Senior GRC Security Consultant - Lead & Shape Cyber Risk in Manchester

About the Role

As a Senior Security Consultant within the Governance, Risk & Compliance (GRC) practice, you will lead and deliver cybersecurity, governance, risk and assurance engagements across public and private sector organisations. This client‑facing consultancy role requires strong strategic advisory, practical delivery and commercial awareness, working closely with client stakeholders at all levels to strengthen security posture, manage cyber risk, improve compliance maturity and implement pragmatic security governance frameworks aligned to business objectives.

Key Responsibilities

• Lead and deliver a range of Governance, Risk & Compliance (GRC) and cybersecurity consultancy engagements across public and private sector clients.
• Provide subject matter expertise across information security governance, risk management, compliance, assurance and security best practices.
• Deliver security assessments, audits, gap analysis, risk assessments, maturity reviews and remediation planning activities aligned to recognised frameworks and standards.
• Support clients in the development, implementation and continual improvement of Information Security Management Systems (ISMS) and associated governance processes.
• Produce high‑quality client deliverables including reports, policies, standards, procedures, risk registers, executive summaries and roadmap documentation.
• Facilitate workshops and engage with stakeholders at all levels, including technical teams, operational management and senior leadership.
• Support clients in understanding and managing cyber risk in a pragmatic and business‑aligned manner.
• Conduct supplier and third‑party assurance activities, including due diligence and control assessments where required.
• Contribute to business development activities including proposal responses, Statements of Work (SoWs), bid support and pre‑sales engagements.
• Support and mentor junior consultants through knowledge sharing, quality assurance activities and collaborative delivery.
• Maintain awareness of emerging threats, regulatory developments, industry trends and evolving security frameworks and standards.
• Contribute to the ongoing growth, capability and maturity of the Secure Advisory practice.

Essential Skills & Experience

• Strong experience delivering Governance, Risk & Compliance (GRC) and information security consultancy services within client‑facing environments.
• Practical experience implementing, assessing or managing security frameworks and standards such as ISO/IEC 27001, NIST, Cyber Essentials, CIS Controls, PCI DSS and NCSC Cyber Assessment Framework (CAF).
• Deep understanding of information security governance, risk management, compliance and assurance principles.
• Experience conducting risk assessments, control reviews, compliance gap assessments and security maturity assessments.
• Experience developing and maintaining Information Security Management Systems (ISMS), including supporting policies, standards and procedures.
• Ability to produce clear, high‑quality documentation and reports suitable for both technical and non‑technical audiences.
• Strong stakeholder management and communication skills, with the ability to engage confidently at all levels including senior leadership.
• Experience facilitating workshops, presenting findings and supporting remediation and improvement activities.
• Commercial awareness with experience supporting proposals, Statements of Work (SoWs), pre‑sales activities or bid responses.
• Good general understanding of modern IT and cloud environments, including Microsoft 365, SaaS platforms, cloud services and traditional infrastructure.
• Ability to manage multiple engagements and priorities within a consultancy environment.
• Excellent analytical, problem‑solving and decision‑making skills.
• Willingness to travel to customer locations where required.
• Ability to secure UK Security Clearance to obtain SC and NPPV3.

Desirable Skills & Experience

• Experience delivering consultancy services within UK public sector or regulated environments.
• Knowledge of data protection and privacy regulations, including UK GDPR and Data Protection Act requirements.
• Knowledge of FCA security requirements.
• Experience supporting supplier assurance, third‑party risk management or operational resilience activities.
• Experience delivering security awareness sessions, workshops or client training activities.
• Exposure to business continuity, disaster recovery or wider operational resilience programmes.
• Hands‑on technical security or infrastructure experience.

Certifications & Qualifications

• Demonstrable experience within information security, cybersecurity, governance, risk, compliance or assurance‑focused roles.
• Former experience delivering within a consulting environment.
• Hold a minimum of two of the following: ISO/IEC 27001 Lead Auditor and/or Lead Implementer, CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CISMP or equivalent security qualification, Cyber Essentials Assessor qualification, Relevant NIST, CAF, PCI DSS or risk‑management certifications, Degree‑level qualification in Cyber Security, Information Security, Computer Science, Risk Management or related discipline.

Benefits

• Compensation and Financial Wellbeing: Competitive base salary. Matching pension scheme (up to 5%) from day one. Discretionary company bonus scheme. 4 × annual salary Death in Service coverage from day one. Employee referral scheme. Tech Scheme.
• Health and Wellness: Private medical insurance from day one. Optical and dental cash‑back scheme. Help@Hand app: access to remote GPs, second opinions, mental health support and physiotherapy. EAP service. Cycle to Work scheme.
• Work‑Life Balance and Growth: 28 days of annual leave + bank holidays. An extra paid day off for your birthday. Ten paid learning days per year. Flexible working hours. Market‑leading parental leave. Sabbatical leave (after five years). Work from anywhere (up to three weeks per year). Industry‑recognised training and certifications. Bonusly employee recognition and rewards platform. Clear opportunities for career development. Length of Service Awards. Regular company events.