Head of Governance, Risk and Compliance - CISO function

Job Description

The Head of GRC leads the pillar responsible for ensuring the organisation understands, manages, and can demonstrate compliance with its security risk and regulatory obligations. This includes owning the PCI DSS compliance programme, managing FCA and ICO regulatory engagement, maintaining the security risk register, and ensuring third-party risks are assessed and managed. The role bridges the gap between technical security delivery and regulatory/business expectations, translating the organisation’s declared risk appetite into measurable tolerances, control objectives, and compliance evidence. This is a critical leadership position that requires someone comfortable operating at both strategic and operational levels. The ideal candidate will have a financial services background, regulation expertise as well as practical experience and the credibility to engage effectively with the FCA, external auditors, and the QSA.

Job Responsibility

Own the security policy framework, ensuring policies are current, proportionate, and aligned to PCI DSS, FCA expectations, UK GDPR, and DORA requirements
Maintain and operate the security risk register, ensuring risks are assessed consistently using a defined methodology, owned explicitly, and reported accurately to the CISO and Executive Leadership Team (ETL)
Manage the relationship with external auditors, the Qualified Security Assessor (QSA), and 2nd/3rd Line of Defence (LoD) on all security and technology risk matters
Own the third-party security assurance process, ensuring all vendors, partners, and card scheme integrations are risk-assessed with a tiered approach proportionate to data access and criticality
Chair the monthly Cyber and Tech Risk and Controls Forum, presenting risk posture, compliance status, and material findings to the CISO, CIO and ELT
Design and maintain the control framework, mapping controls to PCI DSS, FCA, UK GDPR, and DORA requirements, and ensuring control effectiveness is tested on a continuous cycle
Produce KRI dashboards and risk reporting for CISO, CIO, and ELT consumption, ensuring risk is communicated in business terms
Lead regulatory and audit engagement on security matters, coordinating regulatory review and audit interactions and proactively managing stakeholder relationships
Own the risk assessment calendar, ensuring both cyclical and event-driven assessments are executed on schedule with appropriate rigour
Manage the risk acceptance process, ensuring risk acceptance decisions are documented, time-bound, approved at the appropriate authority level, and reviewed before expiry
Manage and develop the GRC team, building capability across risk assessment, compliance, and third-party assurance disciplines

Requirements

CISM, CRISC, or CISSP certification
Experience with DORA (Digital Operational Resilience Act) compliance requirements and implementation
ISO 27001 Lead Auditor or Lead Implementer certification
PCI QSA or Internal Security Assessor (ISA) qualification
Previous experience in FinTech, Digital Banking, Payment Acquiring organisation
Experience with Visa GACS and Mastercard SDP acquirer compliance programmes
Significant experience of progressive experience in information security governance, risk, and compliance, with at least 5 years leading a GRC team in a regulated environment
Strong understanding of UK GDPR and the role of security controls in meeting data protection obligations, including breach notification requirements and data protection impact assessments
Experience designing and operating security control frameworks mapped to multiple regulatory requirements simultaneously (e.g., a single framework serving PCI DSS, FCA, and GDPR)
Understanding of cloud-native architectures and their implications for compliance and risk management
Proven ability to translate technical security risks into business language for executive audiences
Experience managing internal and external audit relationships, regulatory examinations, and QSA assessments
Understanding of risk quantification methodologies and experience producing risk reporting that supports investment decisions
Proven people management experience, developing analysts and building team capability in a growing organisation
Experience with GRC tooling and platforms (e.g., Drata, Vanta, ServiceNow GRC, OneTrust, or equivalent)

What we offer

Competitive holiday allowance
Life assurance
Private medical care
Pension contribution

Barclays - All Job Offers

Select Country

Head of Governance, Risk and Compliance - CISO function - BPL

Job Description

Job Responsibility

Requirements

What we offer

Looking for more opportunities?

Head of Governance, Risk and Compliance - CISO function - BPL

IT Training Lead

K Kitchen Representative

K Kitchen Representative

Restaurant Assistant Manager

Plant Operator - Crushing and Screen

Graduate Student Instructors

Shift Supervisor

Shift Supervisor

Our AI answers in your language