GRC Lead

About us Risk Ledger is developing a network of connected organisations, all working together to defend against cybersecurity attacks in the supply chain. Organisations rely on us to establish trust, through sharing their security maturity and visualising the risks posed by their supply chain ecosystem. And we’re already trusted by customers like British Airways, BAE Systems and the NHS. We are putting together an amazing and talented team from a diverse set of backgrounds and skillsets to drive us towards our vision. Risk Ledger is built on the respect we have for one another and our users, united by our shared values and mission. Every one of us is still learning: it’s how we grow as individuals. We’re curious. We’re ambitious. And we’re humble and honest. At Risk Ledger, we aim high to find the best solutions we can and always put our users first. The team You'll join the Security & IT team, led by the Director of Information Security and IT Operations, which owns information security, IT operations and GRC across Risk Ledger in the UK and US. Risk Ledger helps security and risk teams manage third-party and supply chain risk, so our customers hold us to the same standard they hold their own suppliers to. Our own assurance is part of the product promise: we are ISO 27001 certified, hold Cyber Essentials Plus and have achieved SOC 2 Type 1. The team works closely with Engineering, Product, Sales, Customer Success, People and Finance, making security and compliance something that helps the business win and keep customers rather than slowing it down. This role As GRC Lead you'll own Risk Ledger's governance, risk and compliance work day to day: our certifications, our enterprise risk management, our policies, and the assurance we give customers. This is a hands-on role for someone who likes to do the work, not delegate it. There's no team to inherit. You'll be the person who keeps ISO 27001 running, takes us from SOC 2 Type 1 to Type 2, and owns the risk framework the leadership team relies on. It's a highly collaborative role: expect to spend around half your time working with people across the business, from engineers to Sales to leadership. You'll often be given a problem rather than a plan, so you'll be comfortable turning loose direction into something that works. Because GRC is what our customers do, you'll also get to feed your expertise into our product. In this role you will, • Run our certifications. Maintain our ISO 27001 ISMS year round and lead our external audits. Take us from SOC 2 Type 1 to Type 2 by building and maintaining the evidence, then keep SOC 2 running. • Own enterprise risk management. Own our enterprise risk management framework and risk register, run risk reviews with owners, and give the leadership team clear reporting on our risk posture. • Lead our compliance tooling. Manage our automated security and compliance software platform implementation, then help us move to an in-house solution within the year, so evidence collection is continuous rather than a scramble before each audit. • Support customer assurance. Help Sales and Customer Success answer security questionnaires and due diligence, so security reviews speed deals up rather than slowing them down. • Keep policies current. Keep our policies up to date, owned and followed, and support our own supplier risk programme using the Risk Ledger platform. Bring people with you. Work with control owners across the business, explaining why controls matter and getting things done through influence rather than authority. You'll have • At least 3 years' hands-on GRC experience. • Hands-on experience maintaining an ISO 27001 certification and working on SOC 2 audits from the organisation's side. Both are essential. • Experience in a star