Senior Information Security Consultant (United Kingdom)

Join our GRC Consulting team as a Senior Information Security Consultant. In this remote role, you will provide ongoing security advisory services, lead vCISO-style support, assess existing security programs, and help clients prioritize security initiatives. You will work closely with client stakeholders, communicate clearly, and build trust. This position requires hands-on information security experience and strong consulting skills.

• Deliver ongoing information security advisory engagements across a range of clients and industries, providing practical guidance on information security risks, security programmes, and improvement priorities.
• Lead vCISO-style advisory services and ongoing security programme development, assessing existing security programmes and identifying opportunities to improve their effectiveness, maturity, and sustainability.
• Build trusted, long-term relationships with client stakeholders, working confidently with technical teams, security professionals, operational stakeholders, and senior leadership.

• Experience working in an operational, technical or industry information security environment
• Proven ability to build strong client relationships and deliver effectively in a remote-first consulting model
• Relevant certifications such as CISSP, CISM or CCSP are desirable
• Consulting experience is highly desirable
• Experience developing, operating, assessing or improving security programmes
• Experience working with security controls, risk management, security processes or security operations
• Excellent written and verbal communication skills
• Ability to understand complex problems and develop practical, commercially sensible solutions
• Strong questioning, listening and relationship-building skills
• Experience advising and influencing senior leadership and board-level stakeholders
• Experience with vCISO, security advisory or ongoing security programme support is highly desirable
• 6+ years' experience in information security, cybersecurity, security consulting or a related industry role
• Confident working with technical, operational and senior stakeholders
• Strong client-facing and consulting skills
• Exposure to frameworks such as ISO 27001, SOC 2, CAF, NIST or similar is useful, but strong practical security experience is more important than framework knowledge alone
• Strong practical understanding of information security and cybersecurity principles
• Strong organisational skills and the ability to manage multiple clients, workstreams and competing priorities
• Experience identifying and managing real-world security risks rather than focusing solely on compliance requirements
• Comfortable operating independently and using professional judgement
• Experience with GRC platforms such as Vanta is desirable