Key Responsibilities
Governance & Compliance
- Maintain and enhance the organisation’s governance framework, ensuring alignment with regulatory, contractual, and industry standards.
- Oversee compliance with internal policies, client requirements, and relevant legislation (e.g, GDPR, data protection, cybersecurity regulations).
- Conduct internal audits and governance reviews, producing clear recommendations and action plans.
- Support project teams in meeting governance requirements without introducing unnecessary overhead.
ISMS Management (ISO 27001)
- Act as the primary owner and coordinator of the Information Security Management System (ISMS).
- Maintain ISO 27001 documentation, policies, procedures, and evidence repositories.
- Plan, execute, and document internal ISMS audits; coordinate external surveillance and recertification audits.
- Monitor and report on ISMS performance, including KPIs, non‑conformities, corrective actions, and opportunities for improvement.
- Ensure risk assessments are performed regularly and that risk treatment plans are implemented and tracked.
- Lead security awareness initiatives, ensuring staff understand their responsibilities and follow secure practices.
- Manage the incident management process, including logging, investigation, root‑cause analysis, and lessons learned.
- Work with technical teams to ensure security controls are implemented, maintained, and continuously improved.
Risk Management
- Maintain the organisation‑wide risk register, ensuring risks are identified, assessed, and mitigated.
- Facilitate risk workshops with delivery teams and leadership.
- Provide clear reporting on risk trends, emerging threats, and required actions.
Project & Portfolio Governance
- Support project managers in applying governance processes, including stage gates, reporting cycles, and documentation standards.
- Review project artefacts (RAID logs, change requests, business cases) for completeness and quality.
- Consolidate portfolio‑level reporting for leadership, highlighting risks, dependencies, and performance indicators.
Quality Assurance
- Define and maintain quality standards for deliverables and client outputs as outlined in ISO9001.
- Conduct quality reviews and provide actionable feedback to project teams.
- Identify recurring issues and drive continuous improvement initiatives.
Stakeholder Engagement
- Act as a trusted advisor to internal teams and clients on governance, risk, and information security best practices.
- Facilitate governance boards, steering committees, and security forums.
- Communicate governance and ISMS requirements clearly and constructively.
What Success Looks Like
- The ISMS is well‑maintained, audit‑ready, and continuously improving.
- Governance processes are consistently applied and understood across the consultancy.
- Risks are proactively managed, with clear visibility and fewer escalations including IR35 related matters
- Clients experience increased confidence in the organisation’s security posture and delivery quality.
- Teams view governance and security as enablers of high‑quality delivery.