GRC Lead

Precise Placements; City Of London; On-site; GBP 65,000 - 95,000; Full time

Job summary

Precise Placements is recruiting a GRC Lead to oversee ISMS and security governance for a global law firm client. The role focuses on ISO27001/27002/27005, ISO 31000, and security audits, managing policy development, risk management, audits, and compliance across the firm.

The successful candidate will drive the security program, report risks to senior management, coordinate audits and third-party assessments, and lead security awareness initiatives and policy implementation.

Qualifications

• Proven experience in a similar role.
• Law firm experience preferred but not required.
• Strong knowledge on ISO frameworks.

Responsibilities

• ISMS Management across the firm and country offices.
• Communicate security risks and requirements to senior management.
• Support development of budget for information security objectives.
• Develop and maintain security compliance program.
• Provide support to local offices to update IS documentation.
• Establish security metrics to assess effectiveness and improve processes.
• Coordinate and maintain the management review process.
• Oversee security audits and certifications (internal & external).
• Manage third party providers including security consultants and assessors.
• Own the Security Awareness Program and phishing simulation campaigns.
• Drive improvement management and policy development across global IT teams.

Skills

GRC Experience

ISO frameworks

ISMS

Job description

GRC Lead - ISO27001, ISO 27002, ISO 27005, ISO 31000 ISMS, Security Audits

Our leading global law firm client are actively looking to take on a new GRC Lead (ISO 27001, ISO 27002, ISO 27005, ISO 31000 ISMS, Security Audits) on a permanent basis, this person will be responsible for the management of ISMS globally across the firm which covers a broad range of security activities such as Policy Development, Risk Management, Internal & External audits & compliance etc.

To be considered for this GRC Lead (ISO 27001, ISO 27002, ISO 27005, ISO 31000 ISMS, Security Audits) role, it's ideal that you have:

• Proven experience in a similar role
• Preferable but not required law firm experience
• Strong knowledge on ISO frameworks

Duties, Responsibilities & Person Specification

• ISMS Management
• Communicate to senior management on risks and requirements
• Understand business objectives and support development of budget for information security objectives
• Develop and maintain security compliance program
• Provide support where necessary to local offices to update and maintain country specific IS documentation
• Establish security metrics to assess effectiveness
• Coordinate and maintain the management review process
• Make written and oral reports to ISSC
• Security Audits
• Manage internal and external audits and certifications
• Manage third party providers including security consultants and assessors
• Security Awareness
• Ownership of the Security Awareness Program and the Security Awareness Centre and support of Security Culture Change including owning and managing the quarterly phishing simulation campaigns and the third party relationship.
• Improvement management
• Manage identified improvements through to completion
• Policy
• Develop, maintain and publish security strategies, policies and procedures
• Manage security policy and implementation
• Support global IT departments on implementation of security policy and products