Governance, Risk, and Compliance Lead

The GRC Lead role offers a unique opportunity to provide leadership and accountability for governance, risk, compliance, certification, and continuous improvement across multiple management systems. This position is responsible for maintaining an integrated framework that encompasses ISO 9001, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, along with other relevant legal, regulatory, contractual, client, and compliance requirements. The role ensures that organizational processes align with these standards while driving ongoing enhancements to risk management and compliance practices.

Key Responsibilities

- Maintain an effective governance framework with clearly defined roles, responsibilities, and decision-making authority.
- Oversee the integrated management system covering Quality Management System (QMS), Information Security Management System (ISMS), Privacy Information Management System (PIMS), AI Management System (AIMS), and other adopted frameworks.
- Manage the risk methodology and organizational risk registers, ensuring risk ownership, treatment plans, and target dates are up to date.
- Maintain and monitor registers of legal, regulatory, contractual, client, and internal compliance obligations.
- Supervise document control processes, including controlled-document and record registers, retention requirements, and the impact of management system changes.
- Plan and execute a risk-based audit program on a quarterly and annual basis, utilizing competent and impartial auditors and objective evidence.
- Coordinate certification, surveillance, recertification, transition, client, and other external assurance audits.
- Oversee corrective actions from initial containment and root cause analysis through to closure and effectiveness review.
- Provide compliance oversight for significant nonconformities, security or privacy incidents, breaches, and control failures.
- Define and monitor compliance requirements for suppliers, vendors, contractors, and service providers.
- Provide governance oversight for business continuity, disaster recovery, and resilience reviews and tests.
- Plan and deliver annual competence and awareness programs, maintaining related training records.
- Facilitate management reviews and maintain clear GRC metrics, dashboards, and reports for senior management.
- Prepare gap assessments, business cases, resource estimates, and roadmaps for emerging and certified standards.
- Coordinate AI governance risks, controls, and obligations, supporting the responsible use of AI technologies.
- Respond to client assurance requests by coordinating accurate evidence and maintaining constructive stakeholder relationships.
- Exercise independent access, challenge, approval, recommendation, and escalation authority within approved confidentiality and access-control requirements.

Required Qualifications

- Lead Auditor or Lead Implementer certification for at least one management system standard relevant to the organization.
- A minimum of five years’ experience in management systems, risk, compliance, or assurance, preferably within software or IT services environments.
- Proven ability to interpret standards and compliance obligations independently and apply them practically and proportionately.
- Experience planning and leading audits, with strong skills in communicating findings clearly using objective evidence.
- Competence in designing and maintaining effective governance, risk, and compliance methodologies.
- Proficiency in structured root cause analysis and corrective-action effectiveness review.
- Ability to assess controls related to quality, information security, privacy, business continuity, and AI governance.
- Skilled at facilitating management reviews, risk workshops, and cross-functional decision-making.
- Strong interpersonal skills to build cooperation and influence stakeholders without direct reporting authority.
- Capability to prepare clear and objective reports for senior management while maintaining independence.
- Excellent written and spoken English communication skills.

Preferred Qualifications and Benefits

- Additional certifications or formal training in risk management, privacy, information security, business continuity, AI governance, or governance, risk, and compliance (GRC) are highly desirable.
- Experience coordinating certification or client audits is an advantage.

This role is ideal for a proactive professional who thrives in a dynamic environment and is committed to upholding high standards of governance and compliance while supporting organizational resilience and innovation.