Information Security Governance, Risk and Compliance

Purpose of Position

This fixed-term role will provide practical delivery across Pantheon’s cyber and information-security governance, risk and compliance activities. A major priority will be to implement and build out Microsoft Purview Compliance Manager, starting with GDPR, DORA and ISO/IEC 27001, to identify control gaps, align ownership and evidence collection, and establish a sustainable compliance operating model and governed evidence repository. The role will also deliver core GRC activity across cyber-risk management in Resolver, supplier onboarding and assurance through Risk Ledger, third-party risk management, DDQ/ODD responses, audit and regulatory evidence, control testing, remediation tracking and management reporting. The role is intended to increase delivery capacity, improve the quality and reuse of evidence, and leave well-documented, sustainable processes at the end of the fixed term.

Key Responsibilities

• Implement and build out Microsoft Purview Compliance Manager, beginning with GDPR, DORA and ISO/IEC 27001 and extending to other applicable regulations, standards and internal controls.
• Configure assessments, scope organisational boundaries and services, map common controls, assign owners, record implementation and testing status, maintain evidence, and translate gaps into prioritised improvement actions with dates and closure criteria.
• Design and build a governed SharePoint evidence repository with an agreed taxonomy, metadata, naming, versioning, access, retention, approval, review and evidence-validity model.
• Map authoritative and reusable evidence to controls; identify missing, stale, duplicated or contradictory material; and rationalise collection for Compliance Manager, audits, regulatory requests, DDQs and ODDs.
• Administer and develop cyber-risk records in Resolver, supporting consistent risk identification, assessment, ownership, treatment, acceptance, review, escalation and reporting, with a clear audit trail.
• Support end-to-end third-party risk management, including supplier intake, inherent-risk triage, due diligence, Risk Ledger onboarding and administration, evidence review, findings, remediation, exceptions, periodic reassessment and offboarding.
• Coordinate and draft accurate, consistent and client-ready responses to DDQs, ODDs, RFPs, audits and regulatory information requests, using approved sources and engaging Cyber, Risk, Privacy, Legal, Technology and business owners as required.
• Perform control and compliance gap assessments, support control testing, maintain remediation plans, follow up overdue actions and verify evidence before closure.
• Assess proportionate opportunities for automation, continuous monitoring and evidence reuse across Microsoft 365, Azure, Purview, security tooling and GRC platforms, while documenting activities requiring manual assessment.
• Produce concise management information covering compliance status, material cyber risks, supplier-assurance progress, control gaps, overdue actions, evidence health, dependencies and remediation.
• Document procedures, decisions, mappings, ownership and reporting cadences; train relevant users; and deliver a complete, usable handover so the capabilities remain sustainable after the FTC ends.

Knowledge & Experience Required 

• Demonstrable hands-on Microsoft Purview Compliance Manager experience, including assessments, controls, improvement actions, ownership, implementation and testing status, evidence and reporting.
• Broad practical GRC experience encompassing cyber-risk management, control assessment, remediation tracking, policy and standards activity, regulatory assurance and audit support.
• Working knowledge of GDPR, DORA and ISO/IEC 27001, with the ability to translate obligations into controls, test procedures, evidence requirements and proportionate remediation.
• Experience of third-party risk management, including supplier due diligence, security evidence review, findings, remediation, exceptions and lifecycle reassessment.
• Experience completing or coordinating DDQs, ODDs, RFPs, audit requests or regulatory evidence submissions, with strong attention to accuracy, consistency and approval.
• Strong evidence-management skills, including control libraries, SharePoint repositories, metadata, version control, access governance, review cycles, source validation and quality assurance.
• Good working knowledge of Microsoft 365, Purview, Azure and security and compliance capabilities, with sound judgement about automation and manual assurance.
• Clear written and verbal communication, with the ability to work effectively with Technology, Risk, Privacy, Legal, Procurement, Internal Audit, business owners and senior management.
• Strong delivery discipline: able to manage a time-bound backlog, prioritise competing deadlines, maintain defensible records and leave complete documentation and a sustainable handover.

Desirable

• Hands-on experience of Risk Ledger, Resolver or comparable GRC and third-party risk platforms.
• Experience in regulated financial services, including DORA implementation, regulatory engagement, external assurance or ISO/IEC 27001 certification activity.
• Experience migrating existing controls, risks, assessments and evidence, and creating custom assessment content where standard templates do not meet business needs.
• Experience using Power Platform, Microsoft Graph, APIs or other appropriate methods to streamline evidence collection, workflow and reporting.

Fixed term deliverables 

• First 30 days: confirm the prioritised GRC backlog, stakeholders and RACI; validate Compliance Manager licensing, templates and scope; establish a pilot assessment and evidence-repository design; and review current Resolver, Risk Ledger, TPRM and DDQ/ODD processes and outstanding work.
• By 60 days: populate the agreed GDPR, DORA and ISO/IEC 27001 assessments; map common controls and available evidence; triage priority gaps; improve evidence quality; and deliver agreed cyber-risk, supplier-assurance and due-diligence actions.
• By 90 days: operate control testing and review cycles; establish reporting and remediation governance; demonstrate improved Resolver and Risk Ledger data quality and workflow; and embed a repeatable, approved DDQ/ODD evidence process.
• By the end of the FTC: deliver a functioning and governed Compliance Manager capability and evidence repository, demonstrable improvements across the wider GRC remit, trained owners and a complete handover pack.