Information Security Governance Specialist

The Information Security Governance Specialist owns the governance backbone of the security programme: policy, control framework design, compliance, and audit assurance. This role translates security strategy into structured, auditable, and operationally realistic governance artefacts (e.g.: exception registers, policy suites, control frameworks, audit programmes) and works across the business to embed them into everyday operation.

Key responsibilities

• Develop, maintain, and periodically review information security policies, standards, and procedures aligned to ISO 27001 and other recognised cybersecurity frameworks.

• Maintain the security governance calendar (policy reviews, management reviews).

• Support design and evolution of the organisation's security strategy and multi-year security programme roadmap.

• Administer the security exception/waiver process end-to-end: intake, documentation, approval routing, and tracking of time-bound remediation commitments through to closure.

• Maintain the control framework catalogue, mapping controls to ISO 27001 Annex A, NIST CSF, and CIS Controls, and flag control gaps for risk assessment by the Information Security Risk Specialist.

• Partner with the Information Security Risk Specialist to ensure exceptions and control gaps are risk-assessed and formally risk-accepted by the appropriate owner before a waiver is granted.

• Coordinate internal and external audits and certification cycles (e.g. ISO 27001), including evidence collection and remediation tracking.

• Map controls to regulatory and contractual obligations (GDPR, PCI-DSS, HIPAA, sector-specific requirements as applicable).

• Maintain a defensible audit trail for control operation and governance decisions.

• Produce executive-ready reporting: governance and compliance dashboards, programme status updates, board and committee papers.

• Act as a trusted point of contact for business units seeking governance guidance on new initiatives.

• Contribute governance input to post-incident reviews and remediation programmes, ensuring lessons learned convert into control or policy change.

• Support the broader team on cross-functional initiatives (e.g. data protection projects, security awareness) as priorities require.