Information Security Governance, Risk & Compliance Manager

Own and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence
Lead security governance, regulatory assurance, cyber risk, third-party security risk, policy lifecycle, and security-awareness oversight
Establish clear ownership for security controls, risks, exceptions, evidence, and remediation actions
Coordinate SOC 2, DORA/CySEC-related assurance, internal and external audits, and regulatory requests
Maintain cyber-risk and exception registers and ensure material risks are treated, accepted, or escalated
Lead security aspects of ICT supplier tiering, due diligence, reassessment, and high-risk supplier decisions
Develop practical security policies, standards, controls, and guidance
Ensure audit and assurance evidence is reliable, traceable, and reusable
Track control gaps, findings, and remediation commitments and escalate material risks
Partner with Security, IT, Engineering, Product, Platform, Legal, and business teams on control design and risk-based decisions
Prepare concise GRC and risk reporting for the CISO and executive stakeholders
Build, develop, and manage the GRC team, including responsibilities, goals, and performance expectations
Improve GRC efficiency through automation, reusable evidence, better data quality, and responsible AI-assisted workflows

Strong practical experience in Information Security GRC, cyber/technology risk, security compliance, or assurance
Hands-on experience with recognized frameworks such as SOC 2, ISO 27001, DORA, PCI DSS, NIST CSF, COBIT, or similar
Experience establishing or operating security controls, risk registers, exception processes, and assurance programs
Strong understanding of control design, operating effectiveness, evidence quality, findings, and remediation
Experience coordinating internal or external audits and regulatory or assurance activities
Practical experience with cyber risk assessment, risk treatment, risk acceptance, and escalation
Understanding of third-party and ICT supplier security risk
Ability to translate regulatory and security requirements into practical controls and processes
Strong stakeholder management skills and ability to work effectively with technical, business, and executive audiences
Sufficient technical understanding of cloud, infrastructure, identity, IT operations, and product development to work effectively with technical teams
Experience leading a team, function, program, or complex cross-functional initiatives
Strong ownership, prioritization, and decision-making skills