Governance, Risk & Compliance Lead

About the role

The GRC Lead provides leadership and single‑point accountability for governance, risk, compliance, certification and continual improvement across multiple management systems. This role ensures an integrated framework covering ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and other legal, regulatory and contractual requirements.

Key responsibilities

• Maintain an effective governance framework with clear roles, responsibilities and decision authority.
• Integrate and manage QMS, ISMS, PIMS, AIMS and other adopted management systems.
• Maintain risk management methodology, risk registers, ownership, treatment plans and target dates.
• Oversee document control, record registers, retention requirements and change impacts.
• Plan and deliver risk‑based quarterly and annual audit programmes using impartial auditors.
• Coordinate certification, surveillance, recertification and client assurance audits.
• Manage corrective actions from root‑cause analysis through closure and effectiveness review.
• Provide compliance oversight for significant non‑conformities, security or privacy incidents and control failures.
• Define and monitor compliance requirements for suppliers, vendors and contractors.
• Govern business continuity, disaster recovery and resilience reviews and tests.

Required profile

• Lead Auditor or Lead Implementer certification for at least one management system adopted by the organization.
• Minimum 5 years of experience in management systems, risk, compliance or assurance, preferably in a software/IT services environment.
• Proven ability to interpret standards independently and apply them proportionately.
• Strong capability to plan and lead audits, communicate findings with objective evidence and influence stakeholders without direct authority.
• Excellent written and spoken English communication skills.

Required skills

• Lead Auditor / Lead Implementer certification (ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 or similar).
• Formal training or certification in risk management, privacy, information security, business continuity, AI governance or GRC (preferred).
• Proficiency in structured root‑cause analysis and corrective‑action effectiveness review.
• Ability to assess quality, information security, privacy, business continuity and AI governance controls.