Cyber Governance, Risk & Compliance Lead; GRC)

Salary: Up to £60k + car allowance + package
Location: Leeds (Remote role with some travel)

This is an opportunity to join a stable and growing organisation in a key Group-level cyber security role, working across a diverse portfolio of subsidiary businesses.

As Cyber Governance, Risk & Compliance Lead, you will play a central role in maintaining and developing the Group's cyber governance framework, supporting subsidiaries with security compliance, audit readiness and risk management.

You will also play an important role in integrating newly acquired businesses into the Group's cyber governance framework, building relationships with subsidiary IT teams and helping to establish consistent standards across the organisation.

Reporting to the Group Information Security Officer, you will act as a key point of contact for cyber governance, risk and compliance activity across the Group.

Responsibilities will include:

• Acting as the main point of contact for cyber security audits and audit readiness across the Group.

• Maintaining, reviewing and challenging IT and cyber risk registers, ensuring appropriate remediation and risk treatment activity is in place.

• Supporting subsidiaries with ISO 27001 compliance, audits and ongoing certification requirements.

• Carrying out cyber risk assessments and security maturity assessments using recognised frameworks including NIST and CIS Controls.

• Supporting the integration of newly acquired businesses into the Group's cyber governance and security frameworks.

• Developing, reviewing and maintaining information security policies, standards and procedures.

• Managing and maintaining the Group Cyber Incident Response Plan.

• Working with IT, infrastructure, architecture, legal, privacy and business teams to ensure appropriate security controls are implemented.

• Reviewing vulnerabilities and cyber risks, articulating their potential impact and recommending appropriate controls and mitigations.

• Supporting third-party and supplier security assurance activity.

• Producing cyber risk, compliance and assurance reporting for senior stakeholders.

• Building strong relationships with subsidiary IT teams and acting as a trusted point of contact for cyber governance matters.

We are looking for an experienced Cyber GRC professional who can operate independently and quickly become a trusted point of contact across the Group.

You should have:

• Strong practical experience across cyber security governance, risk and compliance.

• Good knowledge of ISO 27001, including experience supporting or leading audit and certification activity.

• Practical experience working with NIST and CIS security frameworks.

• Experience conducting cyber risk assessments, control assessments or security maturity reviews.

• Experience reviewing and managing cyber or technology risk registers.

• Experience coordinating internal or external security audits and managing audit readiness.

• The ability to assess cyber security risks and vulnerabilities and recommend appropriate mitigation.

• Strong stakeholder management skills with the ability to build relationships across multiple business units.

• The ability to translate technical security risks into clear information for technical and non-technical audiences.

• A pragmatic and flexible approach to working across organisations with different levels of cyber maturity.

This is a varied Group-level role offering the opportunity to work across multiple subsidiary businesses and influence cyber governance standards across a growing organisation.

You will join an established security environment, with several Group businesses already operating to ISO 27001 standards, while having the opportunity to further mature cyber governance, support new acquisitions and develop consistency across the wider Group.

Fruition are an equal opportunities employer and welcome applications from all suitably qualified persons regardless of their race, sex, disability, religion/belief, sexual orientation or age.