Cyber Governance, Risk and Compliance Manager

About the role

The Cyber Governance, Risk & Compliance (GRC) Manager is responsible for establishing, maintaining and continuously improving the organisation's cyber governance, risk management and compliance capabilities.

The position acts as a key bridge between business leadership, technology teams, risk functions, internal audit and regulators, ensuring that cyber security supports business objectives while protecting organisational information assets and maintaining compliance with legal, regulatory and contractual requirements.

The role also leads the adoption of automation and data-driven security practices to enhance efficiency, reporting and risk management effectiveness. This aligns with security objectives identified within the MFS UK Cyber Strategy.

Responsibilities

• Own and maintain the Cyber Security Governance Framework.
• Develop and oversee information security policies, standards, procedures and controls.
• Ensure alignment to recognised frameworks and standards including NIST, FCA/PRA and ECB expectations and Operational Resilience requirements
• Provide governance reporting to relevant UK and Corporate Committees, forums and working groups to support effective decision-making and oversight.
• Identify and monitor the department Top Risks, Emerging Risks and Issues Under Management for reporting to IS-IT Committee and Executive Risk Committee; including preparing papers for the IS-IT Committee.
• Coordinate security reviews, control attestations and policy exception processes.
• Develop and maintain compliance documentation for security audits and regulatory reviews.
• Manage security control testing and assurance programmes.
• Track risk remediation actions and provide assurance reporting.
• Facilitate risk identification, assessment, treatment and reporting activities in line with the organisation's framework - responsible for the completion and assessment of Risk and Control Self Assessments (RCSAs).
• Maintain the cyber risk register and ensure risks are assigned, monitored and escalated appropriately.
• Define risk appetite metrics and key risk indicators (KRIs).
• Drive remediation planning and risk reduction activities.
• Establish and maintain an Emerging Threat Management Programme & oversee Horizon Scanning.
• Present threat intelligence and strategic risk insights to senior leadership.
• Identify opportunities to automate governance, compliance and risk management activities.
• Drive security workflow orchestration and reporting efficiencies.
• Improve use of security tooling, dashboards and data analytics.

Essential Experience

• Significant experience in Cyber Security Governance, Risk and Compliance.
• Experience within a regulated financial services environment.
• Strong understanding of cyber risk assessment methodologies.
• Experience with security frameworks and regulatory compliance.
• Experience presenting to senior leadership and committee structures.
• Strong analytical, reporting and stakeholder management skills.

Desirable Experience

• Experience implementing GRC platforms.
• Experience with automation and workflow tools.
• Knowledge of Operational Resilience frameworks.

Desirable qualifications or equivalent relevant experience

• Degree or equivalent experience in Cyber Security, Information Security, Risk or Technology.
• CISM
• CRISC
• CISSP
• ISO 27001 Lead Implementer or Lead Auditor
• NIST Cybersecurity Framework Practitioner
• Certified Data Protection qualification

Individual Conduct Rules

• Acting with integrity.
• Acting with due skill, care, and diligence.
• Being open and cooperative with regulators.
• Treating customers fairly and with respect.
• Observing proper standards of market conduct.
• Ensuring effective control of the firm's business.

Job Family

Information Technologies & Systems

• Renault Group is committed to creating an inclusive working environment and the conditions for each of us to bring their passion, perform to the full and grow, whilst being themselves.
• In order to follow in real time the evolution of your applications and to stay in touch with us, we invite you to create a candidate account. This will take you no more than a minute and will also make it easier for you to apply in the future.

By submitting your CV or application, you authorise Renault Group to use and store information about you for the purposes of following up your application or future employment. This information will only be used by Renault Group companies as described in the Recruitment Privacy Information Policy.