Cyber Governance and Assurance Manager

The Corporate Services Group (CSG) brings together a broad range of specialist functions which enable UKEF to operate effectively and safely. These include HR (covering resourcing, payroll, employee relations, talent management, learning and development), Facilities, Procurement, Project Management, Transformation, and Security. Together, these teams provide the organisational infrastructure, stewardship, and resilience required to support UKEF’s mission and strategic priorities.

Within CSG, the Security & Resilience team headed by Deputy Director of Security plays a critical role in protecting UKEF’s people, information, physical assets, and operational continuity. The team is responsible for designing, implementing, and maintaining security controls and resilience measures across four core domains.

• Physical and Personnel Security
• Information Assurance
• Business Continuity Planning
• Cyber Security

About the Role

This position is embedded within the Cyber Security function of the Security & Resilience team and reports directly to the Head of Cyber. The postholder is expected to help build and be responsible for leading the governance and assurance function for cyber security, ensuring that all policies, procedures, and controls are robust, effective, and compliant with both business objectives and regulatory standards.

By overseeing cyber security governance and assurance, the postholder plays a pivotal role in safeguarding UKEF’s digital assets, data, and systems. This work directly supports the Security & Resilience team’s broader mission to protect the organisation’s people, information, physical infrastructure, and operational continuity. Through close collaboration with colleagues across the other security domains of Physical and Personnel Security, Information Assurance, and Business Continuity Planning, the postholder helps to maintain a cohesive and resilient security posture throughout UKEF.

Furthermore, this role contributes significantly to the overall effectiveness and resilience of the Corporate Services Group (CSG). By ensuring that cyber security measures are aligned with organisational and regulatory requirements, the postholder supports the CSG’s mandate to provide the infrastructure, stewardship, and resilience necessary for UKEF to operate safely and effectively. This integrated approach enables the division to respond proactively to emerging threats

Main Activities

• Lead and coordinate cyber governance and assurance activity across the organisation, ensuring alignment to relevant government policy and standards and providing clear oversight to senior stakeholders.
• Develop, implement and continuously improve cyber security governance frameworks, policies, standards and processes (e.g., risk management, exception handling and decision logs), ensuring they are understood and adopted across the business.
• Plan and deliver assurance activity (internal/external reviews, audits and assessments), including defining scope, coordinating evidence, documenting outcomes, and driving timely remediation and risk acceptance where appropriate.
• Lead delivery of GovAssure activities, including producing evidence packs, engaging stakeholders, and tracking actions through to closure.
• Coordinate internal cyber audits and assessments, including agreeing scope, supporting testing, and reporting outcomes and recommendations.
• Work with colleagues across Cyber, Digital/IT and the business to embed assurance findings into delivery plans and strengthen organisational capability.
• Monitor and maintain cyber security policies and standards, ensuring they remain current, risk-based and aligned to organisational objectives, with appropriate governance for exceptions and waivers.
• Provide oversight of cyber security controls, working with control owners to confirm controls are designed appropriately, operating effectively and supported by proportionate evidence.
• Identity and access management controls, including joiners/movers/leavers and privileged access governance.
  Provide governance and oversight of privileged access, ensuring least privilege principles are applied, risks are understood and approvals are appropriately documented.
• Promote and support a zero-trust approach (where appropriate), working with technical teams to ensure governance and assurance needs are met.
• Develop and maintain cyber management information (MI) and performance reporting, including risk and compliance dashboards and metrics that support oversight and prioritisation.
• Oversee privileged access governance, ensuring appropriate controls, monitoring and review arrangements are in place.
• Support post-incident reviews from a governance and assurance perspective, ensuring lessons are captured, actions are owned and improvements are tracked.
• Engage with senior stakeholders, providing clear briefings and advice on assurance status, key risks, compliance position and required decisions.
• Work with control owners to ensure asset identification, account administration and access controls are robust, proportionate and compliant.
• Oversee administration and governance of access to relevant security tooling and services (including privileged access where applicable), ensuring appropriate approvals, reviews and audit trails are maintained.
  

UK Export Finance is looking for motivated individuals with a desire to learn about the business. Successful candidates will be provided not only with functional training to enable them to do well in their role, but also with personal development to help them to achieve their career ambitions. Please note that the person specification below outlines at which stage(s) you will be assessed on how you meet the criteria for the role(s) including:-

A = assessed at application stage I = assessed at interview stage P = assessed at presentation stage

Essential

Qualifications

• Hold a current, relevant professional qualification or certification in cyber security governance, risk, compliance or assurance, such as CISM, CISA, CRISC, CISSP, ISO/IEC 27001 Lead Implementer or Lead Auditor, or equivalent recognised professional certification. Candidates relying on equivalent experience must provide clear evidence of comparable formal learning, assessed competence and practical application in a governance, risk and assurance environment. (A)
• Demonstrate continuing professional development in cyber security governance, risk management, information assurance or audit, including keeping current with relevant NCSC guidance, government security policy, GovAssure, CAF and recognised industry good practice. (A, I)

Knowledge

• Proven understanding of relevant government cyber standards and assurance approaches (e.g., NCSC guidance, Cyber Assessment Framework (CAF), GovAssure and related policy), and how to apply them proportionately to support cyber security governance and risk management. (A, I)
• Knowledge of cyber security governance and risk management, including how to define, implement and monitor controls and manage compliance obligations. (A, I, P)
• Knowledge of the Government Security Profession and Government Cyber Profession expectations for cyber security governance, risk management, audit and assurance roles, including how professional standards support capability, career pathways and role-level expectations. (A, I)
• Understanding of SFIA-aligned cyber governance, risk and compliance skills, particularly Governance, Risk Management, Audit, Information Assurance, Information Security, Stakeholder Relationship Management and Measurement/Reporting at a level appropriate to a Grade 7 role. (A, I)

Skills/Ability

• Proven stakeholder engagement and communication skills, including the ability to influence senior leaders, explain complex cyber risk and assurance topics clearly, and drive action across teams. (A, I)

Experience

• Experience of planning and managing assurance activity (e.g., audits, assessments and reviews), including defining scope, coordinating evidence, reporting findings and driving remediation to completion. (A, I)
• Experience of leading or owning cyber governance and assurance work, including setting direction, establishing ways of working, and providing clear oversight and reporting to senior stakeholders. (A, I)
• Experience of developing and embedding cyber security compliance and control requirements (including policy/standards), and monitoring adherence through effective reporting and governance. (A, I)
• Substantial, recent experience in a cyber governance, risk, compliance, information assurance or audit role, with demonstrable accountability for producing assurance evidence, managing control findings and driving remediation or risk acceptance through governance forums. (A, I)
• Experience of working with, or applying, government cyber and security assurance requirements such as GovAssure, Cyber Assessment Framework, NCSC guidance, Security Policy Framework expectations, internal audit recommendations or external assurance reviews. (A, I)
• Experience of preparing senior-level reporting on cyber risk, compliance status, control effectiveness, audit findings, exceptions and remediation progress, using clear evidence and proportionate professional judgement. (A, I, P)
• Ability to evidence claimed experience through specific examples, outcomes and artefacts, such as risk papers, assurance plans, audit evidence packs, control assessment outputs, policy updates, governance records or management information. (A, I)

Professional Framework Alignment

The role should be assessed as a cyber governance and assurance role aligned to the Government Security Profession / Government Cyber Profession career framework and to SFIA responsibilities suitable for a Grade 7 post. Candidates should be able to demonstrate applied capability, not only theoretical awareness, across governance, risk management, audit, assurance, control effectiveness, stakeholder engagement and security reporting.

• SFIA alignment: Governance, Risk Management, Audit, Information Assurance, Information Security, Stakeholder Relationship Management and Measurement should be evidenced at a level consistent with managing complex work, influencing senior stakeholders and providing organisational assurance.
• Government Security Profession alignment: Cyber Security Governance and Risk Management, Cyber Security Audit and Assurance, Governance and Compliance, Security Policy and Security Strategy are the most relevant role families or specialisms for assessment.
• Evidence expectation: Candidates should be asked to provide concrete examples of assurance outputs, governance papers, risk decisions, control assessments, audit responses, policy improvements or MI they have personally led or materially contributed to.

We'll assess you against these behaviours during the selection process:

• Seeing the Big Picture
• Delivering at Pace
• Leadership
• Working Together

We'll assess you against these technical skills during the selection process:

• Technical Questions - you will be assessed across your technical expertise and acumen, in relation to the essential criteria.
• Presentation - assessed against the behaviour 'Seeing the Big Picture' - this will be a subject / topic agreed by UKEF and provided to relevant candidates

• Learning and development tailored to your role
• An environment with flexible working options
• A culture encouraging inclusion and diversity
• A Civil Service pension with an employer contribution of 28.97%

Job contact :

• Name : Recruitment Team
• Email : Recruitment2@ukexportfinance.gov.uk

Recruitment team

• Email : Recruitment2@ukexportfinance.gov.uk

Share this page

• Print
• Email
• Gmail
• Facebook
• LinkedIn