GRC Cyber Security Consultant

Description

The company is a wholly owned subsidiary of a larger group and a risk management specialist in safety, cyber security and sustainability.

It protects businesses and their products end to end, aiming beyond compliance to improve incident prevention and resilience at every level.

Responsibilities

• Act as a trusted adviser to clients across many sectors, guiding them on threats and regulation, covering tactical and technical compliance issues as well as high-level strategic risk.
• Advise on security architecture, including Secure by Design, network segmentation and zero trust, so technical choices match business priorities.
• Lead specialist engagements that combine strategy with technical oversight, and turn topics such as IDAM, PAM and DLP into clear business advice.
• Advise on and check compliance with standards and regulations including ISO27001, ISA/IEC62443, NIST CSF, NIST 800-53, NCSC CAF, NIS2, the Cyber Resilience Act, the AI Act and EASA Part-IS.
• Carry out gap assessments against these frameworks, identify control weaknesses and produce prioritised remediation roadmaps toward full compliance readiness.
• Produce risk assessments and assurance artefacts across the full system lifecycle, tailored to each client's business context, including technical and human factors.
• Turn technical gaps and architectural risks into prioritised plans, advising delivery teams and business stakeholders on compliance and long-term resilience.
• Design and test strategies that help clients withstand and respond to cyber incidents.
• Review system architectures and configurations against security baselines and Secure by Design principles, flagging design flaws early and recommending fixes.
• Use AI tools to improve internal delivery, and advise customers on the secure adoption and governance of AI in their own environments and for regulatory compliance.
• Manage several client engagements at once, setting priorities, keeping timelines on track and maintaining strong customer relationships across sectors.
• Write technical blogs, white papers and insights on emerging security trends to build the company's brand authority.
• Support sales and marketing with technical input at customer and marketing events, and help write case studies and service descriptions for the portfolio.
• Represent the company at webinars, industry panels and conferences.
• Take part in bids and help manage customer relationships to find new opportunities.

Requirements

• Hold UK Government security clearance now, or be able to obtain it.
• Have 5-10 years of experience in cyber security consulting or technical leadership.
• Hold at least one recognised certification, such as CISSP, CISM, CCSP, CISA, ISO 27001, GICSP or ISA62443, or an equivalent.
• Show proven experience with regulatory compliance and adherence to standards.
• Be a self-starter who keeps up with threat intelligence and industry best practice, and who takes a forward-looking view of customer needs to add real value to their business.
• Present confidently and explain complex technical topics to non-technical audiences.
• Work independently while contributing to several virtual and international teams and customers on concurrent projects.
• Understand how to use AI tools for productivity, and the principles of securing AI environments.
• Show evidence of business support work you have carried out and delivered.
• Hold a full UK driving licence.
• Be aware of compliance risks and act with integrity.

Conditions

Permanent contract at professional experience level in the General Security job family.

Hybrid role, with at least 2-3 days a week in the Bristol office.

Flexible working arrangements are supported wherever possible.

Applicants are welcome regardless of background, age, race, ethnicity, disability, neurodiversity, gender, sexual orientation or other characteristics.

Benefits

• Competitive salary.
• Annual profit share scheme.
• Comprehensive company benefits and private healthcare options.