Governance, Risk & Compliance Lead

About the role

The GRC Lead provides leadership and a single point of accountability for governance, risk, compliance, certification and continual improvement across management systems. The role maintains an integrated framework covering ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and other approved legal, regulatory, contractual, client or compliance requirements.

Key responsibilities

• Maintain an effective governance framework with clear roles, responsibilities and decision authority.
• Maintain an integrated management system for QMS, ISMS, PIMS, AIMS and other adopted systems.
• Maintain the risk management methodology, risk registers, risk ownership, treatment plans and target dates.
• Maintain and monitor the register of legal, regulatory, contractual, client and internal compliance obligations.
• Oversee document control, controlled-document and record registers, retention requirements and management-system change impacts.
• Plan and deliver a risk-based quarterly and annual audit programme using competent, impartial auditors.
• Coordinate certification, surveillance, recertification, transition, client and other external assurance audits.
• Oversee corrective actions from containment and root cause analysis through closure and effectiveness review.
• Provide compliance oversight for significant nonconformities, security or privacy incidents, breaches and control failures.
• Define and monitor compliance requirements for suppliers, vendors, contractors and service providers.
• Oversee governance of business continuity, disaster recovery and resilience reviews and tests.
• Plan and deliver the annual competence and awareness programme and maintain training records.
• Facilitate management reviews and provide GRC metrics, dashboards and reports for senior management.
• Prepare gap assessments, business cases, resource estimates and roadmaps for emerging standards, including certified ones.
• Coordinate AI governance risks, controls and obligations and support responsible use of AI.
• Respond to client assurance requests, coordinate evidence and maintain stakeholder relationships.
• Exercise independent access, challenge, approval, recommendation and escalation authority within approved confidentiality and access-control requirements.

Required profile

• At least 5 years of relevant experience in management systems, risk, compliance or assurance, including in a software or IT services environment.
• Experience coordinating certification or client audits is preferred.
• Lead Auditor or Lead Implementer certification for at least one management system standard adopted by KPS.
• Additional certification or training in risk management, privacy, information security, business continuity, AI governance or GRC is preferred.

Required skills

• Ability to interpret standards and compliance obligations independently and apply them practically and proportionately.
• Ability to plan and lead audits and communicate findings clearly using objective evidence.
• Proficiency in structured root cause analysis and corrective-action effectiveness review.
• Ability to assess quality, information security, privacy, business continuity and AI governance controls.
• Ability to facilitate management reviews, risk workshops and cross-functional decision-making.
• Ability to build cooperation and influence stakeholders without relying on direct reporting authority.
• Good written and spoken English.