> Markdown version of [/jobs/ext/2450243-information-security-grc-lead](https://www.wearedevelopers.com/jobs/ext/2450243-information-security-grc-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security GRC Lead

- **Company:** RAC Motoring Services
- **Location:** Bradley Stoke, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cyber Security, PCI Data Security Standards, Phishing, Information Security Management System
- **Published:** August 27, 2026
- **Apply:** https://uk.indeed.com/viewjob?jk=9dd00281a202ba9a

## About the Role

* Proven experience leading Information Security Governance, Risk and Compliance programmes within a complex environment.
 * Strong hands-on expertise with ISO27001, ISMS management, risk management, audit delivery, policy governance and supplier assurance.
 * Experience designing and running human security risk or security awareness programmes.
 * A solid understanding of regulatory and operational resilience requirements, ideally within FCA, PRA or similarly regulated environments.
 * Relevant security qualifications such as CISSP, CISM, CISA or equivalent, alongside excellent stakeholder management and decision-making skills.

## Description

* Lead the design, operation and continuous improvement of the RAC's Information Security Governance, Risk and Compliance (GRC) framework.
 * Own and develop the Information Security Management System (ISMS), ensuring ongoing ISO27001 readiness, successful audits and continual improvement.
 * Design and manage the security risk management programme.
 * Operate and continuously improve the human security risk programme - including phishing simulation, security awareness, and behavioural risk monitoring - translating data from platforms such as CultureAI into measurable risk reduction and executive reporting.
 * Lead internal and external audits, coordinating evidence, managing findings and working with auditors, regulators and stakeholders.
 * Oversee the security policy framework, ensuring policies remain relevant and effective.
 * Drive the human security risk programme, including security awareness, phishing simulations and behavioural risk monitoring.
 * Act as the primary Information Security contact for PCI compliance, leading annual compliance activities and external engagement.
 * Embed security requirements into supplier onboarding, due diligence, contract reviews and renewal processes.
 * Deliver supplier assurance and customer security questionnaires.
 * Identify opportunities to leverage automation and AI to improve efficiency, consistency and reporting across GRC activities.


## Related Videos

- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [GitOps keeps focus on apps, not on infrastructure](https://www.wearedevelopers.com/videos/182-gitops-keeps-focus-on-apps-not-on-infrastructure)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Building Security Champions](https://www.wearedevelopers.com/magazine/87-building-security-champions)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Guide for Expats Living in the UK](https://www.wearedevelopers.com/magazine/355-guide-for-expats-living-in-the-uk)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk)