Information Security Governance, Risk and Compliance Lead

JD Williams & Company Limited; Manchester; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid working (1-2 days per week in 1

Job summary

N Brown is seeking an Information Security Governance, Risk and Compliance Lead to modernise risk and compliance in a cloud-first Digital Operations setup. You will guide a team of GRC analysts, drive automation, and ensure regulatory obligations are met across PCI DSS and GDPR.

You will partner with stakeholders to balance robust governance with agile delivery, reporting on KRIs and control effectiveness, and shaping policy and guardrails for a modern security program.

Qualifications

• Experience implementing AI/LLMs to enhance GRC workflows.
• Deep understanding of ISO27001 and NIST CSF in agile, cloud-first environments.
• Experience with cloud platforms (AWS/Azure) and risk-based controls.
• Proficiency with enterprise workflow tools and automation rules.
• Ability to translate security risks into business impact for stakeholders.
• Proven leadership and coaching of GRC analysts.
• Proactive identification of evidence gaps and remediation actions.

Responsibilities

• Lead AI-driven tools to automate routine GRC tasks and evidence gathering.
• Own end-to-end risk lifecycle; assess and review risk in line with governance forums.
• Oversee security due diligence for the supply chain using automation.
• Define, test and mature key controls with clear assurance delivery.
• Maintain PCI DSS, GDPR, and UK DPA 2018 compliance posture.
• Drive security awareness strategy across Tribes and functions.
• Provide automated reporting on KRIs, control effectiveness and remediation.
• Maintain Information Security Policy framework and guardrails.

Skills

AI & Automation

Risk Management

Third-Party Assurance

Control Excellence

Regulatory Compliance

Security Culture

Governance Oversight

Policy & Guardrails

Audit Liaison

Job description

We're looking for an Information Security Governance, Risk and Compliance Lead to join our Cyber Security team!

The Info Sec Governance, Risk and Compliance team is the engine room for N Brown's security posture, ensuring we protect what matters and enable what's next. They are responsible for the development and rollout of our security policies; building a high-impact awareness programme; and ensuring they meet our regulatory obligations, including PCI DSS and GDPR.

As the GRC Lead, you will be at the forefront of modernising our approach-moving away from manual, static processes toward a data-driven, intelligence-led function. You will lead a team of GRC analysts to manage the risk lifecycle, integrate security into our shift left delivery culture, and pioneer the use of AI to automate control testing and risk reporting. Reporting to the Head of Cyber Security & Risk, you will strike the balance between robust governance and the agility needed for a cloud-first Digital Operations environment.

What will you do as an Information Security Governance, Risk and Compliance Lead at N Brown?

• AI & Automation: Lead the implementation of AI-driven tools to automate routine GRC tasks, such as mapping controls to regulatory frameworks, summarising audit evidence, and optimising the risk intake process.
• Risk Management: Own the end-to-end risk lifecycle, ensuring business and technical risks are accurately assessed, evidenced, and reviewed in line with the Digital Operations Risk Forum requirements.
• Third-Party Assurance: Oversee risk-based security due diligence for the supply chain, using automation to streamline initial assessments and periodic re-reviews.
• Control Excellence: Work with Control Owners and Operators to define, test, and mature key controls, ensuring they are evidenced through clear delivery and assurance activity.
• Regulatory Compliance: Maintain N Brown's compliance posture for PCI DSS, GDPR, and UK DPA 2018, identifying opportunities to use technology to reduce the compliance tax on delivery teams.
• Security Culture: Drive the security awareness strategy, using data and simulations to promote a strong culture across all Tribes and functions.
• Governance Oversight: Support the Digital Operations Risk Forum by providing high-quality, automated reporting on KRIs, control effectiveness, and risk remediation progress.
• Policy & Guardrails: Maintain and evolve the Information Security Policy framework and Security Guardrails, ensuring they remain relevant for a modern, cloud-native technology stack.
• Audit Liaison: Act as the primary interface for internal and external audits, ensuring findings are tracked and remediation is evidenced through clear delivery links

What skills and experience will you have?

• Modern GRC Mindset: You don't just follow a checklist; you look for ways to automate and optimise. Experience using AI or LLMs to enhance risk or compliance workflows is a significant advantage.
• Risk Expert: You'll have a deep understanding of risk management frameworks (ISO27001, NIST CSF) and how to apply them practically in an agile, cloud-first (AWS/Azure) environment.
• Workflow Tooling Proficiency: You'll be highly proficient in using enterprise workflow tools for risk tracking and reporting; experience with advanced query languages and automation rules is preferred.
• Technical Fluency: You'll have enough technical depth to constructively challenge control operators and understand the nuances of cloud security, identity management, and encryption.
• Influencer & Partner: You'll have excellent communication skills with the ability to build relationships across Digital Operations, translating complex security risks into business impact.
• Problem Solver: You'll have a proactive approach to identifying gaps in evidence or traceability and the drive to fix them.
• Leadership: You'll have a proven ability to coach and develop a team of analysts, fostering a culture of continuous improvement and innovation.

What's in it for you?

• Hybrid working (1-2 days per week in the office)
• 24 days holiday (+ 8 bank holidays)
• Annual bonus scheme
• Enhanced maternity and adoption leave
• Company pension with up to 8% N Brown contribution
• Mental Health support both internally and externally, including access to our wellbeing champions and counselling services
• A range of financial wellbeing support
• Stream - a financial wellbeing tool that helps you track your pay, access earnings early and manage your money with confidence
• Colleague discount across all N Brown brands
• Onsite café with subsidised rates and local restaurant discounts!
• Life Assurance and Private Medical Insurance
• Paid volunteer time - all our colleagues can take a full day paid to volunteer for a charity of their choice

N Brown - who we are and why work for us?

N Brown is a leading UK digital retail platform for clothing, footwear, home and technology, headquartered in Manchester and employing over 1,000 people nationwide. Through our strategic retail brands JD Williams, Jacamo and Simply Be and our unique payments offering, we exist to champion inclusivity and serve the underserved. Our customers are our passion, and we take great pride in delivering products that ensure they can look and feel amazing, without compromising on choice, value and accessibility.

We're committed to building a diverse workforce and creating an inclusive environment that values equality for all. Our vision is that by 'By championing inclusion, N Brown will become the UK's most loved and trusted consumer platform, shaping the future of financial empowerment and personal expression'. 'Diversity, Equity, Inclusion and Belonging are, therefore, at the heart of our culture.

In May 2024 we were delighted to be named one of The Sunday Times Best Places to Work 2024. We work hard to create a happy and inclusive culture for everyone and we're so proud to have made this list - as voted for by our very own colleagues!

Ways of Working

We offer hybrid working which varies across the business depending on the role you're in. Our Head Office is located in the Northern Quarter in Manchester City Centre. So if you are travelling by train, tram or bus we're perfectly located, plus we're surrounded by cool cafes, trendy bars and the best places to eat!

Our working hours are 36.17 per week over 5 days.

We believe AI will become a standard part of modern professional practice. We are therefore looking for individuals who are open to learning, testing, and responsibly adopting AI tools to improve efficiency, insight, and impact in their role.

Our promise to you:

We're an equal opportunity employer and value diversity. We do not discriminate based on race, religion, colour, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status, or disability status.