Information Security GRC Manager

Could you lead a team responsible information security risk management for the British Red Cross, including the identification, assessment, and treatment, well as third-party and supply chain cyber security risk management?

What will a day in the life of an Information Security GRC Manager involve?

• Develop and maintain the information security governance framework for the British Red Cross, including policies, standards, and processes, ensuring they align with organisational objectives, legal, contractual, regulatory requirements, and best practices.
• Oversee and continuously improve the information security risk management framework, ensuring robust processes for identifying, assessing, recording, and managing information security risks across the British Red Cross.
• Own the management of information security risks, including developing appropriate risk mitigation and treatment plans when risk levels exceed acceptable thresholds, providing regular reporting and insight on key risks, risk trends, and control effectiveness.
• Lead the ISO 27001 certification programme and ongoing compliance with the ISO/IEC 27001 standard.
• Act as the primary point of contact for external auditors and certification bodies, planning and coordinating certification (and surveillance) audits, ensuring that all necessary evidence, documentation, and corrective actions are managed effectively.
• Work in partnership with other stakeholders, departments, and functions to ensure a cohesive approach to information security across the organisation.

• Strong emotional intelligence, and a commitment to inclusive leadership, creating an environment where team members can grow and excel.
• Excellent knowledge of common cyber and information security compliance requirements, including PCI DSS (Payment Card Industry Data Security Standard), Cyber Essentials, and the NHS Data Security & Protection Toolkit.
• Proven experience implementing or maintaining an ISO/IEC 27001 certified ISMS, including managing certification audits and continual improvement cycles.
• Strong understanding of enterprise risk management methodologies and tools, particularly as they apply to information security risk identification, assessment (quantitative and qualitative), mitigation, and monitoring.
• Demonstrable experience in information security risk management, including establishing risk assessment processes, running risk workshops, managing risk registers, and presenting risk statuses to senior management or governance boards.

In return for your commitment and expertise, you’ll get:

• Flexible working: Remote and hybrid working, flexitime, compressed hours, and job sharing.
• Holidays: 36 days annual leave (including bank holidays) + option to buy 5 extra days.
• Pension scheme: Up to 6% contributory pension.
• Learning & Development: A range of career & learning opportunities.
• Discounts: Blue Light Discount Card, Tickets For Good & employee benefits platform..
• Wellbeing Support: Peer Supporters, CiC (EAP) & Headspace App.
• Cycle2Work: Lease a bicycle through the scheme.

We are proud to champion inclusion as a Disability Confident employer across our UK-based roles and as a Carers Confident employer. We are dedicated to building an inclusive, equitable and wellbeing-focused culture where everyone feels safe, valued and can thrive. Guided by our Equity, Diversity, Inclusion and Wellbeing Strategy, we foster belonging, psychological and physical wellbeing, and work to remove barriers to fair opportunities. Grounded in compassion and anti-racist practice, we listen to diverse voices, value lived experience and create environments where staff and volunteers can succeed. Join us and be part of an organisation that leads with care, celebrates difference and helps everyone succeed.

Together, we are the world’s emergency responders