Risk & Assurance Manager - IT/InfoSec

Altum Consulting; Manchester; Hybrid; GBP 65,000 - 70,000; Full time

Job summary

A leading UK technology services organisation is seeking an experienced IT Risk and Compliance professional. In this hybrid role, you will shape and enhance IT and infosec risk frameworks, ensuring they are compliant with regulations such as ISO 27001 and GDPR. You should have at least 5 years of focused experience in second-line risk or internal audit, supported by strong stakeholder management skills. The role expects you to spend three days per week in the office, reflecting the company's commitment to work-life balance.

Benefits

Discretionary bonus

Strong work-life balance reputation

Qualifications

• At least 5 years’ experience in second-line risk or internal audit with an IT focus.
• Experience in consulting or professional services is advantageous.
• Proven experience leading IT risk or audit initiatives.

Responsibilities

• Shape and enhance IT and infosec risk and control frameworks.
• Own IT Risk & Control Matrices (RCMs).
• Ensure frameworks are audit-ready.

Skills

Stakeholder management

IT risk management

Experience in consultancy

Knowledge of ISO 27001

Understanding of GDPR

Job description

practice area: Risk and Compliance

salary: £65,000.00 - £70,000.00 per annum Discretionary Bonus

This is a £1bn UK technology services organisation experiencing continued organic growth. It also has a strong reputation as an employer, regularly recognised as one of the top UK businesses for work-life balance.

About the role

The position sits within the second line and is focused on IT and Information Security risk oversight. Reporting into the Head of Risk & Assurance, you'll play a key role in strengthening how technology and cyber risks are identified, managed and communicated across the organisation.

You’ll be responsible for shaping and enhancing IT and infosec risk and control frameworks, working with standards such as ISO 27001, ITIL, ISO 22301 and NIST to ensure alignment with regulatory expectations and business priorities. The role also includes ownership of IT Risk & Control Matrices (RCMs), ensuring they remain robust, up to date and audit-ready.

About you

At least 5 years’ experience in second-line risk or internal audit, with a clear IT / Information Security focus

Background in consulting or professional services would be advantageous, particularly where you’ve supported transformation or change programmes

Proven experience leading IT risk or audit initiatives, managing deliverables and influencing outcomes

Strong understanding of recognised frameworks and regulations, including ISO 27001, NIST, CIS Controls and GDPR

Confident stakeholder manager, able to build credibility and challenge effectively across IT, security and the wider business

This is a hybrid role, with an expectation of three days per week in the office.