-
Job Description
Technology GRC Lead
Our Technology teams are at the heart of what we do, surrounded by industry specialists who bring their ideas to the business, shaping the customer experience as part of a forward-thinking team.
The Technology GRC Lead will report directly to the Head of Technology Risk & Compliance and oversee a small group of internal analysts and partner teams, supporting the Security & Risk function in delivering its requirements and obligations.
Key Responsibilities:
- Oversee and manage a portfolio of activities that are the responsibility of the internal analyst team and our 3rd party partners.
- Support the GRC Managers in developing processes and procedures that support the committed deliverables of the team.
- Support the continuous communication between assurance providers, such as External Audit (EA) and Internal Audit (IA), to ensure a holistic view of IT control activities and supports the coordination of the auditing process.
- Support the planning, coordination and testing of IT General Controls required to support management's controls attestations.
- Contribute effectively to the continuous development of the IT General Controls framework.
- Coordinate daily risk management processes, including triage of risks raised by the technology function.
- Support the discovery and baseline of IT dependencies in collaboration with the Internal Controls Team.
- Coordinate meetings with risk and control owners to review and drive the closure of open audit points and track the remediation of controls issues.
- Review, evaluate and document internal controls and design effectiveness testing and assessment.
Requirements:
- Proven practical experience and knowledge of IT control frameworks and best practice methodologies.
- Professional experience working in a highly regulated environment.
- Good understanding of assurance principles and methodologies.
- Basic understanding of the retail industry.
- Basic knowledge of IT governance frameworks, industry standards, and regulatory requirements.
- Experience in developing and testing of controls.
- Experience with COBIT, ISO 27001, NIST, GDPR requirements advantageous.
- Ability to translate complex regulatory language into clear and actionable IT requirements.
This role requires a strong understanding of IT control frameworks, assurance principles, and regulatory requirements. The ideal candidate will have experience working in a highly regulated environment and be able to translate complex regulatory language into clear and actionable IT requirements.