Information Security Governance, Risk and Assurance Lead

This permanent role leads information security governance, risk and assurance across UKRI's federated technology estate. The postholder builds and sustains an organisation-wide security assurance model, giving independent challenge and an evidence-based view of risk and control effectiveness to the CIO, CISO and governance forums. Assurance stays separate from operation: control and risk owners keep responsibility for their controls, while the role sets standards and holds authority to challenge and track remediation.

What the job involves:

• Be accountable for the effectiveness, coherence and development of UKRI's enterprise security governance, risk and assurance framework.
• Set the enterprise assurance approach, standards and evidence expectations, aligned to NIST CSF, ISO 27001 and the Government Cyber Assessment Framework.
• Provide independent challenge and oversight of security risk, control design and control effectiveness, without operating the controls assured.
• Ensure assurance coverage is risk-based, proportionate and consistent across the federated environment, keeping accountability with local owners.
• Challenge risk and control owners, require proportionate remediation, track it to closure and escape material concerns to the CIO, CISO and governance forums.
• Provide an evidence-based enterprise view of security risk, control effectiveness, assurance gaps and remediation status for senior decisions.
• Drive transparency and comparability through assurance measures, trend analysis and decision-quality reporting.
• Influence the future security operating model by embedding sustainable governance and assurance arrangements.

What’s required:

Experience:

• Substantial experience leading information security governance, risk and assurance in a complex or federated organisation.
• Proven experience establishing and improving enterprise security assurance frameworks across complex technology and supplier environments.
• Experience providing independent challenge to senior risk and control owners while preserving their accountability.
• Experience assessing control design and effectiveness using technical, procedural and audit evidence.
• Experience setting proportionate remediation expectations, tracking delivery and escalating material concerns through senior governance routes.

Skills & knowledge:

• Strong knowledge and proportionate application of NIST CSF, ISO 27001 and the Government Cyber Assessment Framework.
• Ability to produce and communicate an authoritative, evidence-based view of security risk and control effectiveness for CIO, CISO and governance audiences.
• Strong leadership, influence and analytical skills, driving consistency across organisational boundaries and deciding where evidence is incomplete or contested.
• Skills in line with the cyber security risk manager role in the Government Security Profession career framework.

Checks & eligibility:

• Eligibility for national security vetting under UK National vetting guidelines, willingness to undergo the process, and indication of eligibility in the written submission.

What’s offered:

• Defined benefit pension scheme.
• 30 days' annual leave plus 10.5 public and privilege days (full-time equivalent).
• Employee discounts and offers on retail and leisure activities.
• Employee assistance programme offering confidential help and advice.
• Flexible working options, including compressed hours.
• Hybrid working between Swindon and Didcot.
• Support for development and continuous learning.
• Wellbeing initiatives.