Governance Risk and Compliance Manager

Manchester | Hybrid – 3 days per week in the office
£60,000–£70,000

We’re looking for a Governance, Risk & Compliance Manager to take ownership of our Group governance, risk and compliance framework and help us continue to strengthen how we manage risk as the business evolves.

This is a broad role with the opportunity to shape how governance operates across the organisation. You’ll work across operational and commercial risk, compliance, data protection, data governance, regulatory change and assurance, partnering with senior leaders and teams across the Group.

It’s not a traditional Legal or CyberGRC role; we’re looking for someone who can take regulatory and governance requirements and turn them into practical frameworks, controls and ways of working that protect the business without creating unnecessary complexity.

You’ll be responsible for the Group’s Governance, Risk & Compliance framework, with a varied remit including:

• Owning and continually developing our Group Governance and Risk Management frameworks.
• Managing the Group risk register, working with business leaders to identify, assess and mitigate operational, commercial, regulatory, technology and data risks.
• Developing a risk-based assurance programme and carrying out control testing to make sure key controls are working effectively in practice.
• Acting as the Group Data Protection and Data Governance Lead, owning the operational privacy framework and working closely with our DPO.
• Owning our Data Governance Framework, including master data governance, data ownership, data quality standards and controls.
• Coordinating regulatory horizon scanning and producing quarterly impact assessments so upcoming regulatory changes are understood and acted on.
• Working with our Security function to provide governance and oversight of information security risk, policies and controls.
• Owning the Group governance calendar, ensuring audits, policy reviews, risk reviews, mandatory training and other key governance activities happen when they should.
• Working with Business Transformation and L&D to develop annual training across areas such as Data Protection, Information Security, Governance and Risk Management.
• Leading governance and compliance projects, including regulatory change, due diligence and implementation of new governance technology.
• Leading our Governance & Compliance function and continuing to improve our approach to placement compliance and operational controls.
• Developing meaningful risk and compliance dashboards and providing regular reporting and insight to Executive Leadership and the Board.

The role builds on the assurance, regulatory change, reporting and compliance responsibilities already established within the function.

We’re looking for someone with a strong governance, risk or compliance background who is comfortable working across a broad remit and can apply good governance in a practical commercial environment.

• Strong experience within governance, risk, compliance, operational risk or a related discipline.
• Experience developing and embedding governance, risk or compliance frameworks.
• Good understanding of UK GDPR, data protection and privacy governance.
• Experience of assurance, auditing or control testing.
• Strong understanding of operational and commercial risk management.
• Experience managing risk registers, remediation actions and compliance reporting.
• Good understanding of information security governance.
• Confidence working with senior stakeholders and providing constructive challenge.
• Strong analytical skills and the ability to turn complex requirements into practical business processes and controls.
• Experience producing risk and compliance reporting.
• Strong communication and stakeholder management skills.

Experience with in recruitment, staffing or professional services would be particularly useful, especially an understanding of the operational, contractual and compliance risks associated with recruitment businesses.

Experience of data governance, master data management, ISO 27001/ISMS, Cyber Essentials or regulatory change would also be advantageous, but we wouldn’t expect someone to already be an expert…