Head of Cyber Governance, Risk and Compliance (GRC)

About the role

The Head of Cyber Governance, Risk and Compliance (GRC) leads the IT GRC team and serves as the central coordination point for internal and external audits, regulatory engagements and overall risk and control activities within the enterprise risk management framework.

Key responsibilities

• Govern the first‑line (1LOD) control environment, ensuring compliance with second‑line (2LOD) policies and providing independent reporting on risk posture and control performance.
• Define, maintain and lifecycle‑manage 1LOD security standards, baselines and control procedures aligned with 2LOD policies.
• Coordinate and execute 1LOD Risk and Control Self‑Assessments (RCSAs), including risk assessment, control validation and thematic reviews.
• Maintain the 1LOD cyber risk register, track treatment plans and oversee the control library & attestation process.
• Provide regulatory intelligence, interpret changes and advise the 1LOD on compliance readiness.

Required profile

• 10+ years in IT/cyber GRC, IT audit or security management within financial services.
• Minimum 4 years leading GRC functions and experience with enterprise risk management frameworks.
• Bachelor’s degree in Information Systems, Computer Science or related field; Master’s preferred.
• Relevant certifications such as CISA, CISM or CRISC required.

Required skills

• Experience with GRC platforms.
• Strong knowledge of enterprise risk management and control frameworks.