Governance, Risk and Compliance (GRC) Professional

As our Governance, Risk and Compliance (GRC) professional, you’ll take ownership of core GRC activities and play a leading role in shaping and improving our approach to governance, risk, and compliance across the business.

You’ll work closely with teams across the organisation to help them understand, meet, and demonstrate compliance requirements in a practical and proportionate way. Our compliance landscape is varied, covering UK legislation and regulation, UK government commercial and contractual requirements, MOD security standards, Cyber Essentials Plus, ISO 27001, ISO 9001, ISO 20000-1, and ISO 14001.

Working alongside an experienced Information Security Manager, who will provide specialist cyber security expertise, and other business leads, you’ll bring the GRC knowledge and perspective needed to ensure we meet our obligations, manage risk effectively, and maintain clear evidence of compliance for internal and external stakeholders.

Responsibilities

• Own the day-to-day operation, maintenance, and continuous improvement of the organisation’s governance and compliance activities, including ISO-certified management systems.
• Plan and conduct internal audits and other assurance activities.
• Lead the coordination of external certification audits and compliance assessments, including those relating to ISO-certified management systems.
• Ensure the appropriate records and evidence are in place to demonstrate compliance, identifying gaps and driving corrective actions where needed.
• Produce clear, meaningful compliance reports for senior leadership.
• Coordinate and collaborate with stakeholders across the organisation to ensure risks are managed effectively, share requirements, gather information, coordinate governance and compliance activities, and drive agreed actions through to completion.
• With support from subject matter experts, maintain an overview of existing and emerging regulatory, contractual, and industry requirements, helping to coordinate the organisation’s response where changes are needed.
• Act as a trusted point of contact for GRC across the business, providing practical advice and guidance and helping teams understand what requirements mean for them.
• Proactively identify opportunities to strengthen or simplify the organisation’s GRC approach, bringing forward ideas and taking ownership of improvements through to implementation.

Key Skills

• Demonstrable experience in governance, compliance, risk, assurance, auditing, or closely related roles.
• Practical experience supporting or maintaining one or more ISO-certified management systems.
• A good understanding of governance, risk, and compliance principles, including practical risk management.
• Ability to apply a pragmatic and proportionate approach to governance and compliance, balancing requirements and best practice with practical realities, resources, and risk profile of a growing organisation.
• Experience maintaining policies, processes, registers, or other controlled documentation.
• Experience conducting or supporting internal audits, compliance reviews, or other assurance activities.
• Strong verbal and written communication skills, with the ability to tailor communications to different audiences.
• Highly organised and proactive, with the ability to manage multiple activities and deadlines, engage effectively with stakeholders, and ensure others follow through on agreed actions.
• Experience interpreting compliance requirements and translating them into practical actions for the business.
• Confidence using a range of digital tools and systems, with the ability to quickly get to grips with new technology and find effective ways to use it in your work. We currently use Jira and Confluence for work planning, knowledge sharing, and collaboration.
• Ability to work effectively remotely and in a flexible, agile environment.

Desirable Skills

• Practical experience supporting or maintaining ISO 9001.
• Experience coordinating surveillance, recertification, or certification audits for ISO-certified management systems.
• Experience supporting compliance with UK government commercial or contractual requirements.
• Internal auditor training.
• Delivery or project management experience and training.
• Experience developing compliance reports, metrics, or dashboards.
• Proficiency with the Atlassian suite, particularly Jira.