GRC Security Consultant

GRC Security Consultant

The team that you'll be working with:

NTT DATA is one of the world's largest global security service providers, partnering with some of the most recognized security technology brands. We're looking for passionate, curious, and motivated individuals to join our team. This vacancy will be joining our rapidly growing security consulting practice for the UK.

What you'll be doing:

Using your background in Governance, Risk & Compliance, you will help our clients:

• Governance
  : directs, oversees, designs, implements or operates within the set of multi-disciplinary structures, policies, procedures, processes and controls implemented to manage cyber and information security at an enterprise level. Supporting an organisation's immediate and future regulatory, legal, risk, environmental and operational requirements and ensuring compliance with those requirements.
• Policy and Procedure Management
  : directs, develops or maintains organisational cyber and information security policies, standards and processes, using recognised standards (e.g. the ISO/ IEC 27000 family, NIST CSF) where appropriate.Applies recognised cyber and information security standards and controls within an organisation, programme, project or operation. Applies relevant security classification.
• Risk Management
  : develops cyber and information security risk management strategies and controls, considering business needs, balancing technical, physical, procedural and personnel controls. Identifies and assesses information assets, threat specific information, business impacts, business benefits and costs to identify and assess potential vulnerabilities and risks.
• Data Privacy
  : directs, oversees, designs, implements, contributes to, or operates within the set of multi-disciplinary structures, policies, procedures, processes and controls to manage the protection of personal data, privacy and human rights, supporting regulatory, legal, risk, environmental and operational requirements, and ensuring compliance with those requirements. (e.g. GDPR, Data Protection).
• Internal Controls Oversight
  : Establish and monitor internal controls to safeguard data and assets, conducting regular reviews and audits.
• Stakeholder Engagement
  : Serve as a liaison, offering guidance and support to internal teams, external partners, and regulatory authorities.Providing remediation guidance and prepare management reports to track remediation activities.
• Continuous Improvement
  : Identify opportunities for process enhancements, driving initiatives to bolster governance framework and security posture. Assess and test the effectiveness of security controls, and document the compliance levels to identify risks and control gaps.

What experience you'll bring:

It starts with amazing people, challenging projects and a work environment that supports the creation of tangible solutions that make an impact. You will need to have a broad experience of security risk management and have evidence of experience in a number of the following fields of expertise:

• 5+ years' varied experience in information security, data protection, risk management, enterprise IT, legal or (relevant) compliance roles.
• Strong understanding of security governance, risk, and compliance frameworks such as ISO 27001, NIST / CSF, NIS/NIS2, DORA, UK CNI / OT / IIOT compliance.
• Hands-on experience building credibility with external stakeholders, including enterprise clients, critical system vendors, certification auditors and regulatory bodies.
• Proven leadership skills with the ability to guide and mentor teams, as well as influence and collaborate with senior stakeholders in a similar GRC, security, or risk management role.
• A hands-on approach with the ability to balance strategic oversight with direct involvement in security tasks.
• Excellent communication skills, with the ability to present complex information clearly and effectively to non-technical stakeholders.
• The ability to explain complex topics to a diverse range of audiences.
• Strong attention to detail and the ability to deliver high quality work.
• A valid right to work in the UK.
• Eligible to obtain UK SC clearance.
• CISA, CRISC, CISM or CISSP certification advantageous

Who we are:

We're a business with a global reach that empowers local teams, and we undertake hugely exciting work that is genuinely changing the world. Our advanced portfolio of consulting, applications, business process, cloud, and infrastructure services will allow you to achieve great things by working with brilliant colleagues, and clients, on exciting projects.

Our inclusive work environment prioritises mutual respect, accountability, and continuous learning for all our people. This approach fosters collaboration, well-being, growth, and agility, leading to a more diverse, innovative, and competitive organisation. We are also proud to share that we have a range of Inclusion Networks such as: the Women's Business Network, Cultural and Ethnicity Network, LGBTQ+ & Allies Network, Neurodiversity Network and the Parent Network.

For more information on Diversity, Equity and Inclusion please click here: Creating Inclusion Together

What we'll offer you:

We offer a range of tailored benefits that support your physical, emotional, and financial wellbeing. Our Learning and Development team ensure that there are continuous growth and development opportunities for our people. We also offer the opportunity to have flexible work options.

For more information on NTT DATA UK & Ireland please click here: NTT DATA

We are an equal opportunities employer. We believe in the fair treatment of all our employees and commit to promoting equity and diversity in our employment practices. We are also a Disability Confident Committed Employer - we want to see every candidate performing at their best throughout the job application and interview process, if you require any reasonable adjustments during the recruitment process, please let us know and we look forward to hearing from you.

Skills and Competencies

Skill

SFIA Level

Description

Governance (A1)

Level 4/5

Contributes to the development and implementation of enterprise-level cyber and information security governance structures, policies, procedures, and controls. Supports compliance with regulatory, legal, risk, environmental, and operational requirements.

Policy and Standards (A2)

Level 4/5

Develops and maintains organizational cyber and information security policies, standards, and processes, using recognized standards (e.g., ISO/IEC 27000 family, NIST CSF). Applies relevant security classification.

Continuous Improvement (A4, A5)

Level 4/5

Identifies opportunities for process enhancements to improve governance framework and security posture. Assesses and tests the effectiveness of security controls and documents compliance levels.

Legal and Regulatory Compliance (A6)

Level 4/5

Supports organizations in meeting immediate and future regulatory and legal requirements and contributes to ensuring compliance.

Risk Management (B2, B3)

Level 4/5

Develops and implements cyber and information security risk management strategies and controls, considering business needs. Identifies and assesses information assets, threats, vulnerabilities, and risks. Provides risk assessments and recommendations.

Internal Controls Oversight (D2, D3)

Level 4/5

Assists in establishing and monitoring internal controls to safeguard data and assets. Conducts reviews and audits to ensure control effectiveness. Provides remediation guidance.

Stakeholder Management (J1, J2, J3)

Level 4/5

Serves as a liaison, providing guidance and support to internal teams, external partners, and regulatory authorities. Prepares management reports on remediation activities.

Data Privacy (G1, G2)

Level 4/5

Contributes to the development and implementation of data privacy structures, policies, procedures, and controls. Supports compliance with data protection regulations (e.g., GDPR).