GRC Manager - Cyber Security

We are looking for an experienced GRC Manager to join a growing Information Security function within a PE-backed international organisation undergoing significant growth and transformation.

Reporting directly to the Director of Information Security, you’ll take ownership of Governance, Risk and Compliance activities across the business, with an immediate focus on supporting the organisation through ISO 27001 certification.

This is an opportunity to have genuine ownership. We’re not looking for someone who has simply contributed to GRC within a large team; we need someone who understands how to take frameworks, controls and best practice and implement them effectively within a lean, fast-moving organisation.

The Role

You’ll take ownership across:

• Driving the organisation’s ISO 27001 certification journey and ongoing ISMS maturity.
• Developing and maintaining security policies, standards and governance frameworks.
• Managing information security risks, risk registers, treatment plans and remediation.
• Coordinating audit evidence, control assessments and audit readiness.
• Supporting compliance with NIS2, NCSC CAF, GDPR and Cyber Essentials.
• Managing third-party security assessments, supplier assurance and customer security questionnaires.
• Producing meaningful security KPIs, KRIs and executive reporting.
• Working across IT, OT, Legal, Procurement, Operations and Commercial teams to drive security improvements.
• Supporting security awareness, business continuity and post-incident improvement activities.
• Continuously improving and automating GRC processes as the organisation grows.

The key requirement is someone who has personally helped take an organisation through ISO 27001 certification and understands what successful implementation looks like in practice.

You’ll ideally bring:

• Strong practical experience across information security Governance, Risk & Compliance.
• Experience developing or significantly maturing a GRC function or ISMS.
• End-to-end ownership of ISO 27001 controls, evidence, audits and remediation.
• Experience managing security risks and driving actions through to completion.
• Exposure to third-party/supplier assurance and customer security requirements.
• Knowledge of NIS2 would be particularly valuable.
• Excellent stakeholder management and communication skills.

You’ll need the confidence to challenge and influence people across the organisation, translating complex security risks into clear business language for audiences ranging from technical teams through to senior executives.

We’re open on industry background. More important is your ability to operate autonomously, adapt best practice to a lean environment and take genuine ownership rather than being one part of a large GRC function.