Risk & Controls Manager

📋 Description

• Operate the risk register from the Security Programme threat model: populate, track treatment
• Keep the ISMS and security policy library current as part of audit readiness. Draft security
• Run Drata as the control and evidence system — Statement of Applicability, framework crosswalk and
• Run critical control monitoring: health check-ins, drift flags and Drata automation. Route drift to
• Feed threat-assessment findings into the register and confidence ratings. Track which required
• Lead audit coordination and preparation: ISO 27001 and SOC 2 logistics, ISMS readiness, team prep

🎯 Requirements

• Hands-on experience running a risk register, control library and audit cycle (ISO 27001 and/or SOC
• Comfortable with GRC platforms (Drata or equivalent) and turning monitoring into evidence.
• Proven ability to coordinate audits and customer questionnaires with named control owners.
• Precise written work; register and Statement of Applicability quality matters.
• Strong stakeholder management with control owners and auditors.
• CISA, ISO 27001 Lead Implementer or Auditor, or equivalent professional certification.