Information Security Governance, Risk & Compliance Manager (GRC)

Job summary

About Cabinet Office Digital:

Cabinet Office Digital sits at the heart of UK government, delivering user-centred digital services, robust technology infrastructure, and progressive digital capability across the Cabinet Office and beyond. Our mission is to make government work better for citizens by modernising legacy systems, championing innovative technologies including secure cloud and AI, and embedding world-class security into every phase of service delivery. We foster an inclusive, collaborative, and agile environment where technical excellence and public value go hand in hand.

The Role:

As the Information Security Governance, Risk & Compliance (GRC) Manager, you will serve as the departmental subject matter expert on cyber risk management, security policy, and enterprise assurance. Reporting directly to the Head of Information Security, you will lead and develop the GRC team to drive the departmental cyber governance strategy, ensuring critical systems and digital services remain resilient against evolving threats.

Bridging the gap between executive strategy and technical implementation, you will provide authoritative risk advice to System Owners, Senior Information Risk Owners (SIROs), and Risk Committees. You will oversee central compliance with the Government Functional Standard for Security (GovS 007), lead the GovAssure programme across the department, and embed Secure by Design (SbD) principles across all digital initiatives, while leveraging frameworks such as the NCSC Cyber Assessment Framework (CAF), ISO/IEC 27001, and NIST.

This role offers an exceptional opportunity to shape cyber resilience at the centre of government, leading high-impact assurance initiatives and fostering a culture of proactive risk management across dynamic digital transformation programmes.

Job description

Strategic Delivery & Governance

Drive the delivery of the departmental cyber security governance strategy, establishing frameworks that support the organisational risk appetite while ensuring direct alignment with GovS 007 and the NCSC CAF.

Manage GovAssure across the Cabinet Office, directing the central programme for the whole department and providing practical support and guidance to service owners.

Embed Secure by Design (SbD), ensuring security is integrated across the entire lifecycle of departmental digital and data projects.

Represent Cyber Security on key governance boards (e.g., Departmental Risk Committee), presenting complex risk trade-offs to non-technical leadership.

Manage commercial requirements, owning the allocated budget and acting as the contract manager for all GRC tooling and security education platforms.

Risk Assessment & Management

Own the cyber risk framework, defining and maintaining the methodologies, standards, and thresholds that departmental teams must work within.

Lead GRC platform engineering, driving the administration, configuration, and continuous maturity of the central GRC tool to automate workflows and improve risk visibility.

Mature the departmental Cyber Risk Register, ensuring risk owners accurately identify, accept, or treat exposures in a timely manner.

Drive third-party and supply chain assurance, establishing cyber risk protocols across the enterprise and high-value procurement contracts.

Provide actionable risk intelligence, delivering regular insights on threat trends and control effectiveness to the Head of Information Security and senior leadership.

Facilitate risk workshops, leading regular sessions with technical and business leads to identify emerging threats and maintain high-quality risk data.
Compliance, Policy & Assurance.

Author and enforce departmental cyber security policies, ensuring they remain practical and mapped against GovS 007, CAF, ISO 27001, and NIST CSF.

Track and integrate audit findings, working closely with operational security teams to record outputs from IT Health Checks (ITHCs), penetration tests, and external audits, ensuring remediation is tracked.

Govern cyber compliance and threat frameworks, leading on cyber-specific legislation and enterprise vulnerability management standards. Work alongside Data

Privacy to support UK GDPR/DPA 2018, ensuring operational alignment with CIS Controls and MITRE ATT&CK.

Lead the security awareness programme, ensuring staff understand current threats and secure data handling practices through effective, metrics-driven education.

Team Leadership & Stakeholder Management

Line manage and mentor a team of security specialists, supporting continuous technical development and professional growth.

Build strategic partnerships with external bodies, including the Government Security Group, DCMS, the NCSC, and partner agencies.

Practice inclusive leadership, building a culture of shared accountability and continuous improvement in security outcomes.

Person specification

Essential Criteria (Mandatory)

• Information Security Leadership: Extensive experience managing Information Security, GRC, or risk functions within the public sector or large, highly regulated organisations.

• Risk Management in Digital Change: Proven experience governing risk management principles for complex digital transformation programmes, including AI integrations, automated decision-making systems, or legacy migrations.

• Stakeholder Communication: Strong ability to translate technical cyber vulnerabilities and risks into clear, business-focused narratives for non-technical senior leaders.

• Supply Chain Assurance: Practical experience creating, establishing, and managing security risk frameworks for supply chains and third-party vendors.

• Core Certifications: Must hold one of the following: CISM, CRISC, ISC2 CGRC, or CISSP.

• Core Framework Mastery: Deep, practical knowledge of GovS 007, the NCSC CAF, GovAssure, Secure by Design, and ISO/IEC 27001/27005.

Desirable Criteria

• GRC Platforms: Hands-on experience administering, configuring, and maturing enterprise GRC software tools.

• Supplementary Frameworks: A good working knowledge of the NIST CSF, CIS Controls, and MITRE ATT&CK.

• Cloud Security: Familiarity with cloud security risk management (e.g., CSA CCSK or CSP specific certifications).

• Enterprise Architecture: Awareness of enterprise architecture methodologies (e.g., TOGAF).

• Data Privacy: Working knowledge of DPA 2018 / UK GDPR principles in an information security context.

• AI Governance: Practical knowledge of AI risk management frameworks (e.g., NIST AI RMF, ISO/IEC 42001).

Additional information:

Cabinet Office policy is that a minimum 60% of your working time should be spent at your principal workplace. For some roles, due to their nature and the business need, this may be up to 100%. Requirements to attend other locations for official business will also count towards this level of attendance.

Qualifications

Proven Track Record: Extensive experience managing information security, GRC, or risk functions within the public sector or large, highly regulated enterprises.

Risk Decision-Making: Demonstrable experience governing risk management principles across complex digital transformation programmes, specifically including AI integrations, automated decision-making systems, and legacy migrations.

GRC Platform Engineering (Desirable): Practical experience administering, configuring, and maturing enterprise GRC tooling.

Senior Stakeholder Engagement: Proven ability to translate technical cyber vulnerabilities into plain-English, business-focused risk narratives.

Supply Chain Security: Hands-on experience establishing supply-chain risk assurance frameworks.

Behaviours

We'll assess you against these behaviours during the selection process:

• Making Effective Decisions
• Communicating and Influencing
• Seeing the Big Picture
• Leadership

Benefits

Alongside your salary of £59,207, Cabinet Office contributes £17,152 towards you being a member of the Civil Service Defined Benefit Pension scheme. Find out what benefits a Civil Service Pension provides (opens in a new window).

• Learning and development tailored to your role.
• An environment with flexible working options.
• A culture encouraging inclusion and diversity.
• A Civil Service Pension which provides an attractive pension, benefits for dependants and employer contributions of 28.97%.
• A minimum of 25 days of paid annual leave, increasing by one day per year up to a maximum of 30.

Things you need to know

Artificial intelligence

Artificial intelligence can be a useful tool to support your application, however, all examples and statements provided must be truthful, factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others, or generated by artificial intelligence, as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see our candidate guidance (opens in a new window) for more information on appropriate and inappropriate use.

Selection process details

This vacancy is using Success Profiles (opens in a new window), and will assess your Behaviours and Experience.

Application process

As part of the application process, you will be asked to provide a CV, Statement of suitability and 250 word examples of the Behaviours: Making Effective Decisions, Communicating & Influencing, Seeing the Bigger Picture and Leadership.

Further details around what this will entail are listed on the application form.

Please provide a 750 word Statement of suitability to explain how you consider your experience; professional skills and qualities provide evidence of your suitability for the role with reference to the essential criteria in the person specification section of the job advert.

Should a large number of applications be received, an initial sift may be undertaken using the lead Behaviour, Making Effective Decisions.

The panel will sift you on Behaviours, CV & Statement of Suitability.

Selection process

On the Interview, you will be assessed on all behaviours.

Expected timeline (subject to change)

Expected sift date – w/c 02/11/2026

Expected interview date/s – w/c 09/11/26

Your interview will either be conducted face to face or by video. You will be notified of the location if you are selected for interview.

Reasonable adjustments

If a person with disabilities is put at a substantial disadvantage compared to a non-disabled person, we have a duty to make reasonable changes to our processes.

If you need a change to be made so that you can make your application, you should:

Contact Government Recruitment Service via CabinetOfficeRecruitment.grs@cabinetoffice.gov.uk as soon as possible before the closing date to discuss your needs.

Complete the ‘Assistance required’ section in the ‘Additional requirements’ page of your application form to tell us what changes or help you might need further on in the recruitment process. For instance, you may need wheelchair access at interview, or if you’re deaf, a Language Service Professional.

Further information

If you are experiencing accessibility problems with any attachments on this advert, please contact the email address in the 'contact point for applicants' section.

Please note that this role requires SC clearance, which would normally need 5 years UK residency in the past 5-years. This is not an absolute requirement, but supplementary checks may be needed where individuals have not lived in the UK for that period. This may mean your security clearance (and therefore your appointment) will take longer or, in some cases, not be possible.

For further information on National Security Vetting please visit the Demystifying Vetting website.

Please note terms and conditions are attached. Please take time to read the document to determine how these may affect you.

Any move to Cabinet Office from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes, including Tax Free Childcare. Determine your eligibility at: https://www.childcarechoices.gov.uk.

A reserve list will be held for a period of 12 months, from which further appointments can be made.

New entrants are expected to join on the minimum of the pay band.

This role is full time only. Applicants who wish to work an alternative pattern are welcome to apply however your preferred working pattern may not be available and you should discuss this with the vacancy holder before applying.

If successful and transferring from another Government Department a criminal record check may be carried out.

In order to process applications without delay, we will be sending a Criminal Record Check to Disclosure and Barring Service/Disclosure Scotland on your behalf.

However, we recognise in exceptional circumstances some candidates will want to send their completed forms direct. If you will be doing this, please advise Government Recruitment Service of your intention by emailing Pre-EmploymentChecks.grs@cabinetoffice.gov.uk stating the job reference number in the subject heading.

For further information on the Disclosure Scotland confidential checking service telephone: the Disclosure Scotland Helpline on 0870 609 6006 and ask to speak to the operations manager in confidence, or email Info@disclosurescotland.co.uk

Applicants who are successful at interview will be, as part of pre-employment screening, subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicant’s details held on the IFD will be refused employment.

A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5-year period following a dismissal for carrying out internal fraud against government.

Feedback

Feedback will only be provided if you attend an interview or assessment.

Security

Successful candidates must undergo a basic (or equivalent) criminal record check.Successful candidates must meet the security requirements before they can be appointed. The level of security needed is security check (opens in a new window).

See our vetting charter (opens in a new window).People working with government assets must complete baseline personnel security standard (opens in new window) checks.

Nationality requirements

This job is broadly open to the following groups:

• UK nationals
• nationals of the Republic of Ireland
• nationals of Commonwealth countries who have the right to work in the UK
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities with settled or pre-settled status under the European Union Settlement Scheme (EUSS) (opens in a new window)
• nationals of the EU, Switzerland, Norway, Iceland or Liechtenstein and family members of those nationalities who have made a valid application for settled or pre-settled status under the European Union Settlement Scheme (EUSS)
• individuals with limited leave to remain or indefinite leave to remain who were eligible to apply for EUSS on or before 31 December 2020
• Turkish nationals, and certain family members of Turkish nationals, who have accrued the right to work in the Civil Service

Further information on nationality requirements (opens in a new window)

Working for the Civil Service

The Civil Service Code (opens in a new window) sets out the standards of behaviour expected of civil servants.

We recruit by merit on the basis of fair and open competition, as outlined in the Civil Service Commission's recruitment principles (opens in a new window).The Civil Service embraces diversity and promotes equal opportunities. As such, we run a Disability Confident Scheme (DCS) for candidates with disabilities who meet the minimum selection criteria.The Civil Service also offers a Redeployment Interview Scheme to civil servants who are at risk of redundancy, and who meet the minimum requirements for the advertised vacancy.

Diversity and Inclusion

The Civil Service is committed to attract, retain and invest in talent wherever it is found. To learn more please see theCivil Service People Plan (opens in a new window) and the Civil Service Diversity and Inclusion Strategy (opens in a new window).

Apply and further information

This vacancy is part of the Great Place to Work for Veterans (opens in a new window) initiative.The Civil Service welcomes applications from people who have recently left prison or have an unspent conviction. Read more about prison leaver recruitment (opens in new window).Once this job has closed, the job advert will no longer be available. You may want to save a copy for your records.

Contact point for applicants

Job contact :

• Name : codigitalrecruitment
• Email : codigitalrecruitment@cabinetoffice.gov.uk

Recruitment team

• Email : cabinetofficerecruitment.grs@cabinetoffice.gov.uk

Further information

Appointment to the Civil Service is governed by the Civil Service Commission’s Recruitment Principles. If you feel that your application has not been treated in accordance with the Recruitment Principles, and wish to make a complaint, then in the first instance you should contact Government Recruitment Service by email at : cabinetofficerecruitment.grs@cabinetoffice.gov.uk
If you are not satisfied with the response you receive, then you can contact the Civil Service Commission at info@csc.gov.uk. For further information on the Recruitment Principles and bringing a complaint to the Civil Service Commission, please visit their website at: https://civilservicecommission.independent.gov.uk/.

Attachments

Cabinet Office Employee Offer Opens in new window (pdf, 302kB)Cabinet Office Terms and Conditions - External 2025-02-20 Opens in new window (docx, 83kB)