Lead, Information Security

📋 Description

• Define multi-year GRC roadmap aligned to business strategy, risk appetite, and regulatory
• Drive control framework evolution: rationalize controls, reduce duplication, and ensure
• Establish 'north star' principles for governance (e.g., minimum control baselines, exception
• Advise leadership on material risk decisions: risk acceptance, remediation prioritisation, control
• Produce executive-grade outputs: risk narratives, board/committee materials, and regulator/customer
• Facilitate senior stakeholder alignment when priorities conflict (delivery speed vs control rigor

🎯 Requirements

• Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk
• Demonstrated ownership of complex, multi-stakeholder GRC programs and successful navigation of
• Deep working knowledge of ISO 27001, DORA and strong familiarity with adjacent frameworks (SOC 2
• Strong technology risk understanding across cloud, IAM, SDLC governance, incident management
• Ability to influence across the organisation and resolve conflicts with a risk-based

🎁 Benefits

• Flexibility to work where you thrive – Hybrid working model with 25 days per year to work from any
• Competitive total compensation package with stock option plan
• Mental wellbeing support through OpenUP
• Additional 3 days paid time off in 2027 after 6 months tenure
• Unlimited access to Udemy's online courses
• Discounts and perks from partners worldwide