- Own and support components of the global GRC programme, aligning them with ISO 27001, SOC 2, and applicable regulatory and contractual obligations.
- Lead enterprise and product-level risk assessments and track remediation with stakeholders.
- Support external audits and certifications by collecting evidence, conducting control walkthroughs, and coordinating with auditors.
- Develop, review, and maintain security policies, standards, and procedures.
- Validate control design and operating effectiveness, identify gaps, and drive remediation plans.
- Operate and improve the third-party risk management programme, including supplier assessments, due diligence, and ongoing monitoring of critical vendors.
- Track and report compliance metrics, audit findings, risk trends, and remediation progress.
- Partner with Engineering, Product, Privacy, Legal, People Team, and other business units to embed security and compliance requirements.
- Improve GRC processes, tooling, reporting, and visibility.
AWSGCPAzure