Information Security GRC Lead Specialist

About the role

The Information Security GRC Lead Specialist will drive the development and implementation of governance, risk and compliance (GRC) programs across the organization. Reporting to senior leadership, you will ensure that security policies, standards, and processes align with regulatory requirements and industry best practices.

Key responsibilities

• Define and maintain information security policies, standards, and related processes in line with cybersecurity regulations.
• Design and implement security procedures and frameworks to ensure consistent control implementation.
• Develop and manage GRC programs for effective risk identification, assessment, and mitigation.
• Create and deliver cybersecurity awareness and education initiatives, including workshops and seminars.
• Conduct regular risk assessments, maintain the risk register, and oversee remediation plans.
• Perform semi‑annual audits against the NCA framework and annual audits against ISO 27001, reporting findings and recommending improvements.
• Manage non‑compliance cases, support external assessments, and produce periodic compliance reports for regulators.
• Adhere to all internal policies, processes, and standard operating procedures.

Required profile

• Experienced professional capable of handling complex security challenges with minimal supervision.
• Strong analytical skills to interpret assessment results and develop mitigation strategies.
• Proactive attitude toward continuous improvement of security posture.

Required skills

• Knowledge of ISO 27001 standards.
• Familiarity with the NCA cybersecurity framework.
• Risk assessment and risk register management.
• Cybersecurity governance and compliance expertise.