Security GRC Manager
Core
Lead a Security GRC team to transform policy, risk, and regulatory alignment into automated, engineer-friendly workflows for a regulated European fintech.
Role type
Senior Security GRC Manager (Regulated Fintech)
Builds
Automated control assurance, consolidated risk registers, and unified evidence management for PCI DSS, SWIFT CSP, and UK/EU regulations.
Domain
Financial Services / Cybersecurity / Regulatory Compliance
Required skills
GRC leadership in regulated financial services, PCI DSS program ownership, UK regulatory expertise (FCA/Operational Resilience), security risk methodology design, third-party risk management, automation of control assurance, technical depth in cloud/identity/network controls.
Preferred skills
SWIFT CSP, PCI PIN, PCI MPoC, ISO 27001, DORA, Vanta experience.
Technologies
Vanta, QSA tools, Risk registers, ISMS frameworks.
Responsibilities
Lead and develop the Security GRC team using a two-week sprint cadence; Represent Security GRC to auditors, regulators, and senior stakeholders; Own ISMS policies and build a mapped control set across all frameworks; Own the security risk methodology, scenario library, and risk register; Run third-party security assessments with Procurement, Privacy, and Legal; Plan and lead annual audit programmes (PCI DSS, SWIFT CSP); Consolidate findings to prevent re-raising issues; Implement Vanta as the source of truth for evidence and lead governed automation; Own the Significant Change procedure for PCI-scoped changes; Report GRC metrics, risks, and audit status to Security leadership.
Seniority
Senior, hands-on IC with team leadership.