GRC Policy and Governance Lead

TN United Kingdom; Bury; On-site; GBP 60,000 - 100,000; Full time

Job summary

An established industry player is looking for an IT & Cyber Governance and Policy Lead to enhance their security posture globally. This role involves developing and implementing governance frameworks and policies, ensuring compliance across diverse organizational entities. The ideal candidate will have a strong background in cybersecurity, policy development, and risk management, along with excellent communication and analytical skills. Join a dynamic team where your expertise will play a crucial role in shaping the organization's security strategy and fostering a culture of compliance and security awareness.

Qualifications

• 5+ years in governance frameworks and policy development.
• Deep understanding of cybersecurity frameworks and risk management.

Responsibilities

• Implement and maintain IT and cyber governance frameworks.
• Communicate policy requirements to stakeholders and suppliers.

Skills

Governance Frameworks

Policy Development

Cybersecurity Frameworks

Risk Management

Analytical Skills

Stakeholder Management

Communication Skills

Education

Bachelor's Degree in Cybersecurity

Certifications (CISSP, CISM, CRISC)

Tools

AWS

Azure

GCP

Job description

Social network you want to login/join with:

Job Description for IT & Cyber Policy and Governance Lead

Business Area

Information Security

Job Title

IT & Cyber Governance and Policy Lead

Scope and Coverage

Global

Outline Purpose of Role

This role will:

• Implement, develop, and own IT and cyber governance processes and forums in alignment with the IT and Information security operations and risk framework.
• Maintain and improve the IT and information security policy framework, including policies, standards, and processes.
• Help drive a robust security posture for a large, complex organization, trading globally within a constantly evolving threat environment.

Impact of Role

• Implement governance framework to enforce and manage IT and cyber policies across all JD entities.
• Promote good security hygiene and controls within the JD Sports business culture.

Reports to

Global Head of Governance, Risk and Compliance within the Information Security Function.

Direct Reports

Individual contributor, potentially managing a GRC Analyst and overseeing seconded resources, contingent workers, and systems integrators.

Key Elements of the Role

The job holder will develop, implement, and maintain IT and cyber governance frameworks, policies, and standards to ensure effective deployment and enforcement across the technology organization. Responsibilities include:

IT and Cyber Policy Framework:

• Assess organizational entities to determine policy requirements.
• Maintain and improve the policy framework for continuous enhancement.
• Establish governance structures with clear roles, responsibilities, and processes.
• Align governance with JD Sports policies and security strategy.
• Define policies, standards, and guidelines following best practices.
• Harmonize policies across entities for consistency.
• Manage policy lifecycle, ensuring reviews and updates.
• Analyze incidents for policy gaps and improvements.
• Report on policy adherence, breaches, and risks.
• Explore automation for policy enforcement.

Stakeholder Engagement and Advisory:

• Communicate policy requirements to internal stakeholders and suppliers.
• Collaborate with vendors to ensure policy adherence.
• Develop compliance regimes aligned with the 3 lines of defense.
• Work with HR, legal, procurement to embed controls in processes.
• Address non-compliance issues with risks and mitigation strategies.
• Provide training on policies and best practices.
• Build relationships to ensure policy effectiveness.
• Serve as SME for governance and policies.

Key Attributes of The Jobholder

Experience and Qualifications

• Bachelor’s degree in Cybersecurity, IT, Compliance, or related.
• 5+ years in governance frameworks, policy development, or compliance.
• Certifications like CISSP, CISM, CRISC preferred.
• Deep understanding of cybersecurity frameworks (NIST, ISO 27001) and risk management.
• Experience with controls development, threat modeling, and vulnerability management.
• Knowledge of third-party risk management.
• Understanding of regulatory frameworks (GDPR, PCI-DSS, etc.).
• Awareness of operating systems and database technologies.
• Experience with cloud environments (AWS, Azure, GCP).
• Familiarity with Agile practices and advanced cybersecurity technologies.

Key Skills

The job holder should possess:

• Ability to clarify ambiguity in complex organizations.
• Strong analytical and decision-making skills.
• Excellent communication skills for diverse audiences.
• Proven collaboration and leadership abilities.
• Effective stakeholder management and policy enforcement skills.