Information Security Governance, Risk and Compliance Lead

The Info Sec Governance, Risk and Compliance team is the engine room for N Brown's security posture, ensuring we protect what matters and enable what's next. They are responsible for the development and rollout of our security policies; building a high-impact awareness programme; and ensuring they meet our regulatory obligations, including PCI DSS and GDPR.

As the GRC Lead, you will be at the forefront of modernising our approach-moving away from manual, static processes toward a data-driven, intelligence-led function. You will lead a team of GRC analysts to manage the risk lifecycle, integrate security into our shift left delivery culture, and pioneer the use of AI to automate control testing and risk reporting. Reporting to the Head of Cyber Security & Risk, you will strike the balance between robust governance and the agility needed for a cloud-first Digital Operations environment.

• AI & Automation: Lead the implementation of AI-driven tools to automate routine GRC tasks, such as mapping controls to regulatory frameworks, summarising audit evidence, and optimising the risk intake process.
• Risk Management: Own the end-to-end risk lifecycle, ensuring business and technical risks are accurately assessed, evidenced, and reviewed in line with the Digital Operations Risk Forum requirements.
• Third-Party Assurance: Oversee risk-based security due diligence for the supply chain, using automation to streamline initial assessments and periodic re-reviews.
• Control Excellence: Work with Control Owners and Operators to define, test, and mature key controls, ensuring they are evidenced through clear delivery and assurance activity.
• Regulatory Compliance: Maintain N Brown's compliance posture for PCI DSS, GDPR, and UK DPA 2018, identifying opportunities to use technology to reduce the compliance tax on delivery teams.
• Security Culture: Drive the security awareness strategy, using data and simulations to promote a strong culture across all Tribes and functions.
• Governance Oversight: Support the Digital Operations Risk Forum by providing high-quality, automated reporting on KRIs, control effectiveness, and risk remediation progress.
• Policy & Guardrails: Maintain and evolve the Information Security Policy framework and Security Guardrails, ensuring they remain relevant for a modern, cloud-native technology stack.
• Audit Liaison: Act as the primary interface for internal and external audits, ensuring findings are tracked and remediation is evidenced through clear delivery links

• Modern GRC Mindset: You don't just follow a checklist; you look for ways to automate and optimise. Experience using AI or LLMs to enhance risk or compliance workflows is a significant advantage.
• Risk Expert: You'll have a deep understanding of risk management frameworks (ISO
  27001, NIST CSF) and how to apply them practically in an agile, cloud-first (AWS/Azure) environment.
• Workflow Tooling Proficiency: You'll be highly proficient in using enterprise workflow tools for risk tracking and reporting; experience with advanced query languages and automation rules is preferred.
• Technical Fluency: You'll have enough technical depth to constructively challenge control operators and understand the nuances of cloud security, identity management, and encryption.
• Influencer & Partner: You'll have excellent communication skills with the ability to build relationships across Digital Operations, translating complex security risks into business impact.
• Problem Solver: You'll have a proactive approach to identifying…