ISMS Cyber and Risk Auditor Review

As an ISMS Cyber and Risk Auditor, I operate within the cybersecurity domain, supporting Capgemini’s Information Security Management System (ISMS) and its alignment with ISO/IEC 27001. On a day‑to‑day basis, my role involves planning, conducting and reporting on internal ISMS audits across accounts and business units, assessing the effectiveness of security controls, governance arrangements and risk management practices. This includes reviewing documentation, interviewing stakeholders, evaluating evidence against ISO27001 requirements, and identifying nonconformities, risks and opportunities for continual improvement. Alongside audit delivery, I contribute to the ongoing operation and maturity of the ISMS by supporting risk reviews, tracking audit actions through to closure, and feeding findings into wider cybersecurity reporting. I also complete regular weekly and monthly reports to support team objectives, provide visibility of audit progress and emerging risks, and help inform senior stakeholders and the CISO function. As my role develops, I am increasingly focused on expanding my capability across the wider cyber risk landscape, including risk‑based assurance, maturity assessments and alignment with broader cybersecurity and compliance frameworks.

Overall, the programme is well structured, with a clear curriculum framework and defined learning outcomes that provide a strong foundation throughout the course. The sequencing of modules and assessments generally supports progressive learning and allows knowledge to be built incrementally. However, my experience has been that the delivery has not always been consistent across lecturers. In some instances, differences in interpretation of assessment criteria, levels of engagement, or teaching approach led to inconsistency, which at times had an adverse effect on grades despite comparable effort and understanding of the subject matter. While the overarching structure of the programme works well, not all lecturers demonstrated the same level of commitment or alignment, which occasionally impacted clarity and fairness. Despite this, the programme as a whole remains valuable and well designed, and these experiences have also helped me develop resilience, adaptability, and the ability to seek clarification and take ownership of my learning.

I receive a high level of support from my employer throughout the programme. My manager has consistently checked in on my progress and taken an active interest in both my academic and professional development. This has included regularly attending my university tripartite reviews, such as the Tripartite Review, which has helped create a shared understanding between my employer and the university around my progress, strengths, and development areas. These discussions have been particularly valuable in ensuring alignment between my role at Capgemini and my academic learning, allowing constructive feedback to be translated into meaningful development actions. Overall, this level of engagement has made me feel well supported and has played a key role in my progression and confidence throughout the programme.

I receive a reasonable level of support from my training provider; however, this has felt slightly inconsistent at times. As the programme was delivered predominantly remotely, it was sometimes challenging to access timely support outside of scheduled sessions. In particular, I found it difficult to attend office hours that aligned with their availability while also managing the demands of working full time. While support was available when accessed, greater flexibility or clearer consideration of full-time working patterns would have been beneficial. Despite these challenges, the academic guidance provided was valuable, and navigating this environment has helped me become more independent and proactive in managing my learning and seeking support when required.

Overall, I feel that my qualification supports my ability to perform better in my role to a strong extent. The programme has helped me develop a broader understanding of digital and technology concepts that underpin my day‑to‑day work within cybersecurity, particularly around governance, risk, strategy, and organisational context. Modules within the Digital and Technology Solutions qualification, such as business processes, digital transformation, and leadership, have enabled me to better understand how security, risk, and compliance activities fit into wider business and technology environments, as reflected in programme materials

Yes

Inclusive atmosphere
Great Pay
Progression Opportunities and Development