Establish, implement, and mature an enterprise-wide Governance, Risk & Compliance program
Directly address high-priority risks including disaster recovery readiness, identity governance, cyber supplier risk, and compliance obligations
Develop and maintain governance frameworks, policies, and standards
Lead identification, assessment, and monitoring of enterprise IT risks
Conduct periodic risk assessments and maintain the corporate risk register
Lead compliance programs including ISO27001, Cyber Essentials+
Oversee internal/external audits and coordinate documentation and evidence collection
Drive third-party cyber risk assessments and supplier due diligence processes
Serve as advisor to CIO/Executive team on governance, risk, and compliance matters
Build and mentor a growing GRC function as the organisation matures

Bachelor’s degree in business IT, Risk Management, Cybersecurity or related field
Preferred: CISA, CRISC, CISSP, ISO27001 Lead Implementer/Auditor
6–15 years GRC, cybersecurity risk management, internal audit, or enterprise risk experience
Experience leading risk mitigation projects across DR, identity governance, supplier risk, and regulatory compliance
Strong knowledge of NIST CSF, ISO27001/2, SOC frameworks, GDPR and global privacy regulations
Strong understanding of IT infrastructure, cloud environments, ERP systems, and identity platforms
Ability to translate complex risks into business-language recommendations
Excellent communication, policy writing, and stakeholder management skills

Governance, Risk & Compliance Lead

Key skills