Governance, Risk & Compliance Lead, Identity & Access Management (GRCIAM) in Edinburgh

Join us as a Governance, Risk & Compliance Lead, Identity & Access Management. This role will see you applying effective controls and risk management thinking in an IT environment, anticipating and assessing the potential impact of risk across the bank. You’ll manage and oversee Identity and Access Management (IAM) controls, while supporting the identification and assessment of material IT risks, and in determining their position relative to agreed appetites. Collaborating with senior stakeholders across the function, you’ll drive forward the development and delivery of remedial action plans where identified risks are considered out of appetite.

What you'll do

• Lead and own the effectiveness of the IAM controls environment.
• Demonstrate risk leadership and advocacy, supporting a culture of proactive and pre‑emptive risk management and continuous improvement.
• Lead the controls design and management for Security Services.
• Quantify risk in terms of financial impact, reputation, operational disruption and regulatory impact.
• Interpret security metrics and develop reporting to leadership in a clear and actionable way.
• Manage and articulate risk, and design and assess controls to mitigate identified risks.
• Lead the Security Services Controls environment, ensuring all controls are adequate and effective.
• Support the creation of management action plans along with papers for the Risk Committees.
• Follow up on Management Action Plans, demonstrating stakeholder management and influencing skills.
• Lead reporting on controls, issues, test schedules, and outcomes.
• Take ownership for building and maintaining a network of key contacts and influencers.
• Conduct annual process and control assessments.
• Provide thought leadership for controls design and management for the IAM and Privileged Access Management transformations.

The skills you'll need

• Experience as a GRC professional with the ability to quantify risk.
• Trusted controls expert who can collaborate with Risk, Audit and Controls colleagues.
• Knowledge of internal and external audit processes and experience of preparing responses to auditors.
• Deep understanding of managing and articulating risk.
• Ability to design, implement, and assess internal controls to ensure compliance with regulatory and internal standards.
• Good data analysis skills and regulatory and framework knowledge, such as ISO27000, NIST, Sarbanes Oxley and PCI DSS.
• Excellent collaboration, communication and relationship-building skills.
• Meticulous attention to detail for policy, standards and compliance.
• Certifications such as CRISC, CISA, CGRC or CISM is desirable.

In addition to this, you'll demonstrate the ability to:

• Design and assess controls to mitigate identified risks.
• See through the delivery of management action plans to remediate inadequate or ineffective controls.
• Interpret metrics and report to leadership in a clear and actionable way.
• Manage stakeholders and management action plans from groups outside of Security.
• Explain complex risks, governance policies and compliance requirements to non-technical stakeholders.

Hours: 35

Job Posting Closing Date: 17/11/2025

Ways of Working: Remote First