SCC
Principal GRC Consultant
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
We are actively building diverse teams and welcome applications from everyone.
Role: Principal GRC Consultant
Location: Birmingham (SCC operate hybrid working, which comprises of a mix of office and home working)
Contract Type: Permanent
Salary Package: Competitive plus large company benefits, a broad flexible benefits scheme, and 2 paid-for volunteering days a year
Hours: 9.00 am – 5.30 pm Monday – Friday
Interview Process: 2-stage process
Why SCC?
- An inclusive workplace
- Excellent package: solid basic and company benefits
- Hybrid working & core hours in line with role requirements
- Career development and life-long learning opportunities
- Opportunity to join Europe's largest privately-owned IT Company
Role Purpose
SCC is building a serious GRC consulting capability not a bolt-on, but a practice designed to last. We want someone who can shape it from the inside: influence how we work, who we hire, and what we stand for in the market.
The challenge is real. Clients are navigating rapidly evolving regulatory environments, boards that need cyber risk explained in business terms, and a threat landscape that AI is making harder to predict. Frameworks and controls matter but what clients actually need is someone who can think clearly under complexity and lead others to better decisions.
This is a principal-level role in the truest sense. The work is advisory, often ambiguous, and always consequential.
You will lead GRC engagements with clients across sectors — from initial scoping through to board-ready outputs. That means running risk assessments and maturity reviews, designing governance frameworks and control environments, supporting compliance programmes, and translating regulatory complexity into practical roadmaps.
You will also work alongside SCC's sales and architecture teams to shape opportunities and strengthen proposals. Over time, you will help define the practice itself: its methods, its talent, and how it grows.
The day-to-day will move between board-level risk discussions and detailed control planning. You need to be equally comfortable in both.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Key Responsibilities
- Help define and shape SCC’s GRC go-to-market strategy, including future service offerings, client propositions and delivery approach
- Lead GRC consulting engagements for clients across a range of sectors, ensuring high-quality outcomes and practical recommendations
- Act as a subject matter expert across recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF and Defence Cyber Certification requirements
- Design and implement governance frameworks, policies, processes and controls that help clients manage cyber risk effectively
- Lead cyber risk assessments, maturity reviews and gap analyses, translating findings into clear improvement plans and business-aligned roadmaps
- Support compliance programmes, audit readiness activity and certification preparation for clients
- Provide expert input into bids, proposals, client presentations and solution design
- Help define the future growth and hiring strategy for the GRC capability, including mentoring and supporting future consultants
- Engage confidently with senior stakeholders, explaining cyber risk and compliance issues clearly, with relevance and actionable
Skills And Experience
- Strong experience in Governance, Risk and Compliance, ideally within cyber security, information security or technology risk
- Good working knowledge of recognised frameworks and standards such as ISO 27001, NIST, NCSC CAF, Cyber Essentials and related assurance or certification schemes
- Experience leading risk assessments, control reviews, audit preparation, compliance programmes or security maturity assessments
- Ability to advise senior stakeholders and translate technical or regulatory requirements into practical business actions
- Previous consulting, advisory or client-facing delivery experience would be highly beneficial
- Strong written and verbal communication skills, including the ability to produce clear reports, recommendations and executive-level briefings
- Confidence working at both strategic and practical levels, from board-level risk discussions through to detailed control improvement planning
- To have already achieved SC (Security Clearance) or willingness to undergo the process for SC Clearance.
- Ideally hold or be working towards recognised Information Security qualifications (e.g., CISSP (Certified Information Systems Security Professional), CISM, ISO 27001 Lead Implementer, CISSP ISSAP), NCSC Practitioner.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
About Us
SCC is Europe's largest privately-owned IT business, based out of the new £7m HQ office in Birmingham and we help clients succeed through IT transformation and exceptional customer experiences. We are a business where innovation is greater as we combine unique ideas, people and disciplines. We are a global company that is passionate about IT and where we look to simplify the complex.
We are an equal opportunities employer
SCC is committed to providing equal opportunities and a proactive and inclusive approach to equality and diversity in employment. No applicant or employee will be treated less favourably than another on the grounds of a protected characteristic which are defined as sex, sexual orientation, age, disability, gender reassignment, trade union membership or non-membership, marriage and civil partnership, pregnancy and maternity, race and religion or belief.
If you are selected for interview, and need any reasonable adjustments made for your interview, please let the SCC Talent Acquisition team know, at the point of scheduling.
Diversity & Inclusion at SCC - https://www.scc.com/diversity-and-inclusion/
Sustainability at SCC - https://www.scc.com/sustainability-at-scc/
Life at SCC - https://www.linkedin.com/company/scc/life
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills