Want to know if this job is worth applying to?
Greater London, England, United Kingdom
Onsite
Your Role: Head of Governance, Risk and Compliance – Cyber Security
This is a builder role. You'll shape how GRC works at Global from the ground up, creating a modern, engineering-led function that fits a fast-moving, creative business rather than a heavily regulated institution.
As Head of Governance, Risk and Compliance – Cyber Security at Global, you will lead the strategy, operating model and future team for GRC, working directly with the Director of Cyber Security with wider cyber security team and senior leaders across Technology, Consumer and the wider business. You will be curious and inventive about how AI and automation can be used thoughtfully to solve real GRC problems and remove unnecessary friction.
Set the GRC strategy and operating model (30%): Define and own the cyber GRC vision, principles and multi-year roadmap. Design practical governance forums and decision pathways, establish a clear security policy framework and lifecycle, and agree the future team structure, capabilities and hiring plan.
Build risk, control and compliance frameworks (30%): Create and embed simple, outcome-focused frameworks for security and enterprise risk management, control design and assurance, and compliance coordination. Ensure risks have clear owners and treatment plans, controls are measurable and effective, and evidence management is scalable and reusable.
Establish GRC engineering, tooling and automation (25%): Lead the move towards policy as code, automated control testing, workflow-driven assurance and integration of GRC into engineering and business processes. Use data, tooling and automation to reduce manual, document-heavy tasks and improve visibility of risk and compliance posture.
Lead stakeholder engagement, culture and reporting (15%): Partner with Technology, Product, Legal, Procurement, Privacy, Audit and business teams to embed GRC into day-to-day work. Own security culture, awareness and behaviour-change activities, and provide clear, concise risk and compliance reporting and insights for senior leaders and boards.
Think Big: Shape what 'great' GRC looks like for a leading media and entertainment company, creating a function that is modern, data-driven and fit for a digital world.
Own It: You'll have the mandate to design and implement the strategy, operating model, processes and shape the tooling we use.
Keep it Simple: Your focus will be on practical, lightweight frameworks that help people make good decisions, not on bureaucracy. You'll strip out red tape and build approaches that teams genuinely want to use.
Better Together: Work closely with engineers, product teams, commercial leaders and support functions to embed GRC into everyday workflows and build a strong, collaborative security culture.
In your first few months, you'll have:
Agreed a clear, phased GRC strategy and roadmap with the Director of Cyber Security and key stakeholders.
Established simple, repeatable governance and risk processes that leaders find helpful, not burdensome.
Reviewed our security policy and standards framework.
Launched or enhanced core GRC tooling, automation or data flows to reduce manual effort and improve visibility.
Delivered clear, concise risk and compliance updates for senior stakeholders, improving shared understanding of priorities.
Strategic and hands-on: Experience setting GRC strategy and operating models, combined with a willingness to roll up your sleeves and build frameworks, content and processes yourself.
Modern GRC mindset: Strong background in security governance, risk and compliance in technology-led organisations, with an interest in GRC engineering, automation and policy-as-code approaches.
Pragmatic risk leadership: Ability to not let perfect be the enemy of good, keeping things proportionate and outcomes-focused rather than checkbox-driven.
Influence and collaboration: Excellent stakeholder skills, able to build credibility with engineers, product teams, legal, procurement, audit and senior executives.
AI-curious and inventive: A genuine curiosity about how AI and related technologies can safely augment GRC processes, and an ability to spot practical use cases that reduce friction and improve outcomes.
Delivery focus: Comfortable in fast-paced, changing environments, with a track record of turning ideas into working practices, tooling and measurable improvements.