Information Security GRC Manager

British Red Cross

6d • Hybrid

About The Position

The Information Security GRC (Governance, Risk, and Compliance) Manager will lead a team responsible for information security risk management for the British Red Cross. This includes the identification, assessment, and treatment of risks, as well as third-party and supply chain cyber security risk management. The role involves developing and maintaining the information security governance framework, overseeing the risk management framework, and leading the ISO 27001 certification program. The manager will also act as the primary point of contact for external auditors and work collaboratively with other stakeholders to ensure a cohesive approach to information security.

Requirements

• Strong emotional intelligence, and a commitment to inclusive leadership, creating an environment where team members can grow and excel.
• Excellent knowledge of common cyber and information security compliance requirements, including PCI DSS (Payment Card Industry Data Security Standard), Cyber Essentials, and the NHS Data Security & Protection Toolkit.
• Proven experience implementing or maintaining an ISO/IEC 27001 certified ISMS, including managing certification audits and continual improvement cycles.
• Strong understanding of enterprise risk management methodologies and tools, particularly as they apply to information security risk identification, assessment (quantitative and qualitative), mitigation, and monitoring.
• Demonstrable experience in information security risk management, including establishing risk assessment processes, running risk workshops, managing risk registers, and presenting risk statuses to senior management or governance boards.

Responsibilities

• Develop and maintain the information security governance framework for the British Red Cross, including policies, standards, and processes, ensuring they align with organisational objectives, legal, contractual, regulatory requirements, and best practices.
• Oversee and continuously improve the information security risk management framework, ensuring robust processes for identifying, assessing, recording, and managing information security risks across the British Red Cross.
• Own the management of information security risks, including developing appropriate risk mitigation and treatment plans when risk levels exceed acceptable thresholds, providing regular reporting and insight on key risks, risk trends, and control effectiveness.
• Lead the ISO 27001 certification programme and ongoing compliance with the ISO/IEC 27001 standard.
• Act as the primary point of contact for external auditors and certification bodies, planning and coordinating certification (and surveillance) audits, ensuring that all necessary evidence, documentation, and corrective actions are managed effectively.
• Work in partnership with other stakeholders, departments, and functions to ensure a cohesive approach to information security across the organisation.

Benefits

• Flexible working: Remote and hybrid working, flexitime, compressed hours, and job sharing.
• Holidays: 36 days annual leave (including bank holidays) + option to buy 5 extra days.
• Pension scheme: Up to 6% contributory pension.
• Learning & Development: A range of career & learning opportunities.
• Discounts: Blue Light Discount Card, Tickets For Good & employee benefits platform.
• Wellbeing Support: Peer Supporters, CiC (EAP) & Headspace App.
• Cycle2Work: Lease a bicycle through the scheme.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed