UK Head of IT Risk & Compliance
Senior leadership role owning Priory's UK information security strategy: building and running the ISMS, managing IT risk and compliance (ISO 27001, Cyber Essentials, GDPR), leading audits and third-party risk assessments, and responding to security incidents. Hybrid role based in Bristol with at least 2 days per week in the office.
- Compensation
- Not disclosed
- Location
- Stoke Gifford , Bristol
- Work setup
- Hybrid
- Seniority
- C level
- Employment
- Not specified
- Experience
- 5+ years
- Category
- Not specified
- Posted
Skills
Must have
- Significant experience in IT risk, compliance or audit roles, with proven ability to develop and deliver information security or governance strategies
- Strong knowledge of information security frameworks and regulatory standards, including ISO 27001, NIST, Cyber Essentials and GDPR
- Hands-on experience implementing, managing and continuously improving an Information Security Management System (ISMS)
- Experience conducting IT risk assessments, identifying compliance gaps and developing mitigation plans
- Experience planning and delivering internal and external audits, managing compliance assessments and reporting on findings
- Good understanding of IT infrastructure, cybersecurity and technology environments, with ability to assess associated risks
- Experience working with senior leaders, technical teams and external partners
- Strong communication, organisational and analytical skills
- Recognised qualification in risk management, compliance, audit or related field, or willingness to work towards one
Nice to have
- Experience working within a regulated industry, particularly healthcare
- Understanding of healthcare-specific information security requirements
Full description
We are recruiting a UK Head of IT Risk & Compliance to join our IT Senior Leadership Team in Bristol. This is a newly created role, offering the opportunity to shape and lead our UK information security strategy, strengthening how we manage IT risk, governance and compliance across the business.
Reporting directly to our UK Chief Information Officer, you'll take ownership of our UK information security approach, ensuring our systems, data and technology services are secure and meet regulatory requirements. You'll work closely with senior stakeholders and our Group Chief Information Security Officer to strengthen our security controls, improve risk management and contribute to our wider Group information security strategy.
This is a hybrid role with at least 2 days per week required in the Bristol office.
You'll be responsible for developing and delivering our UK information security strategy, ensuring we have effective governance, risk management and compliance processes in place. You'll lead the ongoing development of our Information Security Management System (ISMS), helping to embed a proactive, risk-based approach to information security across the business.
Key responsibilities include:
- Information security strategy: Develop and deliver our UK information security strategy, ensuring alignment with Group policies, regulatory requirements and business priorities.
- Risk management: Oversee the identification, assessment and management of IT risks, maintaining effective risk registers and driving improvements to reduce exposure.
- Governance and compliance: Lead the development and continuous improvement of our ISMS, ensuring alignment with ISO 27001, Cyber Essentials and relevant healthcare regulatory requirements.
- Audit and assurance: Lead internal and external IT security audits, coordinating compliance assessments, certifications and improvement plans.
- Third-party risk: Oversee IT supplier risk assessments, due diligence and ongoing assurance, ensuring third-party systems and services meet our security requirements.
You'll also lead our response to significant information security incidents, working closely with IT, Legal and other business teams to manage risks and drive improvements. As a senior leader, you'll provide guidance on information security matters, oversee the UK IT Risk & Compliance budget and report on our security and compliance position to senior stakeholders.
You'll be an experienced IT risk and compliance professional with a strong understanding of information security, regulatory requirements and risk management frameworks. You'll combine strategic thinking with practical experience, bringing the ability to influence senior stakeholders, improve governance and embed effective risk management across a complex organisation.