Senior Manager, Cybersecurity Governance, Risk & Compliance (GRC)

Title: Senior Manager, Cybersecurity Governance, Risk & Compliance (GRC) About the Role KBR is seeking a Senior Manager, Cybersecurity Governance, Risk & Compliance (GRC) to lead cybersecurity governance, risk management, information assurance, and data protection activities across the United Kingdom. As the senior information security representative for UK operations, this role is responsible for driving the implementation of security policies, standards, and controls while overseeing accreditation, compliance, and assurance activities. Working closely with business, technology, and security leaders, the successful candidate will identify, assess, and mitigate cyber risks across the enterprise. This position provides strategic security leadership, ensures compliance with regulatory and contractual requirements, and delivers executive-level reporting on security risks, control effectiveness, and the organisation's overall security posture. In September 2025, KBR announced that we are spinning our Mission Technology Solutions business into a separate public company. This role will ultimately be part of the new company. The Mission Technology Solutions business partners with governments and defence, intelligence, space, aviation, and critical infrastructure customers to deliver advanced engineering, science, technology, and mission support solutions. What You’ll Be Doing Lead the implementation and oversight of enterprise information security, data protection, and privacy policies across the business. Manage security governance processes and ensure alignment with Office of the CISO policies, standards, and procedures. Plan and manage network certification, accreditation, and compliance activities in coordination with the Office of the CISO, government customers, auditors, certification bodies, and third-party assessors. Coordinate and support penetration testing, security assessments, and related assurance activities. Assist in the management and coordination of regional regulatory compliance and data privacy initiatives. Collaborate with Security Operations and IT teams to ensure appropriate governance and protection of OFFICIAL-SENSITIVE and classified information. Assess security threats and risks and develop appropriate mitigation strategies. Serve as a cybersecurity subject matter expert, providing guidance on security architecture, governance, and risk management. Provide consulting and security oversight for current and future projects involving network, infrastructure, and enterprise security architecture. Support the development and delivery of security awareness training, data protection education, and best practice guidance. Author, review, and maintain information security policies, standards, procedures, and supporting documentation. Provide security representation and guidance for Architecture Review Boards, Change Control Boards, and project governance forums. Respond to customer security inquiries and support security-related requirements for business programs and projects. Support formal investigations involving security incidents, policy violations, and misconduct in coordination with Human Resources, Corporate Security, Finance, Business Integrity, and Office of the CISO teams. Participate in cybersecurity incident response activities and support incident investigations as required. Manage and respond to Data Privacy and Information Security support requests across the business. Provide security advice, guidance, and risk-based recommendations to management, stakeholders, and customers. Participate in Privacy Impact Assessments and support the review and development of data protection requirements and contractual language. Review and approve information security governance activities including risk assessments, security categorization, waivers, exceptions, and variances in accordance with CISO directives. Provide regular reporting and executive-level briefings regarding security risks, compliance posture, and the effectiveness of security controls. What You’ll Bring Qualifications & Experience Essential Bachelor's degree in Cybersecurity, Information Security, Information Assurance, Computer Science, Information Technology, or a related field; additional relevant experience may be considered in lieu of a degree. Experience in Information Security, Information Assurance, Cybersecurity, or a related discipline, including leadership of security initiatives within complex enterprise environments. Experience in cybersecurity governance, risk management, compliance, accreditation, and information security programme oversight. Knowledge of information security frameworks and standards, including ISO 27001, NIST, and related governance controls. Experience working with UK government, defence, or other highly regulated environments. Preferred Master's degree in Cybersecurity, Information Security, or a related field CISSP, CISM, CCSP, or equivalent cybersecurity certification Experience supporting a