Digital GRC Section Head

Role Purpose

Governance and Policy Oversight

• Establish, refine, and enforce IT governance frameworks, policies, and controls across the enterprise technology landscape.
• Align governance practices with standards, regulatory requirements, and industry best practices.
• Report policy adoption and compliance levels to the Section Head.

Risk and Vulnerability Oversight

• Lead enterprise IT risk assessments and maintain a centralized risk register with ownership and remediation timelines.
• Prioritize vulnerabilities and risks by business impact and coordinate remediation with architecture, infrastructure, and security functions.
• Promote a risk-aware culture through awareness and practical guidelines.

Compliance and Audit Readiness

• Oversee ISO, NCA, GDPR, and other compliance frameworks and keep digital platforms audit ready.
• Lead control testing, gap assessments, remediation planning, and responses to internal and external audits.
• Maintain evidence repositories for efficient audit responses.

Third-Party Risk Governance

• Assess vendor GRC maturity, embed risk-based clauses, and monitor vendor compliance.
• Verify vendor compliance through service-level agreements, certifications, or independent audits.

Reporting and Improvement

• Maintain GRC dashboards for risk posture, audit findings, remediation timelines, and compliance status.
• Provide structured updates to the Section Head and governance committees.
• Improve GRC practices through benchmarking, maturity assessments, and lessons learned.

Policies and People Management

• Monitor day-to-day compliance with policies and procedures and identify opportunities for process improvement.
• Train, mentor, coach, direct, prioritize, delegate, and monitor the workflow of subordinates.

Qualifications and Requirements

• Minimum six years of experience in a related field or equivalent is required.
• A bachelor's degree in Engineering, Computer Science, Information Technology, or equivalent is required.
• Audit and assurance certifications are preferable.
• Expertise in risk management, KPI-P, compliance, and internal control frameworks is preferable.