Team Manager, Cybersecurity; GRC

This job is brought to you by Jobs/Redefined, the UK's leading over-50s age inclusive jobs board.

Team Manager, Cybersecurity
(GRC)

Role

Title:

Team Manager, Cybersecurity

Reports to:

Senior Lead, Information Security

Location:

London, Hybrid

Team:
Cybersecurity, OCTO

Cybersecurity Governance, Risk & Compliance function sits within the Chief Information Security Office as part of the Digital and Technology organisation that consists of a wide range of shared services reporting to the Chief Information Officer at Pearson.

We are seeking a highly motivated and experienced Team Manager, Cybersecurity to lead our cyber risk and third-party risk management capabilities within the Cyber GRC team. This role is accountable for how cyber risks are identified, assessed, prioritised, treated, and reported across the organisation.

The role sits at the heart of cybersecurity decision-making, partnering closely with Technology, Data Privacy, Designated Risk Owners, and senior stakeholders to ensure risks are understood, actively managed, and transparently reported
, while enabling the business to move at pace.

This is a people-leadership role
, responsible for developing a team of cyber risk professionals and setting the standard for pragmatic, risk-based decision-making across Cyber GRC.

• Lead the development, implementation, and continuous improvement of the enterprise cyber risk management framework
  .
• Oversee risk identification, assessment, treatment, and monitoring across all cybersecurity domains.
• Ensure cyber risks are consistently articulated in business-relevant terms
  , with clear ownership and agreed remediation plans.
• Establish and maintain robust cyber risk reporting and data standards, ensuring risk data is accurate, accessible, and consistently used to inform decision-making.
• Provide clear, concise risk insights and reporting to senior leadership, risk forums, and executive stakeholders.
• Drive a strong risk culture
  , embedding risk management into technology and business decision‑making.

• Own and oversee the third‑party cyber risk management (TPRM) programme
  , aligned to business criticality and risk appetite.
• Ensure supplier and partner risks are assessed proportionately and tracked through to resolution or risk acceptance.
• Support and lead material supplier risk discussions, including escalation and formal risk acceptance where required.
• Support and govern formal cyber risk acceptance decisions, ensuring risks are clearly articulated, understood, and owned at the appropriate level.
• Partner with Procurement, Legal, and Technology to ensure third-party risks are understood and managed throughout the supplier lifecycle.
• Define and oversee third-party cyber risk reporting, metrics, and data quality to provide clear visibility of supplier risk exposure, remediation status, and material risk decisions.

• Lead, coach, and develop a small team of cyber risk and third-party risk professionals.
• Set clear priorities, allocate work effectively, and ensure high-quality, timely risk outcomes.
• Act as a senior subject‑matter expert and escalation point within the Cyber GRC function.
• Drive pragmatic risk prioritisation, balancing risk reduction, delivery timelines, and business priorities in line with risk appetite.
• Maintain awareness of relevant regulatory, industry, and threat landscape developments to inform risk judgement and stakeholder advice.
• Build capability across the team in risk judgement, stakeholder engagement, and executive communication.
• Develop sustainable team capability and succession, reducing single‑points‑of‑failure across cyber risk and TPRM activities.
• Build and maintain strong relationships and professional networks across Technology, Data Privacy, Legal, and senior stakeholders to enable effective risk outcomes and informed decision‑making.

• Drive the maturity of Cyber GRC processes through automation, tooling, and simplification
  .
• Ensure risk workflows, dashboards, and reporting provide meaningful insight rather than compliance overhead.
• Identify and remove…