GRC Lead

About us

Risk Ledger is developing a network of connected organisations, all working together to defend against cybersecurity attacks in the supply chain.

Organisations rely on us to establish trust, through sharing their security maturity and visualising the risks posed by their supply chain ecosystem. And we’re already trusted by customers like British Airways, BAE Systems and the NHS.

We are putting together an amazing and talented team from a diverse set of backgrounds and skillsets to drive us towards our vision. Risk Ledger is built on the respect we have for one another and our users, united by our shared values and mission.

Every one of us is still learning: it’s how we grow as individuals. We’re curious. We’re ambitious. And we’re humble and honest. At Risk Ledger, we aim high to find the best solutions we can and always put our users first.

The team
You'll join the Security & IT team, led by the Director of Information Security and IT Operations, which owns information security, IT operations and GRC across Risk Ledger in the UK and US.

Risk Ledger helps security and risk teams manage third-party and supply chain risk, so our customers hold us to the same standard they hold their own suppliers to. Our own assurance is part of the product promise: we are ISO 27001 certified, hold Cyber Essentials Plus and have achieved SOC 2 Type 1.

The team works closely with Engineering, Product, Sales, Customer Success, People and Finance, making security and compliance something that helps the business win and keep customers rather than slowing it down.

This role
As GRC Lead you'll own Risk Ledger's governance, risk and compliance work day to day: our certifications, our enterprise risk management, our policies, and the assurance we give customers.

This is a hands-on role for someone who likes to do the work, not delegate it. There's no team to inherit. You'll be the person who keeps ISO 27001 running, takes us from SOC 2 Type 1 to Type 2, and owns the risk framework the leadership team relies on.

It's a highly collaborative role: expect to spend around half your time working with people across the business, from engineers to Sales to leadership. You'll often be given a problem rather than a plan, so you'll be comfortable turning loose direction into something that works.

Because GRC is what our customers do, you'll also get to feed your expertise into our product.

In this role you will,

- Run our certifications. Maintain our ISO 27001 ISMS year round and lead our external audits. Take us from SOC 2 Type 1 to Type 2 by building and maintaining the evidence, then keep SOC 2 running.

- Own enterprise risk management. Own our enterprise risk management framework and risk register, run risk reviews with owners, and give the leadership team clear reporting on our risk posture.

- Lead our compliance tooling. Manage our automated security and compliance software platform implementation, then help us move to an in-house solution within the year, so evidence collection is continuous rather than a scramble before each audit.

- Support customer assurance. Help Sales and Customer Success answer security questionnaires and due diligence, so security reviews speed deals up rather than slowing them down.

- Keep policies current. Keep our policies up to date, owned and followed, and support our own supplier risk programme using the Risk Ledger platform.
Bring people with you. Work with control owners across the business, explaining why controls matter and getting things done through influence rather than authority.

You'll have

- At least 3 years' hands-on GRC experience.

- Hands-on experience maintaining an ISO 27001 certification and working on SOC 2 audits from the organisation's side. Both are essential.

- Experience in a startup or scale-up, ideally in B2B SaaS, fintech or security.

- Hands-on experience of risk management, and turning risk data into clear reporting for senior leaders.

- A pragmatic, risk-based approach: you favour real security outcomes over box-ticking and can explain why a control matters.

- A self-starter mindset: you take ownership, work well with loose direction and move at pace.

- Strong communication and people skills, adapting to audiences from engineers to auditors to leadership.

- AI and automation experience

Nice to have

- Experience with Cyber Essentials or Cyber Essentials Plus.

- Experience with ISO 42001, the EU AI Act or other AI governance frameworks.

- Experience with GRC automation platforms, or building compliance tooling in house.

- Working knowledge of UK GDPR and awareness of US privacy and security expectations.

- Experience supporting sales through customer security reviews and questionnaires.

- Experience with third-party or supply chain risk management, or a strong interest in the problem we solve.

- Relevant certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC or CISSP.

Why join us

- Work on GRC at a company whose customers are GRC and security teams, and help shape the product they use.

- Real ownership from day one, with room to grow into leadership as the company scales.

- A differentiated vision and a unique community-based approach to supply chain risk.

- Hybrid working from our new London office near Old Street.

Salary range £70,000 — £80,000 GBP