Strategic Information Security Risk & GRC Lead

twentyAI; England; On-site; GBP 70,000 - 100,000; Full time

Job summary

twentyAI is seeking an information security risk lead to own a broad risk area, engaging with senior stakeholders across the business to ensure risk is understood, assessed, and managed proportionately.

You will influence governance, policy, audits, and resilience, translating technical alerts into business-focused recommendations while maintaining autonomy and a visible presence at board level.

Qualifications

• Strong experience in information security risk, GRC, or second line security.
• Ability to engage senior stakeholders and challenge constructively.
• Calm, measured approach to cut through noise.
• Autonomous, taking ownership without close management.
• Strong business-focused communication on security risks.
• Experience in risk, policy, audit, controls, governance, or related disciplines.
• CISSP and broader GRC qualifications are helpful.

Responsibilities

• Lead from a second line / GRC perspective focusing on risk, policy, control effectiveness, governance, and regulatory alignment.
• Assess security issues in terms of business impact, risk appetite, and resilience.
• Collaborate with heads of department and senior leadership.
• Translate incidents and vendor alerts into clear, business-oriented recommendations.
• Support risk assessments, audits, policy and procedure development, and operational resilience.
• Contribute to a small team with board and executive exposure.

Skills

InfoSec risk

GRC

Stakeholder mgmt

Policy development

Governance

Audit

Third-party risk

Operational resilience

Calm demeanor

Business risk language

Education

CISSP or equivalent

Job description

twentyAI is seeking an information security risk lead to own a broad risk area, engaging with senior stakeholders across the business to ensure risk is understood, assessed, and managed proportionately.

You will influence governance, policy, audits, and resilience, translating technical alerts into business-focused recommendations while maintaining autonomy and a visible presence at board level.