Senior GRC Lead (Privacy, AI & Security)

Location: London, United Kingdom; hybrid working with 2–3 days per week in the London office and the rest remote

Company

hirify.global builds AI, behavioural intelligence and agentic operating systems that help organisations understand customer intent while protecting privacy.

What you will do

• Operate the day-to-day ISO 27701, ISO 27001 and ISO 42001 governance, risk and compliance management systems.
• Maintain risk registers, the Statement of Applicability, control registers, integrated control mappings and the GRC calendar.
• Identify, assess, document and escalate information security, privacy and AI risks across products, services and client implementations.
• Run privacy control operations, PIAs/DPIAs, evidence collection, control testing, audit support and management review preparation.
• Work with Product, Engineering, Data, Legal, Security and Customer Success teams to document data flows and track remediation.

Requirements

• 3–5 years of hands-on operational GRC experience across information security, privacy and AI or emerging technology risk.
• Working knowledge of UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and EU GDPR, applied to analytics and AI.
• Hands-on experience running PIAs/DPIAs for analytics or data-driven products and handling individual rights requests.
• Experience operating controls, collecting evidence and supporting ISO 27001 and/or ISO 27701 audits.
• Experience maintaining risk registers, control frameworks and remediation trackers.
• Experience working with engineering and data teams to document data flows and track remediation.
• Experience in a technology, SaaS, AI, data analytics or cloud-based business.
• Ability to assess privacy and security controls across complex data flows, transformations and AI/ML or agentic analytics pipelines, including inference, aggregation and re-identification risks.
• Knowledge of ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, AI governance and responsible AI frameworks including the EU AI Act, cloud and SaaS security risk management, privacy impact assessment, individual rights handling and vendor risk management.
• Strong organisation, tracking, follow-up, attention to detail and concise evidence-based written communication; confidence escalating stalled issues and working pragmatically in a fast-moving product environment.

Nice to have

• SOC 2 Type II audit experience.
• ISO/IEC 42001 experience or a management system standard transition, such as ISO/IEC 27701:2025.
• Experience in AI-enabled, analytics-heavy or martech environments.
• Preferred but not mandatory certifications: CIPP/E, CIPM, ISO 27001/ISO 27701 Lead Implementer or Lead Auditor, ISO 42001 Lead Implementer or Lead Auditor, CISM, CRISC or CISSP.

Culture & Benefits

• Hybrid and flexible working in a collaborative, innovative and sociable environment with a flat structure.
• Private medical insurance, subject to eligibility, pension scheme, income protection, employee assistance programme and life assurance.
• 26 days of holiday, increasing with service, plus enhanced statutory maternity and paternity benefits.
• Training opportunities, wellbeing programme, work socials and a cycle-to-work scheme.
• Family-friendly approach, personal development focus and free daily breakfast when working in the office.