Principal GRC Consultant in Birmingham

We are actively building diverse teams and welcome applications from everyone.

Location: Birmingham (SCC operate hybrid working, which comprises of a mix of office and home working)

Contract Type: Permanent

Salary Package: Competitive plus large company benefits, a broad flexible benefits scheme, and 2 paid-for volunteering days a year

Hours: 9.00 am – 5.30 pm Monday – Friday

Interview Process: 2-stage process

Why SCC?

• An inclusive workplace
• Excellent package: solid basic and company benefits
• Hybrid working & core hours in line with role requirements
• Career development and life-long learning opportunities
• Opportunity to join Europe's largest privately-owned IT Company

Role purpose:

SCC is building a serious GRC consulting capability not a bolt-on, but a practice designed to last. We want someone who can shape it from the inside: influence how we work, who we hire, and what we stand for in the market. The challenge is real. Clients are navigating rapidly evolving regulatory environments, boards that need cyber risk explained in business terms, and a threat landscape that AI is making harder to predict. Frameworks and controls matter but what clients actually need is someone who can think clearly under complexity and lead others to better decisions. This is a principal-level role in the truest sense. The work is advisory, often ambiguous, and always consequential. You will lead GRC engagements with clients across sectors — from initial scoping through to board-ready outputs. That means running risk assessments and maturity reviews, designing governance frameworks and control environments, supporting compliance programmes, and translating regulatory complexity into practical roadmaps. You will also work alongside SCC's sales and architecture teams to shape opportunities and strengthen proposals. Over time, you will help define the practice itself: its methods, its talent, and how it grows. The day-to-day will move between board-level risk discussions and detailed control planning. You need to be equally comfortable in both.

Key responsibilities:

• Help define and shape SCC’s GRC go-to-market strategy, including future service offerings, client propositions and delivery approach
• Lead GRC consulting engagements for clients across a range of sectors, ensuring high-quality outcomes and practical recommendations
• Act as a subject matter expert across recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF and Defence Cyber Certification requirements
• Design and implement governance frameworks, policies, processes and controls that help clients manage cyber risk effectively
• Lead cyber risk assessments, maturity reviews and gap analyses, translating findings into clear improvement plans and business-aligned roadmaps
• Support compliance programmes, audit readiness activity and certification preparation for clients
• Provide expert input into bids, proposals, client presentations and solution design
• Help define the future growth and hiring strategy for the GRC capability, including mentoring and supporting future consultants
• Engage confidently with senior stakeholders, explaining cyber risk and compliance issues clearly, with relevance and actionable

Skills and experience:

• Strong experience in Governance, Risk and Compliance, ideally within cyber security, information security or technology risk
• Good working knowledge of recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF, Cyber Essentials and related assurance or certification schemes
• Experience leading risk assessments, control reviews, audit preparation, compliance programmes or security maturity assessments
• Ability to advise senior stakeholders and translate technical or regulatory requirements into practical business actions
• Previous consulting, advisory or client-facing delivery experience would be highly beneficial
• Strong written and verbal communication skills, including the ability to produce clear reports, recommendations and executive-level briefings
• Confidence working at both strategic and practical levels, from board-level risk discussions through to detailed control improvement planning
• To have already achieved SC (Security Clearance) or willingness to undergo the process for SC Clearance.
• Ideally hold or be working towards recognised Information Security qualifications (e.g., CISSP (Certified Information Systems Security Professional), CISM, ISO 27001 Lead Implementer, CISSP ISSAP), NCSC Practitioner.

SCC is committed to providing equal opportunities and a proactive and inclusive approach to equality and diversity in employment. No applicant or employee will be treated less favourably than another on the grounds of a protected characteristic which are defined as sex, sexual orientation, age, disability, gender reassignment, trade union membership or non-membership, marriage and civil partnership, pregnancy and maternity, race and religion or belief.

If you are selected for interview, and need any reasonable adjustments made for your interview, please let the SCC Talent Acquisition team know, at the point of scheduling.