Senior GRC Lead

Intent HQ | FT1000 fastest growing European business

. Operate the day-to-day ISO 27701, ISO 27001 and ISO 42001 management systems .

Posted 11/9/2026contractLondon • United KingdomSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing ISO 27701, ISO 27001, and ISO 42001 systems while ensuring compliance with UK GDPR and EU GDPR. Proficient in risk management, privacy controls, and collaboration across cross-functional teams to support audits and maintain data protection standards.

Highest-signal resume keywords

Operational GRC ExperienceISO 27001 ComplianceUK GDPR KnowledgePrivacy Impact Assessment (PIA)AI Governance Frameworks

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

ISO 27701 ManagementRisk Register MaintenanceControl FrameworksData Flow DocumentationPrivacy Controls ImplementationEvidence Collection for AuditsAI/ML Analytics AssessmentInformation Security Risk ManagementRemediation TrackingIndividual Rights Requests Handling

Soft Skills

Strong OrganisationAttention to DetailClear Written CommunicationFollow-Up ConfidenceCollaboration

Tools & Technologies

GRC Calendar ManagementData Analytics ToolsPrivacy Management SoftwareAudit Management SystemsControl Testing Tools

Certifications & Qualifications

CIPP/ECIPMISO 27001 Lead ImplementerISO 27701 Lead ImplementerCISMCRISCCISSP

Industry Keywords

Information SecurityPrivacy Risk ManagementAI GovernanceSaaS EnvironmentsData Protection Act 2018Data (Use and Access) Act 2025EU AI ActEmerging Technology RiskControl TestingVendor Risk Management

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Operate the day-to-day ISO 27701, ISO 27001 and ISO 42001 management systems
Maintain the risk register, Statement of Applicability, control register and integrated control mappings
Identify, assess and record information security, privacy and AI risks across products, services and client implementations
Escalate risks to the VP of InfoSec & Privacy Operations
Maintain the GRC calendar, including scheduled reviews, control tests, policy review dates and audit milestones
Prepare management review inputs, including metrics, open actions and control status
Operate privacy controls where personal data is processed, analysed, inferred or enriched using AI and advanced analytics
Implement, test, monitor and evidence established privacy and AI governance frameworks
Work alongside the independent DPO
Collaborate with Product, Engineering, Data, Legal, Security and Customer Success teams
Document data flows and track remediation with engineering and data teams
Support audits and management systems in real business and client-facing environments

Requirements

What you’ll need

3–5 years of hands-on operational GRC experience
Exposure across information security, privacy and AI or emerging technology risk
Working knowledge of UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and EU GDPR
Hands-on experience running PIAs/DPIAs for analytics or data-driven products
Experience handling individual rights requests
Experience operating controls, collecting evidence and supporting audits against ISO 27001 and/or ISO 27701
Experience maintaining risk registers, control frameworks and remediation trackers
Experience working with engineering and data teams to document data flows and track remediation
Experience in a technology, SaaS, AI, data analytics or cloud-based business
Able to follow complex data flows, transformations and AI/ML or agentic analytics pipelines sufficiently to assess privacy and security controls
Understanding of inference, aggregation and re-identification risk in multi-client environments
Knowledge of UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, EU GDPR and other international data protection regimes
Knowledge of ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001
Knowledge of AI governance and responsible AI frameworks, including the EU AI Act
Knowledge of information security risk management in cloud and SaaS environments
Knowledge of privacy impact assessment, individual rights handling and vendor risk management
Strong organisation, tracking, follow-up and attention to detail
Clear written communication for concise, evidence-based assessments, findings and status reports
Confident following up with control owners and escalating issues
Preferred but not mandatory: CIPP/E, CIPM, ISO 27001/ISO 27701 Lead Implementer or Lead Auditor, ISO 42001 Lead Implementer or Lead Auditor, CISM, CRISC or CISSP

Benefits

Comp & perks

Hybrid working: based in the London office 2–3 days per week and the rest of the week remote
Flexible working
Private medical insurance, depending on eligibility
Free breakfast daily when in the office
26 days holiday, increasing with service
Pension scheme
Income Protection with Employee Assistance Programme
Life Assurance
Higher than statutory maternity/paternity benefits
Work socials
Wellbeing programme
Cycle to work scheme
Training opportunities
Personal development opportunities
Family-friendly approach