> Markdown version of [/jobs/ext/2813113-information-security-grc-specialist](https://www.wearedevelopers.com/jobs/ext/2813113-information-security-grc-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security GRC Specialist

- **Company:** Morson Group
- **Location:** Greater London, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cloud Computing, Cloud Computing Security, Cyber Security, Identity and Access Management, Security Information and Event Management, Software Vulnerability Management
- **Published:** September 10, 2026
- **Apply:** https://www.collegerecruiter.com/job/2847390403-information-security-grc-specialist

## About the Role

* Proven experience within financial services.
 * Proven experience in Information Security, Cyber GRC, or Technology Risk within a regulated environment.
 * Experience operating in a hands-on capacity across both governance and technical security domains (e.g. vulnerability management, SIEM/SOC, IAM, cloud security).
 * Strong understanding of security frameworks such as ISO 27001 and/or NIST.
 * Ability to engage with and challenge technical teams, ensuring controls are implemented effectively rather than existing as policy only.
 * Experience producing senior-level reporting, including risk metrics and board-facing outputs.
 * Exposure to GRC tooling and/or automation initiatives.
 * Strong stakeholder management skills, with the ability to work across technical and non-technical audiences.
 * Certifications (e.g. CISSP, CISM) are not essential - practical, real-world experience is key.

## Description

This is a senior hire within the Information Security GRC function, acting as deputy to the Head of Information Security & GRC, supporting the leadership and day-to-day running of the team. The role combines hands-on delivery with leadership responsibility, operating in a 1.5 line capacity - working closely with technology teams while maintaining strong governance oversight., * Act as second-in-command within the GRC function, supporting the Head of Information Security & GRC across BAU, projects, and stakeholder engagement.

 * Operate in a hands-on 1.5 line capacity, working closely with SecOps, IAM, and cloud teams to ensure controls are effective in practice.
 * Lead cyber risk assessments and control reviews, identifying gaps and driving remediation through to closure.
 * Act as a bridge between GRC and technical teams, confidently challenging and validating control design and implementation.
 * Support board-level reporting and risk metrics, translating technical issues into clear, business-focused insights.
 * Contribute to the development and rollout of GRC tooling, with a focus on automation, reporting, and adoption across technical teams.
 * Support incident response oversight, including post-incident reviews and control improvements.
 * Maintain and enhance security policies, standards, and frameworks aligned to ISO 27001 and NIST.
 * Work across Technology, Risk, Compliance, and Audit to embed security into business processes and decision-making.


## Related Videos

- [A Computer Is All You Need](https://www.wearedevelopers.com/videos/100142-a-computer-is-all-you-need)
- [Green Cloud Computing](https://www.wearedevelopers.com/videos/592-green-cloud-computing)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [WebAssembly: The Next Frontier of Cloud Computing](https://www.wearedevelopers.com/videos/972-webassembly-the-next-frontier-of-cloud-computing)
- [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure)

## Related Articles

- [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023)
- [Software Engineer Salary London](https://www.wearedevelopers.com/magazine/252-software-engineer-salary-london)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk)
- [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk)
- [Data Engineer Salary UK](https://www.wearedevelopers.com/magazine/253-data-engineer-salary-uk)