Lead Security Consultant

Senior GRC Consultant | Cyber Risk Advisory

Up to £70,000 base + up to 10% bonus

Remote-first UK | Occasional client and office travel

Lead longer-term cyber risk programmes. Build trusted client relationships. Help complex organisations make lasting improvements.

Have you led substantial GRC engagements for large, complex organisations? Are you looking for the autonomy to shape programmes, advise senior stakeholders and see your recommendations through to implementation?

55 Exec Search is working with a growing UK cyber security consultancy looking for a Senior GRC Consultant to lead engagements across cyber risk, governance and assurance.

The focus is on longer-term strategic programmes, helping clients understand their current position, establish priorities and embed improvements across their organisations. You’ll combine strategic advice with practical delivery, taking ownership of client relationships and the work required to move programmes forward.

The opportunity

You’ll work with enterprise clients to strengthen how they govern and manage cyber risk, connecting security priorities with business objectives and translating them into achievable plans.

Your involvement will extend from initial discovery and programme scoping through to implementation and ongoing improvement. This offers the opportunity to develop a deeper understanding of your clients, build lasting stakeholder relationships and see the impact of your work over time.

Frameworks such as ISO 27001, NCSC CAF and NIST will inform your approach, with the emphasis on applying them to each client’s risks, priorities and operating environment.

This is a delivery-focused consulting role with meaningful ownership, support from experienced specialists and opportunities to broaden your expertise as the team grows.

What you’ll do

• Lead substantial, longer-term GRC and cyber risk programmes for enterprise clients, owning scope, planning, delivery and outcomes.
• Help clients develop and deliver cyber risk improvement roadmaps, prioritising activity around business objectives, risk exposure and organisational maturity.
• Build trusted relationships with senior security, technology and business stakeholders, providing advice throughout the engagement.
• Manage programmes spanning multiple business units, workstreams and stakeholder groups, keeping priorities, dependencies and delivery on track.
• Develop and embed governance structures, risk management processes, policies and reporting that support effective decisions.
• Use risk assessments, maturity reviews and gap analyses to shape programme priorities and guide practical improvements.
• Support the implementation and development of ISMS and wider governance capabilities, drawing on ISO 27001, NCSC CAF, NIST and other relevant frameworks.
• Present progress, risks and recommendations to senior stakeholders, helping them understand trade-offs and agree next steps.
• Coordinate and review contributions from other consultants, supporting junior colleagues while remaining actively involved in delivery.

What we’re looking for

• A proven track record of personally leading substantial GRC or cyber risk consulting engagements for large, complex organisations.
• Experience supporting clients through sustained programmes of improvement, from defining priorities and roadmaps to implementing change.
• Clear accountability for engagement delivery, stakeholder relationships and client outcomes.
• The ability to connect cyber risk and governance requirements with business objectives and translate strategic recommendations into practical action.
• Experience navigating multiple stakeholders, competing priorities and established governance structures.
• Broad, practical GRC expertise, including strong knowledge of ISO 27001 and experience across areas such as NCSC CAF, NIST, cyber risk management or third-party risk.
• Strong consulting judgement, with the confidence to challenge constructively, manage expectations and recognise when specialist input is needed.
• Experience coordinating other consultants and maintaining consistent delivery quality.
• UK right to work and eligibility for UK Security Check (SC) clearance.

We’re particularly interested in the scale and complexity of the programmes you’ve led, the decisions you owned and the improvements you helped clients embed.

Useful additional experience

• Cyber strategy, governance design or security transformation programmes.
• Advising senior leadership on cyber risk, investment priorities and programme progress.
• Exposure to DORA, NIS2, incident response tabletop exercises or operational resilience programmes.
• ISO 27001 Lead Auditor or Lead Implementer certification.
• Professional qualifications such as CISM, CISSP or CISA.
• Experience with ISO 42001 and AI governance, or ISO 9001.
• Cyber Essentials delivery or assessment experience; certified assessor status is not essential.

Interested in taking ownership of longer-term client programmes and shaping how organisations manage cyber risk? Apply now