GRC Lead (Cybersecurity)

Location: Hybrid working from the London office near Old Street, United Kingdom

Salary: £70,000–£80,000 GBP per year

Company

hirify.global develops a cybersecurity platform that connects organisations to manage third-party and supply-chain risk. The company is ISO 27001 certified, holds Cyber Essentials Plus, and has achieved SOC 2 Type 1.

What you will do

• Maintain the ISO 27001 information security management system and lead external audits.
• Build the evidence and controls needed to progress from SOC 2 Type 1 to Type 2 and maintain the programme.
• Own the enterprise risk management framework and risk register, run reviews with risk owners, and report the risk posture to leadership.
• Manage the implementation of automated security and compliance tooling, then support the transition to an in-house solution within the year.
• Support Sales and Customer Success with security questionnaires, due diligence, and customer assurance.
• Maintain policies, support supplier risk management, and influence control owners across the business.

Requirements

• At least 3 years of hands-on GRC experience.
• Hands-on experience maintaining an ISO 27001 certification and working on SOC 2 audits from the organisation’s side; both are essential.
• Experience in a startup or scale-up, ideally in B2B SaaS, fintech, or security.
• Hands-on risk management experience, including turning risk data into clear reporting for senior leaders.
• A pragmatic, risk-based approach focused on security outcomes rather than box-ticking.
• Ability to take ownership, work with loose direction, and move at pace.
• Strong communication and people skills, with the ability to adapt to engineers, auditors, and leadership.
• Experience with AI and automation.

Nice to have

• Experience with Cyber Essentials or Cyber Essentials Plus.
• Experience with ISO 42001, the EU AI Act, or other AI governance frameworks.
• Experience with GRC automation platforms or building compliance tooling in-house.
• Working knowledge of UK GDPR and awareness of US privacy and security expectations.
• Experience supporting sales through customer security reviews and questionnaires.
• Experience with third-party or supply-chain risk management, or a strong interest in the problem being solved.
• Relevant certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CRISC, or CISSP.

Culture & Benefits

• Hybrid work from the London office near Old Street.
• Real ownership from day one, with room to grow into leadership as the company scales.
• Opportunity to work on GRC for customers that are themselves GRC and security teams and help shape the product they use.
• Collaborative work across Engineering, Product, Sales, Customer Success, People, and Finance.
• Work on a community-based approach to supply-chain risk.