Information Security GRC Lead - Ageas

Job Title : Information Security GRC Lead Target Start Date: ASAP Contract Type: Permanent, Part Time, Full Time, Job Share option available Salary Range: Up to £105,000 Location: Eastleigh, hybrid Closing Date for applications: Friday 14th August

Information Security GRC Lead: The Governance, Risk and Compliance (GRC) Lead is a senior leadership role within the Information Security function, responsible for defining, operating, and continuously improving the organisation’s security governance, risk management, and compliance capabilities. Reporting directly to the CISO, the role ensures that information security risks are identified, assessed, managed, and reported in line with organisational risk appetite, regulatory obligations, and industry best practice. The role provides authoritative oversight of security compliance frameworks, third‑party risk management, and human risk management, and ensures clear, high‑quality risk reporting to governance forums. The GRC Lead also plays a key role in modernising GRC practices through the use of automation and AI‑enabled tools, including AI agents to support risk assessments and security awareness programmes. Main Responsibilities as Information Security GRC Lead:

• Lead and manage the Information Security GRC function, ensuring effective governance, risk, and compliance across the organisation.
• Define and maintain the information security governance framework, policies, standards, and procedures.
• Own and oversee the implementation and ongoing maintenance of key compliance frameworks, including: ISO/IEC 27001, PCI DSS and Alignment with NIST and ISF frameworks.
• Lead and oversee security risk management, ensuring risks are identified, assessed, treated, and tracked through to resolution or acceptance.
• Manage the organisation's third party and supplier security risk assessment programme, including due diligence, ongoing assurance, and risk remediation.
• Lead the human risk management programme, including security awareness, behaviour change initiatives, and insider risk considerations.
• Drive the use of AI enabled capabilities within GRC, including: AI agents to support and streamline risk assessments, AI assisted analysis of control effectiveness and risk trends, and AI enhanced security awareness and training programmes.
• Oversee IT risk and controls management, ensuring alignment between technology risks, security controls, and enterprise risk management.
• Produce clear, accurate, and timely information security KRIs and KPIs, including trend analysis and risk insights.
• Provide high quality reporting for security governance forums, executive committees, and second line risk functions.
• Coordinate and support internal and external audits, certifications, and assurance activities.