Governance, Risk & Compliance; GRC) Specialist

Home. There's no place like it. And there's no feeling like helping people create the joy of feeling truly  Dunelm, that's what we do. We're the UK's number one choice for homewares because we make home life lovelier for our customers. And we've crafted a workplace that feels just as welcoming – where you can bring your ideas, be yourself, and feel right at home.

We're a hybrid business, which means you'll have flexibility alongside time together with your team. In this role, you can expect minimum 1 day per week in our Leicester office.

We are seeking an experienced Governance, Risk & Compliance (GRC) Specialist to join our Information Security team within a FTSE 250 retail organisation. This role is responsible for developing, implementing and continually improving the organisation's cyber security governance, risk and compliance capabilities, ensuring alignment with business objectives, regulatory obligations and industry best practice.

Working collaboratively across technology, digital, retail operations, finance, legal, procurement, HR and other business functions, you will help strengthen the organisation's cyber security maturity, support regulatory compliance and embed security into everyday business processes.

The successful candidate will have a strong understanding of cyber security frameworks, governance principles and risk management, combined with excellent stakeholder management and communication skills.

• Develop, maintain and continually improve our Information Security Management System.
• Support and maintain compliance with:
  • NIST Cyber Security Framework (CSF) 2.0
  • PCI DSS
  • UK Data Protection Act 2018 and relevant EU data privacy legislation.
  • Other relevant regulatory and industry requirements such as Provision 29, Cyber Essentials and Cyber Essentials Plus.
• Coordinate internal and external security audits.
• Support evidence collection for compliance activities.
• Monitor emerging legislation and regulatory changes, assessing business impact.
• Support the implementation of security governance across all business functions.

• Administer the Cyber Security risk register toolset.
• Facilitate cyber risk assessments across projects, business initiatives and operational services.
• Support risk owners throughout the cyber security risk lifecycle.
• Enhance risk reporting for senior leadership and executive committees.

• Oversee the supplier cyber security assurance process.
• Conduct security assessments of suppliers, partners and third parties.
• Help to highlight supply chain risks and recommend appropriate mitigation.
• Track supplier security due diligence.
• Monitor ongoing supplier compliance throughout the contract lifecycle.

• Develop and maintain Information Security policies, standards, procedures and supporting guidance.
• Ensure documentation remains current, aligned with business objectives and regulatory requirements.
• Support governance forums and security steering committees.
• Produce reports for senior management and executive stakeholders.
• Assist in maintaining security exceptions and risk acceptance processes.

• Help develop cyber security awareness programmes.
• Contribute to phishing simulations and awareness campaigns.
• Review effectiveness of these measures through reporting and behavioural metrics.
• Promote a positive security culture across stores, support centres and digital teams.
• Support onboarding and annual security training programmes.

• Develop governance and compliance KPIs and KRIs.
• Administer metrics addressing:
  • Compliance status
  • Audit findings
  • Risk posture
  • Third‑party assurance
  • Policy compliance
  • Security…