Security GRC Lead (Cybersecurity)

Location: Hybrid in London or Bristol, UK. Existing right to work in the UK is required; visa sponsorship is not offered.

Company

hirify.global provides an energy intelligence platform that coordinates real-time decisions across homes, devices, markets, and grids to support clean electrification.

What you will do

• Own hirify.global’s security Governance, Risk, and Compliance capability and act as the primary security bridge to the central Risk & Compliance team.
• Monitor and interpret evolving information security, privacy, critical infrastructure, and emerging technology regulations, including NIS2, AESCSF, CAF, the UK Cyber Security and Resilience Bill, and ISO 42001.
• Translate regulatory developments into security control requirements, risk assessments, and enterprise risk management inputs while maintaining accurate security risk registers.
• Design and maintain a unified Common Control Framework mapped to ISO 27001 Annex A, regulatory requirements, frameworks, and client contracts.
• Lead the SOC 2 Type 2 gap assessment, control build-out, observation period, and ongoing alignment with ISO 27001 and ISO 22301.
• Develop governance reporting, own client security assurance workflows, and coordinate external GRC consultants, audits, and supplier assessments.

Requirements

• Hands-on experience implementing and managing ISO 27001, ISO 22301, and SOC 2 Type 2 frameworks.
• Sound understanding of UK and EU cybersecurity laws, critical infrastructure mandates, including NIS2, CSRB, and CAF, and emerging technology governance.
• Experience with automated GRC platforms such as Vanta or Drata.
• Experience managing risk registers aligned with enterprise risk taxonomies.
• Demonstrated ability to partner with enterprise Risk, Legal, or Compliance teams to analyze and operationalize complex regulatory requirements.
• Ability to build bridges across central Risk & Compliance, technical engineering teams, senior leadership, and enterprise clients.
• Proactive leadership, pragmatic decision-making, strong influencing and communication skills, and the ability to establish an integrated GRC capability from design through execution.
• Existing right to work in the UK.

Nice to have

• Experience with every framework and technology listed is not required; potential and skills fit are also considered.

Culture & Benefits

• Pragmatic, lean governance focused on business value rather than compliance administration.
• 26 days of holiday and 26 weeks of full pay for new parents without a qualifying service period.
• Private medical insurance with virtual GP, life assurance, pension scheme, mortgage advice, and eye tests.
• Discretionary bonus, a Flex Fund of 5% of salary, and retail discounts.
• Personal learning budget, home office budget, and climate action support through Furthr.