Information Security Governance, Risk and Compliance Lead

Overview

Lead the Information Security GRC function to modernise risk and compliance at N Brown. You will drive a data-driven, AI-supported GRC program that covers policy, risk management, third‑party assurance and regulatory compliance. You’ll manage a team of GRC analysts in a cloud-first Digital Operations environment, delivering automated risk reporting and evidence-based control testing. This role combines governance with business impact, shaping security culture and audit readiness across Tribes and functions.

Pay / Benefits

• Hybrid working
• Annual bonus
• Company pension with up to 8% contribution
• Mental health support
• Colleague discount across all N Brown brands
• Private Medical Insurance

Responsibilities

• AI & Automation: implement AI-driven tools to automate GRC tasks such as mapping controls to regimes and summarising audit evidence
• Risk Management: own end-to-end risk lifecycle with evidence-based assessments
• Third-Party Assurance: oversee risk-based due diligence for the supply chain with automation
• Control Excellence: define, test, and mature key controls with clear assurance activity
• Regulatory Compliance: maintain PCI DSS, GDPR, UK DPA 2018 posture and leverage tech to reduce compliance burden
• Security Culture: drive security awareness using data and simulations across the organisation
• Governance Oversight: provide automated KRIs, control effectiveness, and remediation progress reporting
• Policy & Guardrails: evolve Information Security Policy framework and Security Guardrails for a cloud-native stack
• Audit Liaison: act as primary interface for internal/external audits with traceable remediation links

Key requirements

• Modern GRC mindset with a drive to automate and optimise
• Experience with AI or LLMs to enhance risk/compliance workflows (advantage)
• Deep risk management knowledge (ISO27001, NIST CSF) in agile cloud-first (AWS/Azure)
• Proficiency with enterprise workflow tools and automation rules
• Technical fluency to challenge control operators and understand cloud security, identity management, encryption
• Strong communication to translate security risks into business impact
• Proven leadership in coaching and developing a team of analysts

• Communication
• Relationship building across Digital Operations
• Proactive problem solving
• AI/LLMs for risk and compliance
• ISO27001 and NIST CSF frameworks
• AWS/Azure cloud environments

…