Security GRC Manager

Teya; Greater London; On-site; GBP 90,000 - 130,000; Full time

Benefits offered by this job

Flexible working hours

WellHub fitness & wellbeing benefits

Enhanced parental leave

Cycle-to-Work Scheme

Health and Life Insurance

Pension Scheme

25 days annual leave

Office snacks

Job summary

Teya, a regulated payments fintech serving local businesses across Europe, is hiring a Security GRC Manager in London. You will lead the Security GRC team, align policies with PCI DSS, SWIFT CSP, and ISO 27001, and drive regulatory compliance with UK authorities.

The role focuses on transforming governance into scalable, automated processes. Reporting to the CISO, you’ll partner with security engineering and procurement to improve evidence collection and audit readiness while shaping risk

Qualifications

• 7+ years in information security with GRC leadership in regulated financial services.
• Hands-on ownership of PCI DSS or equivalent programme, including QSA relationships.
• Experience with UK regulation, operational resilience and regulatory reviews.
• Track record designing and running security risk governance and third-party risk programmes.
• Experience automating assurance at scale with auditability.

Responsibilities

• Lead the Security GRC team with sprint cadence and manage roadmap vs unplanned demand.
• Represent GRC to auditors, regulators and senior stakeholders.
• Own UK regulatory coverage including resilience and FCA expectations.
• Develop a unified ISMS control set across frameworks.
• Maintain the risk methodology, scenario library and risk register.
• Coordinate third-party assessments with Procurement, Privacy and Legal.
• Plan audits and lead PCI DSS and SWIFT CSP assessments.
• Maintain consolidated findings and automate evidence review.
• Oversee access controls and change procedures.
• Report metrics and audit status to Security leadership.

Skills

GRC leadership

Regulatory knowledge

Information security

Communication

Vendor management

Auditing

Regulatory alignment

Tools

QSA relationship

ISO 27001

SWIFT CSP

Vanta

Job description

Hello. We’re Teya.

Teya was founded on a simple belief: local businesses deserve better.

They are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business.

Teya exists to change that.

We’re building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work.

We move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand.

If you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we’d love to hear from you

Your mission

Teya is a regulated payments fintech serving small businesses across Europe. Security, audit and regulatory trust are what keep our licences, card-scheme access and market access. Security at Teya is three connected teams: Security Engineering builds and runs technical controls, Security Operations runs monitoring and incident response, and Security GRC owns policy, risk and regulatory alignment.

As Security GRC Manager, reporting to the CISO, you will lead a team of three that turns PCI DSS, SWIFT CSP, ISO 27001, PCI PIN, PCI MPoC and UK and EU regulation into clear, engineer-able and increasingly automated ways of working. The function is mid-transformation. Vanta is being rolled out, the risk approach is being redefined, findings are being consolidated and third-party risk is being rebuilt with Procurement. Your job is to finish that shift, make it stick, and make GRC an accelerator for engineering rather than a toll gate. For the next two to three years, the priority is PCI DSS and SWIFT CSP excellence, built to scale towards the expectations of a regulated UK and European financial entity.

Responsibilities

• Lead and develop the Security GRC team, running a two-week sprint cadence and balancing roadmap work against heavy unplanned demand

• Represent Security GRC to auditors, assessors, regulators, the CISO and senior stakeholders

• Lead UK regulatory coverage, including operational resilience and FCA expectations, partnering with the team’s GRC Lead for EU regulation and DORA

• Own the ISMS policies and build one mapped control set across all frameworks, so teams get one evidence request instead of several

• Own the security risk methodology, scenario library and risk register, working with 2nd-line Risk and the OpRes and DORA programmes

• Run third-party security assessments with Procurement, Privacy and Legal, including the exceptions and risk acceptance path

• Plan the annual audit programme and lead PCI DSS (with the QSA) and SWIFT CSP assessments

• Own the consolidated findings register so issues are closed, not re-raised audit after audit

• Make Vanta the source of truth for evidence and lead governed automation of control assurance, including AI-assisted evidence review with named human owners

• Own the Significant Change procedure for PCI-scoped changes and oversee access and joiner-mover-leaver controls

• Report GRC metrics, risks and audit status to Security leadership

Requirements

• 7+ years in information security, with substantial GRC leadership in regulated financial services; UK banking or payments strongly preferred

• Hands-on ownership of a PCI DSS or equivalent programme, including the QSA relationship and Report on Compliance end to end

• Experience of UK regulation, including operational resilience, and ideally a regulatory authorisation or supervisory review

• A track record of designing and running a security risk register, governance forum and third-party security risk programme

• Experience automating assurance at scale, with human accountability and auditability built in

• Enough technical depth in infrastructure, cloud, identity and network controls to challenge evidence and work credibly with engineers

• Clear, plain-language communication with engineers, executives, auditors and regulators

• A partner mindset: you advise, enable and persuade rather than block

• Experience with SWIFT CSP, PCI PIN, PCI MPoC, ISO 27001, DORA or Vanta is a plus

Perks

• We trust you, so we offer flexible working hours, as long as it suits both you and your team.

• Physical and mental health support through our partnership with WellHub, giving free access to over 1,500 gyms in the UK, 1-1 therapy, meditation sessions, and digital fitness and nutrition apps.

• Our company offers extended and improved maternity and paternity leave choices, giving employees more flexibility and support.

• Cycle-to-Work Scheme.

• Health and Life Insurance.

• Pension Scheme.

• 25 days of Annual Leave (plus Bank Holidays).

• Office snacks every day.

• Friendly, comfortable, and informal office environment in Central London.

Teya is proud to be an equal opportunity employer.

We are committed to creating an inclusive environment where everyone regardless of race, ethnicity, gender identity or expression, sexual orientation, age, disability, religion, or background can thrive and do their best work. We believe that a diverse team leads to better ideas, stronger outcomes, and a more supportive workplace for all.

If you require any reasonable adjustments at any stage of the recruitment process whether for interviews, assessments, or other parts of the application—we encourage you to let us know. We are committed to ensuring that every candidate has a fair and accessible experience with us.