The Citation Group
Transformation Risk & Assurance Lead
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Transformation Risk & Assurance Lead
Role Purpose
Citation runs a portfolio of transformation programmes involving significant change to business systems, processes, and increasingly AI and agentic capability. This role is the embedded governance, risk and compliance partner across these programmes. It will be essential to work directly with programme leads, architects, and delivery managers to understand what is being built, ask the right questions early, and make sure risk is understood and communicated as solutions develop and escalate.
The role exists to give InfoSec and legal functions real-time visibility and influence across fast-moving change, so that risk is identified and addressed as part of design rather than discovered after build. It carries the trust and seniority to work as a peer to senior technical and delivery stakeholders, and the communication skill to translate technical risk into language that supports good decisions at every level, up to and including the CISO and board.
Key Responsibilities
Stakeholder relationship and influence
- Build direct, trusted working relationships with Programme/Pod Leads, Tech Leads, Business Analysts, Enterprise Architects, Solution Architects, and AI Architects across active transformation programmes
- Establish a presence as an embedded partner in programme design discussions, not a checkpoint encountered only at formal gates
Tech and AI initiative identification
- Identify new technology initiatives early in programme design, including new supplier or vendor tools being introduced, new technology being adopted, and solutions being built in-house
- Identify planned AI and agentic initiatives specifically, including where solutions are given configuration, administration, or development access to core business systems, or where an ontology or semantic layer is proposed across multiple data sources
- Identify shadow IT arising from transformation activity such as tools, SaaS trials, or AI services adopted by programme teams outside standard procurement or InfoSec channels, and route them into the appropriate assessment process
- Articulate these initiatives clearly to the relevant stakeholders, providing enough context on scope, data involved, and system access for assessment to begin without delay
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Business systems integration
- Review access scope, credential and service account handling, and data residency for new system-to-system integrations before go-live
- Watch for change control being bypassed under programme time pressure, and raise this where it occurs
Data and vendor risk
- Map which initiatives touch sensitive personal, financial, or audit data, and identify where Data Protection Impact Assessment involvement is required
- Conduct risk assessments, such as DPIAs, for in-scope programme initiatives, own recommended risk treatment, and lead security due diligence for programme delivery and AI partners
Communication and escalation
- Translate technical and security findings into risk language that supports decisions at pod, programme, and executive level
- Identify what needs to be escalated immediately and what can be handled through standard programme cadence
- Apply an agreed risk framework to treat low-risk items directly, escalating only where the framework requires it
- Escalate data protection risks to the Group DPO and security/architecture risks to the CISO
- Represent Information Security and legal interests in programme governance and steering forums
Required Experience and Skills
- Substantial experience in Information Security, information assurance, GRC, or technology risk, ideally including exposure to a fast-moving transformation or change programme
- Working understanding of technology and AI/agentic system risk, sufficient to recognise and flag emerging initiatives, new suppliers, and in-house builds for detailed assessment by the relevant specialist function
- Experience assessing third-party and vendor security risk, including in the context of AI delivery partners
- Practical understanding of data protection principles, including how purpose limitation and lawful basis apply to data aggregation and AI use cases
- Strong stakeholder management skills, with a demonstrated ability to build trust and influence senior technical and delivery professionals without formal authority over them
- Excellent written and verbal communication, with the ability to translate technical risk for non-technical and executive audiences
- Comfortable operating independently and at pace in a PE-backed, multi-entity environment
Get help with your application
Your very own career expert that helps elevate your application to the next level.
About Us
We are Citation. We are far from your average service provider. Our colleagues bring their brilliant selves to work every day and we create an environment where they can shine. We are a nice bunch. We don't do office politics or “that's not my job”. We listen, support and take ownership.
We have been proudly delivering valuable HR and Health and Safety services to SME's across the UK for over 20 years. Passionate about service, we're on a mission to revolutionise our colleague's and client's experience by employing brilliant people who are experts at what they do and smile whilst they are doing it.
Working for Citation you will have access to 25 days holiday, plus your birthday off work, gym membership discount, healthcare, childcare vouchers, the opportunity to purchase extra leave, pension contributions and more.
It's a great place to work because of the people we employ. Fun and professional, we want likeminded individuals who love to love their job (no ‘mood hoovers’ here thanks!) and want the Company to succeed.
So, if our culture sounds like a good fit for you and you want to be part of our success story, then send us your details.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London