Lead GRC Consultant in Dunfermline

Lead GRC Consultant required to join a well established global technology company with a strong base in Edinburgh. This is a senior role within the Information Security team, focused on governance, risk and compliance, with responsibility for helping shape and continually improve the organisation's security framework across a global environment. You'll take ownership of key GRC areas, including ISO 27001, security risk assessments, third-party risk, audit and control effectiveness. There is also an interesting element around the governance and responsible use of AI, helping the business understand and manage the security and data risks that come with emerging technologies.

This is a broad GRC role where you'll have genuine ownership and influence across the Information Security function. You'll be responsible for operating and improving the company's ISO 27001-aligned security management framework, while working closely with IT, Security, Engineering and wider business teams to identify and manage risk. A key part of the role will be assessing security risks around new systems, services and business initiatives, working with stakeholders to understand how controls are designed and whether they are operating effectively. You'll also play a significant role in third-party risk, reviewing suppliers and service providers and ensuring any identified risks are properly understood and addressed. There is an evolving focus on AI governance too. As the business continues to adopt AI technologies, you'll help establish the security and risk framework around their use, including acceptable-use guidance, risk assessments and appropriate controls for new AI tools and services. You'll also have the opportunity to improve the way GRC is delivered through technology, with responsibility for administering and optimising enterprise GRC platforms such as ServiceNow GRC or OneTrust.

Key Responsibilities:

• Lead the day-to-day operation and ongoing improvement of the organisation's ISO 27001-aligned Information Security Management System.
• Own and develop security policies, standards, controls and exception management processes.
• Lead information security risk assessments across new technology, projects, services and business initiatives.
• Assess the effectiveness of security controls and work with stakeholders to develop and track appropriate risk treatment plans.
• Manage third-party security risk, including supplier assessments, due diligence, remediation and ongoing monitoring.
• Support internal and external audits, customer security assessments and certification activities.
• Analyse and communicate security risks clearly to both technical and non-technical stakeholders, including senior leadership.
• Configure and continually improve GRC tooling, supporting risk registers, control libraries, assessments, exceptions and third-party workflows.
• Work closely with teams around privacy, regulatory and data protection requirements.
• Help develop the governance and security framework around the responsible use of AI, including GenAI and emerging agentic technologies.
• Act as a trusted advisor to IT, Engineering, Security and business teams, making sure security requirements are practical and can be embedded into the way teams operate.
• Produce clear reporting, briefings and presentations for senior stakeholders and support wider security awareness activity.

Key Skills & Background:

• Strong experience within Information Security, with a particular focus on GRC, risk management and/or security compliance.
• Practical experience working with ISO 27001, including the ISMS lifecycle, risk assessment, treatment and security controls.
• Experience across both internal security risk assessments and third-party/vendor risk management.
• Good technical understanding across areas such as cloud/SaaS, identity, networks, endpoints and security operations.
• Experience using an enterprise GRC platform, ideally ServiceNow GRC, although experience with other platforms such as OneTrust will also be relevant.
• Ability to work with technical and business stakeholders and translate security and compliance requirements into practical actions.
• Strong analytical skills and the ability to assess risk in the context of wider business objectives.
• Comfortable working independently, managing multiple priorities and taking ownership through to completion.
• Relevant certifications such as CISSP, CISM, CISA, CRISC or ISO 27001 Lead Implementer/Lead Auditor would be advantageous, but are not essential.

The company boasts one of the best offices in Edinburgh City Centre, offering a stunning, modern workspace that perfectly complements its dynamic and innovative culture. The office is equipped with great amenities, creating an environment that's not only comfortable but also designed to inspire collaboration and creativity. This is a hybrid role, with a minimum of two days per week in the Edinburgh office. On top of this, the company offers a very competitive salary and a great benefits package including bonus and share scheme. This is an opportunity to join a global technology business where Information Security is an important part of how the organisation operates. You'll have the scope to influence security governance at a global level, work closely with senior stakeholders and play a key role in how the business manages both established and emerging risks, particularly as AI adoption continues to develop.