Information Security Governance, Risk, and Compliance (GRC) Specialist

Responsibilities

• Develop and maintain comprehensive cybersecurity policies and procedures.
• Ensure these policies align with industry standards and regulatory requirements.
• Assist in the integration of security practices and controls across technical and non‑technical departments, enhancing workflow and operational processes.
• Conduct regular risk assessments to identify vulnerabilities and threats.
• Collaborate and oversee the implementation of risk mitigation strategies.
• Monitor emerging threats and evolving technologies to continuously refine risk assessment protocols.
• Design and evaluate control metrics for assessing the effectiveness of cybersecurity measures.
• Collaborate with Enterprise Risk Management to embed cyber risk into broader risk registers and board‑level reporting.
• Monitor and ensure compliance with internal policies, industry standards, and regulatory requirements.
• Engage with stakeholders in Technology, Legal, Compliance, and Internal Audit as required.
• Compile and deliver detailed compliance reports to senior management.
• Monitor upcoming regulations and prepare compliance roadmaps.
• Support and enhance engaging cybersecurity awareness training programs.
• Foster a company‑wide culture of cybersecurity awareness.
• Keep current with the latest cybersecurity trends and best practices to inform training content and security measures.
• Train and guide wider Tech team members on best practices in cybersecurity risk management.
• Actively participate in the response to security incidents.
• Support post‑incident evaluations and reporting.
• Collaborate with relevant stakeholders to devise and enforce corrective measures to strengthen defences against future incidents.
• Maintain clear and effective communication with stakeholders at all levels.
• Provide expert guidance on cybersecurity best practices.
• Work collaboratively with Technology and other departments to achieve comprehensive security objectives.

Qualifications

• Bachelor's Degree in Information Technology, Cybersecurity, or a related field; equivalent work experience also considered.
• 3 to 5 years of professional experience in information security.
• Certification such as Certified Information Systems Security Professional (CISSP) strongly preferred.
• Deep understanding of cybersecurity principles, frameworks (e.g., NIST, ISO/IEC 27001), and compliance standards.
• Experience with financial service regulations such as FCA, SEC, MAS, DORA.
• Proficient knowledge of network security principles and controls such as Firewalls, IPS/IPD, TCP/IP, DHCP, and DNS.
• Extensive experience securing Operating Systems including Windows, UNIX/Linux, and Mac systems, including security access rights, configuration best practices.
• Knowledge of cloud service and deployment models (IaaS, PaaS, SaaS, public, private, hybrid, community) and experience implementing and managing cloud security best practices.
• In‑depth knowledge of IAM principles and technologies, including Single Sign‑On (SSO), Multi‑Factor Authentication (MFA), and role‑based access control (RBAC) systems.
• Understanding of Secure DevOps / CI/CD pipeline governance.

You will be expected to understand the regulatory obligations of the firm and abide by the regulated entity requirements and JHI policies applicable to your role.

All applicants must be willing to comply with the provisions of the Janus Henderson Investment Advisory Code of Ethics related to personal securities activities and other disclosure and certification requirements, including past political contributions and political activities.

Janus Henderson is an equal opportunity / affirmative action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or veteran status. All applications are subject to background checks.