GRC Lead

Own and continually develop the global Information Security Management System (ISMS).

Assess information security risk and communicate key risks, requirements and priorities to senior management.

Develop and maintain the security compliance programme, including appropriate metrics and management review processes.

Lead and coordinate internal and external security audits, certifications and third-party assessors.

Develop, maintain and publish security strategies, policies, procedures and supporting documentation.

Drive identified GRC and security improvements through to completion across multiple concurrent workstreams.

Support global technology teams and regional offices with security policy implementation and country-specific information security documentation.

Own the security awareness programme, including culture-change initiatives, phishing simulation campaigns and third-party relationships.

Support governance of technology and business change, ensuring security requirements are understood and Embedded.

Strong experience in a senior GRC, security governance, information security risk or ISMS-focused role.

Proven experience developing, managing or materially owning an ISMS.

Strong working knowledge of ISO 27001/27002:2022.

Experience using risk frameworks such as ISO 27005 and/or ISO 31000.

Substantial experience leading or managing security audits, assessments and certification activity.

ISO 27001 Lead Implementer/Lead Auditor certification, or equivalent depth of security audit experience.

CISSP, CISM or equivalent security/GRC certification would be highly advantageous.

Excellent written and verbal communication, with the credibility to present risk and recommendations to senior stakeholders.

Highly organised and able to prioritise and deliver several projects or improvement initiatives simultaneously.

Strong documentation and policy-writing capability.

Experience working across geographically dispersed or international teams.

Legal or wider professional-services experience would be beneficial but is not essential.

A leading international law firm is looking for an experienced Governance, Risk and Compliance Lead to take ownership of its global Information Security Management System and wider information security governance framework. This is a senior, visible role with significant interaction across international offices and senior stakeholders.

The position is deliberately GRC-led rather than a hands-on cyber security engineering role. The successful candidate will own risk, compliance, audit, policy, security awareness and continuous improvement activity, while helping the business navigate security requirements in a pragmatic and commercial way.