Security GRC Manager

Hello. We’re Teya.

Teya was founded on a simple belief: local businesses deserve better.

They are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business.

Teya exists to change that.

We’re building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work.

We move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand.

If you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we’d love to hear from youYour mission

Teya is a regulated payments fintech serving small businesses across Europe. Security, audit and regulatory trust are what keep our licences, card-scheme access and market access. Security at Teya is three connected teams:
Security Engineering builds and runs technical controls, Security Operations runs monitoring and incident response, and Security GRC owns policy, risk and regulatory alignment.

As Security GRC Manager, reporting to the CISO, you will lead a team of three that turns PCI DSS, SWIFT CSP, ISO 27001, PCI PIN, PCI MPoC and UK and EU regulation into clear, engineer-able and increasingly automated ways of working. The function is mid-transformation. Vanta is being rolled out, the risk approach is being redefined, findings are being consolidated and third-party risk is being rebuilt with Procurement.

Your job is to finish that shift, make it stick, and make GRC an accelerator for engineering rather than a toll gate. For the next two to three years, the priority is PCI DSS and SWIFT CSP excellence, built to scale towards the expectations of a regulated UK and European financial entity.

Responsibilities Lead and develop the Security GRC team, running a two-week sprint cadence and balancing roadmap work against heavy unplanned demand

Represent Security GRC to auditors, assessors, regulators, the CISO and senior stakeholders

Lead UK regulatory coverage, including operational resilience and FCA expectations, partnering with the team’s GRC Lead for EU regulation and DORAOwn the ISMS policies and build one mapped control set across all frameworks, so teams get one evidence request instead of several

Own the security risk methodology, scenario library and risk register, working with 2nd-line Risk and the OpRes and DORA programmes

Run third-party security assessments with Procurement, Privacy and Legal, including the exceptions and risk acceptance path

Plan the annual audit programme and lead PCI DSS (with the QSA) and SWIFT CSP assessments

Own the consolidated findings register so issues are closed, not re-raised audit after audit

Make Vanta the source of truth for evidence and lead governed automation of control assurance, including AI-assisted evidence review with named human owners

Own the Significant Change procedure for PCI-scoped changes and oversee access and joiner-mover-leaver controls

Report GRC metrics, risks and audit status to Security leadership

Requirements7+ years in information security, with substantial GRC leadership in regulated financial services; UK banking or payments strongly preferred

Hands-on ownership of a PCI DSS or equivalent programme, including the QSA relationship and Report on Compliance end to end

Experience of UK regulation, including operational resilience, and ideally a regulatory…