Information Technology Governance Manager

Waterstones; Greater London; Hybrid; GBP 70,000 - 110,000; Full time

Job summary

Waterstones seeks a senior IT governance and compliance leader to drive control frameworks and audit readiness across the group. You will manage risk, GDPR/data privacy controls, and regulatory alignment while collaborating across IT, Finance, Legal, and Business teams.

The role requires 5+ years in IT audit/governance in regulated environments with strong SOX, ITGC, and ISO27001 knowledge. Hybrid work with UK travel is expected.

Qualifications

• 5+ years in IT audit, controls, governance or compliance.
• Experience in regulated / FTSE or enterprise environments.
• Strong knowledge of SOX, ITGCs, ISO27001, COBIT, ITIL, NIST.

Responsibilities

• Lead IT control frameworks (SOX, ITGC, ISO27001, COBIT, ITIL, NIST).
• Run internal/external IT audits end-to-end with readiness, execution, remediation.
• Maintain SOX narratives, RACMs, and control docs.
• Manage IT risk register and perform risk assessments.
• Embed controls across change, access, incident, and operations.
• Lead user access reviews and enforce segregation of duties.
• Oversee GDPR-aligned data privacy controls and DPIAs.
• Maintain and test Incident Response Plan including tabletop exercises.
• Deliver executive reporting on risks, audits, and compliance posture.
• Monitor regulatory changes and update controls accordingly.
• Drive control automation and continuous improvement.
• Deliver security and compliance awareness activities.
• Partner with IT, InfoSec, Finance, Audit, Legal, and business stakeholders.
• Support NIS2 and UK/EU regulatory alignment where applicable.
• Implement and optimize GRC / control automation tooling.
• Own third-party / supplier assurance for technology risk.
• Define and report KPIs (audit findings, remediation SLAs, control effectiveness).
• Provide oversight on emerging risks including AI governance and new technologies.

Skills

IT governance

IT audit

Regulatory compliance

SOX

ISO27001

COBIT

ITIL

NIST

Education

Degree in IT or related field

Tools

GRC tooling

Job description

Hybrid Based in London with travel to Solihull and Burton Upon Trent Trent (3 days in the office / 2 days at home)

We are looking for someone to join us in this newly created role to lead IT governance, audit, risk, and compliance across the Waterstones group. The successful candidate will ensure strong IT controls, regulatory alignment, and a resilient, audit-ready control environment supporting secure and effective business operations.

What you will be doing

• Own and develop IT control frameworks (SOX, ITGC, ISO27001, COBIT, ITIL, NIST)
• Lead all internal and external IT audits end-to-end (readiness, execution, remediation)
• Maintain SOX narratives, RACMs, and control documentation
• Manage IT risk register and perform risk assessments
• Embed controls across change, access, incident, and operational processes
• Lead user access reviews and enforce segregation of duties
• Oversee GDPR-aligned data privacy controls and DPIAs
• Maintain and test Incident Response Plan (including tabletop exercises)
• Deliver executive reporting on risks, audits, and compliance posture
• Monitor regulatory changes and update controls accordingly
• Drive control automation and continuous improvement
• Deliver security and compliance awareness activities
• Partner with IT, InfoSec, Finance, Audit, Legal and business stakeholders
• Support NIS2 and UK/EU regulatory alignment where applicable
• Implement and optimise GRC / control automation tooling
• Own third-party / supplier assurance for technology risk
• Define and report KPIs (audit findings, remediation SLAs, control effectiveness)
• Provide oversight on emerging risks including AI governance and new technologies

What we need from you

• 5+ years in IT audit, controls, governance or compliance
• Experience in regulated / FTSE or enterprise environments
• Strong knowledge of SOX, ITGCs, ISO27001, COBIT, ITIL, NIST
• Audit management and control framework implementation experience
• Understanding of GDPR and data privacy requirementsDegree in IT, Information Systems or related field

Person Profile

• Self-starter with strong ownership mindset
• Strong stakeholder management and communication skills
• High attention to detail and analytical thinking
• Able to influence and embed controls across teams
• Organised and capable of managing multiple priorities

Why work for Waterstones

Waterstones is the cornerstone of bookselling across the UK and Ireland. Joining Waterstones means being an active part in a success story that began in 1982, and books are as popular now as the day we started.

Trading across the UK, Ireland and Europe, we are present in over 300 shopping locations, where Waterstones continues to thrive, each year actively pursuing a programme of new bookshop openings. Online at Waterstones.com, we meanwhile mirror the essence of our bookshops, further showcasing the unique enthusiasm and knowledge of our booksellers.

If you have the relevant essential experience and you are interested, we would love to hear from you.

Waterstones is committed to encouraging equity, diversity and inclusion in the workplace, and is dedicated toward eliminating unlawful discrimination.

Our aim is to be truly representative of all sections of society and our customers, and for each employee to feel fully respected and to be able to give their best.

Diversity Statement

At Waterstones, we are committed to creating a workplace that is fair and inclusive to people from all backgrounds, perspectives and experiences, and we strive to promote an inclusive work culture.

We are working hard to ensure our recruitment processes are free from bias, and our aim is to be truly representative of all sections of society and our customers, and for each employee to feel fully respected and able to give their best.

Reasonable Adjustments

We understand that some disabled applicants may, due to the nature of their disability, find some parts of the recruitment process challenging. If you need any reasonable adjustments during any part of the interview process, please make these known either to your interviewer or the person you liaise with when setting up your interview.