Information Security GRC Lead

RAC; West of England; On-site; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Colleague Share Scheme (Owning It.Tog)

RAC Ultimate Breakdown Service

Car salary sacrifice scheme

25 days annual leave

Pension scheme with matched 6.5%

Life assurance up to 4x salary

24/7 confidential support

Orange Savings discount portal

Flexible schedules

Family leave

Job summary

RAC is seeking an experienced Information Security GRC Operations Lead to own and advance our Governance, Risk and Compliance function. You will shape security across the organisation, drive ISO27001 readiness, and lead human security initiatives, audits, and supplier assurance.

The role is hybrid, with 2 days in Bradley Stoke and 3 days remote, offering a dynamic team environment and opportunities to influence security culture across members and colleagues.

Qualifications

• Experience leading Information Security Governance, Risk and Compliance programmes within complex environments.
• Strong expertise with ISO27001, ISMS management, risk management, audit delivery and policy governance.
• Experience designing and running human security risk or security awareness programmes.
• Understanding of FCA/PRA or similar regulated environments and related requirements.

Responsibilities

• Lead design, operation and continuous improvement of the GRC framework.
• Own and develop the ISMS, ensuring ISO27001 readiness and audits.
• Design and manage the security risk management programme.
• Lead human security risk initiatives including phishing simulations and awareness campaigns.
• Coordinate internal and external audits, manage findings with auditors and regulators.
• Oversee the security policy framework and supplier assurance.
• Embed security requirements in supplier onboarding and contract processes.
• Drive automation and AI to improve GRC reporting and efficiency.

Skills

GRC governance

ISO27001

ISMS management

Risk management

Audit delivery

Policy governance

Supplier assurance

Security awareness

Human security risk

Regulatory compliance

Stakeholder management

Education

CISSP/CISM/CISA or equivalent

Job description

About The Role

We're looking for an experienced Information Security GRC Operations Lead to join our Information Security team on a permanent basis.

This is an opportunity to take ownership of the RAC's Information Security Governance, Risk and Compliance (GRC) function, shaping how security is embedded across the organisation and enabling us to move forward with confidence while protecting our members, colleagues and services.

A key part of the role will be leading and continuously enhancing our Human Security Risk Programme, helping to strengthen security culture across the business through phishing simulations, security awareness initiatives and behavioural risk monitoring.

You'll also lead the design and day-to-day operation of our Information Security Management System, risk management framework, audit programme, policy governance processes, drive ISO27001 certification activities and ensure security risks are understood, managed and reduced.

This is a highly visible role where you'll drive continuous improvement across our governance, risk and compliance activities, ensuring the RAC has the visibility, assurance and controls needed to confidently manage security risk.

This is a hybrid role, working 2 days a week from our Bradley Stoke office and 3 days a week from home offering flexibility while being part of a dynamic and supportive team.

We offer more than a job. We offer a career with purpose.

As anInformation Security GRC Operations Leadat RAC, you’ll get benefits that go the extra mile

• Earnings That Motivate – enjoy a competitive salary plus automatic enrolment in our ‘Owning It Together’ Colleague Share Scheme - a unique opportunity to share in RAC’s future success and be rewarded for the exceptional work you deliver.
• Tools to Drive Your Future – get started with a free RAC Ultimate Complete Breakdown Service from day one, plus access to a car salary sacrifice scheme (including electric vehicle options) after 12 months, delivering serious tax savings.
• Time Off That Matters – enjoy 25 days annual leave, plus bank holidays. We also support work-life balance with paid family leave, flexible schedules, and practical resources to help navigate personal commitments.
• Financial Security & Perks – pension scheme with up to 6.5% matched contributions alongside life assurance cover up to 4x salary (10x optional with flex benefits), designed to support you long-term.
• Wellbeing That Works for You – our 24/7 confidential support service is available to you and household members aged 16+, offering reassurance whenever you need it.
• Extras That Make a Difference - access Orange Savings, our exclusive discount portal with deals across top retailers, holidays, tools, tech and more. After passing probation, you’ll automatically join our Colleague Share Scheme, giving you a stake in our collective success.

What you’ll do

• Lead the design, operation and continuous improvement of the RAC's Information Security Governance, Risk and Compliance (GRC) framework.
• Own and develop the Information Security Management System (ISMS), ensuring ongoing ISO27001 readiness, successful audits and continual improvement.
• Design and manage the security risk management programme.
• Operate and continuously improve the human security risk programme - including phishing simulation, security awareness, and behavioural risk monitoring - translating data from platforms such as CultureAI into measurable risk reduction and executive reporting.
• Lead internal and external audits, coordinating evidence, managing findings and working with auditors, regulators and stakeholders.
• Oversee the security policy framework, ensuring policies remain relevant and effective.
• Drive the human security risk programme, including security awareness, phishing simulations and behavioural risk monitoring.
• Act as the primary Information Security contact for PCI compliance, leading annual compliance activities and external engagement.
• Embed security requirements into supplier onboarding, due diligence, contract reviews and renewal processes.
• Deliver supplier assurance and customer security questionnaires.
• Identify opportunities to leverage automation and AI to improve efficiency, consistency and reporting across GRC activities.

What you’ll need

• Proven experience leading Information Security Governance, Risk and Compliance programmes within a complex environment.
• Strong hands-on expertise with ISO27001, ISMS management, risk management, audit delivery, policy governance and supplier assurance.
• Experience designing and running human security risk or security awareness programmes.
• A solid understanding of regulatory and operational resilience requirements, ideally within FCA, PRA or similarly regulated environments.
• Relevant security qualifications such as CISSP, CISM, CISA or equivalent, alongside excellent stakeholder management and decision‑making skills.

Why RAC?

For more than 128 years, we’ve been keeping drivers moving, and today we’re trusted by over 15 million members. We’re also trusted by our people, with a 4.5-starGlassdoorrating showing that RAC is a place where support, ambition, and opportunity go hand in hand.

We welcome people from every background, value every voice, and back your growth every step of the way. At the RAC, you can bring your full self to work and we’ll be with you every step of the way to help you grow and develop your career.

Ready to make a difference? Your next career move starts here.