Security Governance, Risk & Compliance Manager

Role overview

Workplace

• Hybrid role requiring two office days per week; the base can be any National Highways office in the UK.
• Some travel is required for team meetings.

Responsibilities

• Lead the GRC function's tactical direction and ensure frameworks, processes, and programmes meet organizational, regulatory, and industry expectations.
• Own and maintain the enterprise security risk management framework and ensure risks are assessed, prioritized, escalated, and communicated.
• Oversee regulatory compliance, including NIS obligations and engagement with the Department for Transport.
• Lead second-line assurance of security controls, supplier compliance, and operational practices.
• Improve GRC processes, tooling, policies, reporting, and operational maturity, embedding governance across the organization.
• Lead the team and engage senior leaders, regulators, auditors, suppliers, and operational stakeholders.

Requirements

• Significant leadership experience in governance, risk, compliance, audit, or cybersecurity and a record of leading high-performing teams.
• Extensive security governance, risk management, and assurance experience in complex, multi-supplier, or regulated environments.
• Deep knowledge of security controls, governance frameworks, risk methodologies, and regulatory obligations, including NIS or comparable requirements.
• Proven ability to embed governance, compliance, and assurance frameworks and turn complex risks into clear reporting and recommendations.
• Excellent communication, influencing, and stakeholder-management skills.
• Must hold or be willing to obtain SC clearance before starting employment.

About National Highways

Compensation

• External candidates are offered a starting salary at the lower end of the pay scale; current employees are appointed under the established pay policy.