Information Security Governance, Risk and Assurance Lead

This permanent role leads information security governance, risk and assurance across UKRI's federated technology estate. The postholder builds and sustains an organisation-wide security assurance model, giving independent challenge and an evidence-based view of risk and control effectiveness to the CIO, CISO and governance forums. Assurance stays separate from operation: control and risk owners keep responsibility for their controls, while the role sets standards and holds authority to challenge and track remediation.

Candidates must be eligible for national security vetting and say so in their written submission.

• Be accountable for the effectiveness, coherence and development of UKRI's enterprise security governance, risk and assurance framework
• Set the enterprise assurance approach, standards and evidence expectations, aligned to NIST CSF, ISO 27001 and the Government Cyber Assessment Framework
• Provide independent challenge and oversight of security risk, control design and control effectiveness, without operating the controls assured
• Ensure assurance coverage is risk-based, proportionate and consistent across the federated environment, keeping accountability with local owners
• Challenge risk and control owners, require proportionate remediation, track it to closure and escape material concerns to the CIO, CISO and governance forums
• Provide an evidence-based enterprise view of security risk, control effectiveness, assurance gaps and remediation status for senior decisions
• Drive transparency and comparability through assurance measures, trend analysis and decision-quality reporting
• Influence the future security operating model by embedding sustainable governance and assurance arrangements

• Substantial experience leading information security governance, risk and assurance in a complex or federated organisation
• Proven experience establishing and improving enterprise security assurance frameworks across complex technology and supplier environments
• Experience providing independent challenge to senior risk and control owners while preserving their accountability
• Experience assessing control design and effectiveness using technical, procedural and audit evidence
• Experience setting proportionate remediation expectations, tracking delivery and escalating material concerns through senior governance routes

• Strong knowledge and proportionate application of NIST CSF, ISO 27001 and the Government Cyber Assessment Framework
• Ability to produce and communicate an authoritative, evidence-based view of security risk and control effectiveness for CIO, CISO and governance audiences
• Strong leadership, influence and analytical skills, driving consistency across organisational boundaries and deciding where evidence is incomplete or contested
• Skills in line with the cyber security risk manager role in the Government Security Profession career framework

• Eligibility for national security vetting under UK National vetting guidelines, willingness to undergo the process, and indication of eligibility in the written submission

• Defined benefit pension scheme
• 30 days' annual leave plus 10.5 public and privilege days (full-time equivalent)
• Employee discounts and offers on retail and leisure activities
• Employee assistance programme offering confidential help and advice
• Flexible working options, including compressed hours
• Hybrid working between Swindon and Didcot
• Support for development and continuous learning
• Wellbeing initiatives