About the job

Senior GRC Consultant | Cyber Risk Advisoryup to £70,000 base + up to 10% bonusRemote-first UK | Occasional client and office travel

Have you led substantial GRC engagements for large, complex organisations? Are you looking for the autonomy to own client relationships and deliver meaningful improvements, supported by an experienced consulting team?

We’re working with a growing UK cyber security consultancy looking for a Senior GRC Consultant to lead client engagements across cyber risk, governance and assurance.

Experience leading large engagements for enterprise clients is a core requirement. You’ll be trusted to take responsibility for scope, delivery, stakeholder relationships and outcomes, working independently or leading delivery with support from other consultants.The opportunity

You’ll help clients understand their cyber risks, strengthen governance and turn complex requirements into practical improvement plans.

The work will draw on a broad range of GRC disciplines, including ISO 27001, NCSC CAF, NIST, risk assessments, gap analysis and third-party assurance. You don’t need to be an expert in every framework, but you will need the breadth of experience and consulting judgement to lead substantial assignments confidently.

This is a delivery-focused role with ownership of your engagements, access to experienced specialists and opportunities to broaden your expertise as the team grows.

• What you’ll doLead substantial GRC engagements for enterprise clients, taking ownership from initial scoping and planning through to delivery and completion.
• Manage complex programmes involving multiple business units, workstreams and stakeholder groups, keeping scope, timelines and quality on track.
• Act as the main client contact, building trusted relationships with senior security, technology and business stakeholders.
• Deliver cyber risk assessments, maturity reviews and gap analyses, translating findings into clear, prioritised recommendations.
• Support clients with ISO 27001 implementation, ISMS development and assurance, alongside other relevant frameworks and standards.
• Contribute to engagements covering NCSC CAF, NIST, Cyber Essentials, third-party risk and regulatory requirements, according to your expertise.
• Guide and review the work of junior consultants where required, while remaining actively involved in delivery.
• Present findings and recommendations clearly to technical and non-technical audiences, helping clients make informed decisions.

• What we’re looking forA proven track record of personally leading large GRC/ cyber risk consulting engagements for enterprise organisations, with clear accountability for delivery and client outcomes.
• Experience navigating complex client environments, including multiple stakeholders, competing priorities and established governance structures.
• The ability to manage engagements independently, make sound delivery decisions and recognise when additional expertise is needed.
• Broad, practical GRC experience, with strong knowledge of ISO 27001 and experience across areas such as NCSC CAF, NIST, risk assessments, gap analysis or third-party risk.
• Strong client-facing consulting skills, including the confidence to challenge constructively, manage expectations and communicate with senior stakeholders.
• Experience coordinating contributions from other consultants and maintaining consistent delivery quality.
• UK right to work and eligibility for UK Security Check (SC) clearance.

We’re particularly interested in the scale and complexity of the engagements you’ve led, your personal responsibilities and the outcomes you helped clients achieve.

• Useful additional experienceISO 27001 Lead Auditor or Lead Implementer certification.
• Professional qualifications such as CISM, CISSP or CISA.
• Cyber Essentials delivery or assessment experience; being a certified assessor is not essential.
• Exposure to DORA, NIS2, incident response tabletop exercises or wider resilience programmes.
• Experience with ISO 42001 and AI governance, or ISO 9001.