Lead GRC Consultant in Edinburgh

Lead GRC Consultant required to join a well established global technology company with a strong base in Edinburgh. This is a senior role within the Information Security team, focused on governance, risk and compliance, with responsibility for helping shape and continually improve the organisation’s security framework across a global environment. You’ll take ownership of key GRC areas, including ISO 27001, security risk assessments, third-party risk, audit and control effectiveness. There is also an interesting element around the governance and responsible use of AI, helping the business understand and manage the security and data risks that come with emerging technologies.

This is a broad GRC role where you’ll have genuine ownership and influence across the Information Security function. You’ll be responsible for operating and improving the company’s ISO 27001-aligned security management framework, while working closely with IT, Security, Engineering and wider business teams to identify and manage risk. A key part of the role will be assessing security risks around new systems, services and business initiatives, working with stakeholders to understand how controls are designed and whether they are operating effectively. You’ll also play a significant role in third-party risk, reviewing suppliers and service providers and ensuring any identified risks are properly understood and addressed. There is an evolving focus on AI governance too. As the business continues to adopt AI technologies, you’ll help establish the security and risk framework around their use, including acceptable‑use guidance, risk assessments and appropriate controls for new AI tools and services. You’ll also have the opportunity to improve the way GRC is delivered through technology, with responsibility for administering and optimising enterprise GRC platforms such as ServiceNow GRC or OneTrust.

Key Responsibilities:

• Lead the day-to-day operation and ongoing improvement of the organisation’s ISO 27001-aligned Information Security Management System.
• Own and develop security policies, standards, controls and exception management processes.
• Lead information security risk assessments across new technology, projects, services and business initiatives.
• Assess the effectiveness of security controls and work with stakeholders to develop and track appropriate risk treatment plans.
• Manage third‑party security risk, including supplier assessments, due diligence, remediation and ongoing monitoring.
• Support internal and external audits, customer security assessments and certification activities.
• Analyse and communicate security risks clearly to both technical and non‑technical stakeholders, including senior leadership.
• Configure and continually improve GRC tooling, supporting risk registers, control libraries, assessments, exceptions and third‑party workflows.
• Work closely with teams around privacy, regulatory and data protection requirements.
• Help develop the governance and security framework around the responsible use of AI, including GenAI and emerging agentic technologies.
• Act as a trusted advisor to IT, Engineering, Security and business teams, making sure security requirements are practical and can be embedded into the way teams operate.
• Produce clear reporting, briefings and presentations for senior stakeholders and support wider security awareness activity.