working with Technology Teams to ensure ownership, implementation and evidence are clear.
• Security Control Assurance: Coordinate and evidence regular assurance over information technology security controls across people, process, premises and technology, working with Technology Teams to validate control operation, escalating gaps and track remediation.
• Information Security Risk and Compliance: Support information security risk and compliance activity by interpreting relevant standards and good practice frameworks, translating requirements into practical actions, and working with Technology Teams to support proportionate implementation.
• Security Incident Support: Support security incident response by helping assess governance, risk and compliance impacts, coordinating evidence, supporting root cause analysis and ensuring lessons learned are tracked with the relevant technical owners
• IT Disaster Recovery and Resilience: Coordinate oversight and challenge of IT disaster recovery arrangements, working with Technology Teams to maintain plans, schedule testing, evidence outcomes, identify dependencies and track remediation of weaknesses.
• IT Change Management: Support effective IT change governance, including chairing or supporting the Good Energy Change Advisory Board, and ensuring security and resilience impacts are considered and that technical owners complete agreed actions before implementation where required.
• PCI-DSS Compliance: Coordinate and support PCI-DSS control activity, evidence gathering, control testing and remediation tracking where technology controls are in scope.
• Penetration Testing and Vulnerability Management: Coordinate penetration testing and support vulnerability management oversight, working with Technology Teams and third parties to risk assess findings, agree ownership and monitor remediation without taking ownership of technical remediation activity.
• Technology Policy and Awareness: Develop, review and maintain technology security policies, standards and guidance, supporting employee awareness of key security responsibilities.

As the Information Security GRC Lead, you will be a proactive, practical and technically aware individual who can work confidently between IGRC, Technology Teams and wider business teams.

You will be able to translate technical security concepts into clear business language, provide…