Job Title: Cyber Security Governance & Assurance Specialist

Req ID: 59973

Job Function: Cyber Security

Posting Start Date: 24/08/2026

Posting End Date: 26/08/2026

Division: Digital

Job Location: GBR-London-BTHQ One Braham, GBR-Manchester-New Bailey

Advertised Salary: Competitive + Benefits

Location

This role can be based out of our New Bailey Manchester office, or our One Braham London office. We have a hybrid working model of 3 days together and 2 days wherever.

Due to the nature of the work, you will need to be eligible for security clearance+.

About The Role

BT Business provides large scale multi-year contracts to government departments. The Secure Engineering team, Digital is accountable for ensuring the development, connectivity, and maintenance of multiple Service Management Platforms to recover revenue of more than £400m per annum.

This role supports the delivery and assurance of cyber security controls for UK Government customers, ensuring the protection of sensitive data and systems is embedded as a core principle within solution design. You will ensure that security requirements, risk considerations, and compliance obligations are integrated into architecture and design decisions from the outset, aligned to relevant government and industry security standards.

As a Cyber Security Governance & Assurance Specialist, you will be responsible for establishing, maintaining, and assuring the effectiveness of security governance frameworks, risk management processes, and control environments across customer platforms. This includes defining and enforcing security policies, standards, and baselines aligned to recognised frameworks such as ISO27001, NIST, and CIS.

You will lead risk identification and assessment activities, perform control validation and assurance testing, and support internal and external audit processes. Working closely with infrastructure, cloud, and engineering teams, you will ensure security controls are embedded by design across architectures and delivery pipelines, with clear traceability to risk and compliance requirements.

You will also act as a key interface between technical teams and business stakeholders, translating complex security risks into measurable business impact, and driving remediation through structured governance forums. Your focus will be on continuous improvement of the control landscape, ensuring security posture is measurable, auditable, and aligned to both regulatory obligations and customer expectations.

What You’ll Be Doing

• Identifies, evaluates and reports on cyber security risks in a manner that meets the Group's internal, regulatory and other compliance requirements.
• Collaborates with internal departments and organisations to implement practices that meet the Group's defined policies and standards for information risk management.
• Delivers the rigorous assessment of internal compliance, informing and advising on data protection obligations, providing advice regarding Data Protection Impact Assessments, acting as a contact point for data subjects.
• Contributes to the ongoing development and management of frameworks pertaining to Information Governance (IG), Cyber Security and Data Protection.
• Ensures the adherence to policies and procedures to support requirements to enable the group to meet its legal, contractual and statutory obligations while reducing the cyber security and information risk exposure.
• Executes activities in support of cyber security owned programs and related teams including security policies, vendor risk and compliance management, regulatory audits and compliance management, metrics, risk and performance indicators, executive and board reporting, security awareness and training, security integration and assessment of M&A and related ventures.
• Supports lines of business to perform security assessments and ensures timely execution of projects and programs while mitigating any security risks.
• Executes the evaluation of cyber security controls to ensure effectiveness, compliance and adherence to key controls and policies and drive its remediation efforts.
• Implements analysis of key GRC (governance, risk and compliance) risk information, including the cyber risk register, policy exceptions, audit findings and data security reviews and the preparation of reporting and dashboards as necessary to satisfy the Group's cyber reporting requirements at both a management and executive level.
• Monitors cyber compliance portals and acts as the liaison with communication groups driving awareness and adoption of cyber policies and standards across the BT Group.
• Leads liaison for cyber audits and maturity assessments assisting with reviews and providing artefacts as needed.
• Mentors other Cyber Security Governance & Assurance professionals, helping to improve the team's abilities by acting as a technical resource.
• Champions, continuously develops and shares with team knowledge on emerging trends and changes in Cyber Security Governance & Assurance.