Job Search

We are seeking an experienced Cyber Risk Lead to coordinate legacy technology risk management and provide assurance across a complex and evolving environment. This role will help identify, assess and reduce cyber risks associated with older platforms, applications and infrastructure, while ensuring that appropriate controls, governance and remediation plans are in place.

You will work closely with technology, security, risk, compliance and business stakeholders to maintain a clear view of legacy cyber risk. Responsibilities will include developing and managing risk registers, reviewing control effectiveness, challenging risk owners, tracking remediation activity and escalating material concerns through established governance forums. You will also support risk acceptance processes, ensuring that decisions are evidence-based, time-bound and aligned with risk appetite.

The role will involve coordinating assurance activity across legacy services, including control assessments, audit preparation, vulnerability and threat reviews, third-party assurance and responses to regulatory or internal findings. You will help establish consistent reporting and provide clear insight into risk exposure, dependencies, trends and overdue actions. Where appropriate, you will contribute to the development of practical security improvements, transition plans and longer-term modernisation roadmaps.

Applicants should have proven experience in cyber security, technology risk, information assurance or a closely related discipline, with a strong understanding of risk management principles and control frameworks. Experience working with legacy systems, complex technology estates or transformation programmes would be highly beneficial. You will be confident interpreting technical information, translating it for senior audiences and influencing stakeholders without direct authority.

Strong communication, organisation and analytical skills are essential, alongside the ability to manage competing priorities and maintain momentum across multiple workstreams. Relevant professional qualifications in cyber security, risk, audit or information technology are desirable, as is experience with recognised frameworks such as ISO 27001, NIST, COBIT or CIS Controls. This is an opportunity to play a key role in strengthening cyber resilience, improving assurance and supporting informed risk-based decision-making.