Expert, Information Security

Define a multi-year GRC roadmap aligned with business strategy, risk appetite and regulatory expectations, including readiness for DORA, audit strategy and control maturity targets.

Drive evolution of the control framework by rationalising controls, reducing duplication, and ensuring proportionality based on criticality, data sensitivity and business impact.

Establish guiding principles for governance, such as minimum control baselines, exception governance and evidence-by-design practices.

Advise leadership on material risk decisions, including risk acceptance, remediation prioritisation, control investments and scope decisions.

Produce executive-level outputs such as risk narratives, board/committee materials, and regulator or customer responses with defensible rationale.

Facilitate alignment among senior stakeholders when priorities conflict, such as delivery speed versus control rigor or cost versus assurance depth.

Own the strategy and approach for major audits and assurance activities, including ISO 27001, SOC 2, regulatory examinations and key client due diligence, including scope, positioning and negotiation.

Lead responses to complex audit or regulatory issues, including root-cause analysis, corrective action programs and verification of sustained effectiveness.

Act as subject matter expert for one or more domains depending on business needs, which may include: ISMS/ISO 27001 at scale across multiple entities with continuous compliance; DORA and operational resilience governance, including control mapping, ICT risk integration and testing oversight; third-party risk management for critical ICT providers, covering oversight models, ongoing monitoring and exit/continuity governance; and security control assurance, including testing program design, evidence standards and control health metrics.

Set standards and reusable artifacts such as control narratives, evidence templates, testing methodologies and playbooks.

Mentor specialists and associates, and help raise organisation-wide capability through coaching and review.

Partner with Security Engineering, IT and Compliance teams to embed controls into workflows, including policy-to-automation where possible.

Typically 7–10+ years of experience in information security GRC, audit/assurance, security risk, compliance, software engineering, and/or financial services risk roles.

A track record of owning complex, multi-stakeholder GRC programs and successfully navigating audits and regulatory scrutiny.

Deep working knowledge of ISO 27001 and DORA, along with strong familiarity with adjacent frameworks such as SOC 2, NIST CSF, BaIT and COBIT, including how to test and evidence controls.

Strong understanding of technology risk across cloud, identity and access management, SDLC governance, incident management, vulnerability management, logging/monitoring, and crypto/fintech operational processes as relevant.

Ability to influence across the organisation and resolve conflicts using a risk-based, outcome-oriented approach.