The Role: The successful candidate will oversee the firm's GRC group, supporting the Chief Information Security Officer (CISO) by planning, developing, and managing the information security program. The role entails ensuring compliance with regulatory and contractual obligations, maintaining governance standards, and enhancing security measures. The Director will act as the process owner for GRC-related projects and will contribute strategically and operationally to the firms overarching information security objectives. Key Responsibilities: Lead and manage the GRC team, defining operational strategies and driving performance. Oversee client audit processes, RFP responses, and internal IT audits. Ensure continual improvement of security frameworks and adherence to ISMS standards. Serve as the primary contact for GRC toolsets and processes, facilitating efficient service delivery. Work closely with business units and the legal team to ensure compliance with contracts and regulatory requirements. Support the CSIRT team and maintain situational awareness to protect the firm. Develop and manage the security awareness and training programs, including initiatives such as phishing tests. Oversee risk assessments, report on audit outcomes, and suggest improvements. Author and maintain policies, guidelines, and procedures to safeguard information. Mentor team members and foster a culture of performance excellence. Skills and Experience Required: Proven expertise in managing a GRC function within a complex organization. Comprehensive knowledge of information security frameworks such as NIST, ISO , and COBIT. Familiarity with regulatory requirements like GDPR, PCI-DSS, and HIPAA. Strong strategic thinking and communication skills, with the ability to present complex information clearly. Proficiency in using EGRC/ITGRC platforms. In-depth understanding of security controls and technical infrastructure, including SIEM, IDS, and log management. Demonstrated leadership and mentoring skills. Capacity to manage high-stress situations while maintaining composure. Skills: GRC Governance, risk, and compliance ISO 27001 ISO 27002 GDPR PCI-DSS