GRC Lead

Risk Ledger; City of Westminster; Sur place; GBP 85 000 - 120 000; Plein temps

Résumé du poste

Risk Ledger is seeking a GRC Lead to own governance, risk and compliance activities across the UK and US. You’ll manage ISO 27001 operations, advance SOC 2 from Type 1 to Type 2, and maintain the risk framework relied on by leadership.

This is a hands-on role with minimal delegation and strong cross-functional collaboration. You’ll work with teams across Engineering, Product, Sales, Customer Success, People and Finance to ensure security outcomes drive business growth while meeting customer

Qualifications

• At least 3 years' hands-on GRC experience.
• Experience maintaining ISO 27001 certification and SOC 2 audits from the organisation's side.
• Experience in a startup or scale-up, ideally in B2B SaaS, fintech or security.
• Hands-on experience turning risk data into clear reporting for senior leaders.
• Pragmatic, risk-based approach with clear business impact.

Responsabilités

• Run ISO 27001 ISMS year round and lead external audits; progress SOC 2 from Type 1 to Type 2.
• Own enterprise risk management framework and risk register; report risk posture to leadership.
• Lead compliance tooling and move to an in-house solution for continuous evidence collection.
• Support customer assurance; assist Sales and Customer Success with security questionnaires.
• Keep policies current; collaborate with control owners across the business.

Connaissances

GRC experience

Risk management

Communication skills

Self-starter

Control rationale

AI & automation

Outils

GRC software platform

Description du poste

You'll join the Security & IT team, led by the Director of Information Security and IT Operations, which owns information security, IT operations and GRC across Risk Ledger in the UK and US. Risk Ledger helps security and risk teams manage third-party and supply chain risk, so our customers hold us to the same standard they hold their own suppliers to. Our own assurance is part of the product promise: we are ISO 27001 certified, hold Cyber Essentials Plus and have achieved SOC 2 Type 1. The team works closely with Engineering, Product, Sales, Customer Success, People and Finance, making security and compliance something that helps the business win and keep customers rather than slowing it down. This role As GRC Lead you'll own Risk Ledger's governance, risk and compliance work day to day: our certifications, our enterprise risk management, our policies, and the assurance we give customers. This is a hands-on role for someone who likes to do the work, not delegate it. There's no team to inherit. You'll be the person who keeps ISO 27001 running, takes us from SOC 2 Type 1 to Type 2, and owns the risk framework the leadership team relies on. It's a highly collaborative role: expect to spend around half your time working with people across the business, from engineers to Sales to leadership. You'll often be given a problem rather than a plan, so you'll be comfortable turning loose direction into something that works.,

• Run our certifications. Maintain our ISO 27001 ISMS year round and lead our external audits. Take us from SOC 2 Type 1 to Type 2 by building and maintaining the evidence, then keep SOC 2 running.
• Own enterprise risk management. Own our enterprise risk management framework and risk register, run risk reviews with owners, and give the leadership team clear reporting on our risk posture.
• Lead our compliance tooling. Manage our automated security and compliance software platform implementation, then help us move to an in-house solution within the year, so evidence collection is continuous rather than a scramble before each audit.
• Support customer assurance. Help Sales and Customer Success answer security questionnaires and due diligence, so security reviews speed deals up rather than slowing them down.
• Keep policies current. Keep our policies up to date, owned and followed, and support our own supplier risk programme using the Risk Ledger platform.
• Bring people with you. Work with control owners across the business, explaining why controls matter and getting things done through influence rather than authority.
• At least 3 years' hands-on GRC experience.
• Hands-on experience maintaining an ISO 27001 certification and working on SOC 2 audits from the organisation's side. Both are essential.
• Experience in a startup or scale-up, ideally in B2B SaaS, fintech or security.
• Hands-on experience of risk management, and turning risk data into clear reporting for senior leaders.
• A pragmatic, risk-based approach: you favour real security outcomes over box-ticking and can explain why a control matters.
• A self-starter mindset: you take ownership, work well with loose direction and move at pace.
• Strong communication and people skills, adapting to audiences from engineers to auditors to leadership.
• AI and automation experience

Nice to have

• Experience with Cyber Essentials or Cyber Essentials Plus.
• Experience with ISO 42001, the EU AI Act or other AI governance frameworks.
• Experience with GRC automation platforms, or building compliance tooling in house.
• Working knowledge of UK GDPR and awareness of US privacy and security expectations.
• Experience supporting sales through customer security reviews and questionnaires.
• Experience with third-party or supply chain risk management, or a strong interest in the problem we solve.
• Relevant certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC or CISSP.

Risk Ledger is developing a network of connected organisations, all working together to defend against cybersecurity attacks in the supply chain. Organisations rely on us to establish trust, through sharing their security maturity and visualising the risks posed by their supply chain ecosystem. And we're already trusted by customers like British Airways, BAE Systems and the NHS. We are putting together an amazing and talented team from a diverse set of backgrounds and skillsets to drive us towards our vision. Risk Ledger is built on the respect we have for one another and our users, united by our shared values and mission. Every one of us is still learning: it's how we grow as individuals. We're curious. We're ambitious. And we're humble and honest. At Risk Ledger, we aim high to find the best solutions we can and always put our users first.