Principal Information Security & Data Governance Specialist

Operating as a senior individual contributor, you will develop and maintain security and data governance frameworks, assess risk across IT, cloud and Operational Technology environments, support audit and compliance activity, and advise stakeholders on evolving security and regulatory requirements. The position also has responsibility for cyber awareness, third-party risk management and supporting the continued development of the organisation’s GRC capability.

The client has an office in Aberdeen - North, although fully remote working within the UK can be considered for an appropriately experienced candidate based further afield.

Main Duties and Responsibilities:

• Develop, implement and maintain information and cyber security policies, standards and procedures, aligned with recognised frameworks including ISO 27001, NIST CSF and CIS Controls.
• Establish and maintain an enterprise data governance framework covering data classification, handling, retention, protection, ownership, stewardship and lifecycle management.
• Conduct security risk assessments across IT, cloud and OT environments, supporting incident response planning and the continual improvement of security controls.
• Oversee regulatory and compliance requirements across multiple jurisdictions, supporting audits, maintaining risk registers and monitoring changes to cyber and data regulations.
• Develop cyber security awareness programmes, phishing simulations and risk-based campaigns for corporate and operational environments.
• Act as a subject matter expert across security, governance and compliance, supporting third-party risk management and providing leadership reporting on security posture, regulatory change and risk exposure.

• Significant experience within information security, cyber security GRC or IT governance.
• Proven experience implementing data governance frameworks and a strong understanding of international data protection and cyber security regulations.
• Experience working within regulated environments and supporting audit and compliance processes.
• Familiarity with recognised security frameworks such as ISO 27001 and NIST.
• Strong risk and compliance expertise, with the ability to assess complex risks and communicate technical and regulatory requirements effectively.
• The ability to operate autonomously while engaging and influencing stakeholders across technical and business functions.

Desirable experience includes working within energy, utilities or critical infrastructure, exposure to OT environments, experience with GRC platforms such as ServiceNow GRC, RSA Archer or MetricStream, and certifications including CISSP, CISM, CRISC, CISA or CDMP.