Digital GRC Section Head

Role Purpose

As the Digital GRC Section Head, you will spearhead the development, implementation, and oversight of robust IT Governance, Risk, and Compliance (GRC) frameworks across digital platforms. Your leadership will ensure that risk management, audit readiness, and regulatory adherence are seamlessly integrated into the organization’s technology operations. By embedding GRC principles into IT processes, managing third-party risks, and delivering actionable insights, you will foster a culture of accountability and risk awareness, enabling the organization to operate with confidence and resilience.

Key Responsibilities

Governance Framework & Policy Oversight

• Develop, refine, and enforce enterprise-wide IT governance frameworks, policies, and controls to align with regulatory requirements and industry best practices.
• Ensure that governance practices are consistently applied across all digital platforms and technology initiatives.
• Provide structured reporting to the Section Head on policy adoption, compliance levels, and areas requiring attention.

Enterprise Risk Management & Vulnerability Oversight

• Lead comprehensive IT risk assessments and maintain a centralized risk register, ensuring clear ownership and defined remediation timelines.
• Prioritize vulnerabilities and risks based on their potential business impact, collaborating with architecture, infrastructure, and security teams to drive remediation efforts.
• Champion a risk-aware culture within IT teams by promoting awareness, providing practical guidelines, and fostering proactive risk management behaviors.

Compliance Management & Audit Readiness

• Oversee compliance with critical frameworks such as ISO, NCA, GDPR, and other relevant standards to ensure digital platforms remain audit-ready.
• Conduct control testing, gap assessments, and remediation planning, while coordinating timely responses to internal and external audits.
• Maintain well-organized evidence repositories to facilitate efficient and effective audit responses.

Third-Party & Vendor Risk Governance

• Lead assessments of vendor GRC maturity, embedding risk-based clauses into contracts and agreements.
• Monitor vendor compliance through SLAs, certifications, and independent audits to mitigate associated risks.

Performance Reporting, Metrics & Continuous Improvement

• Define and maintain dynamic GRC dashboards that provide real-time visibility into risk posture, audit findings, remediation timelines, and compliance status.
• Deliver regular, structured updates to the Section Head and governance committees to support informed decision-making.
• Drive continuous improvement in GRC practices through benchmarking, maturity assessments, and the integration of lessons learned.

Policies, Processes, and Procedures

• Monitor day-to-day activities to ensure strict adherence to established policies and procedures.
• Identify opportunities for process optimization, cost reduction, and productivity improvements by leveraging leading industry practices and adapting to evolving business environments.

People Management

• Provide hands-on mentorship, coaching, and on-the-job training to develop the skills and capabilities of your team members.
• Set clear expectations, prioritize tasks, delegate responsibilities, and monitor workflow to ensure high performance and alignment with organizational goals.
• Foster a high-performance culture that embodies the company’s values and promotes collaboration, innovation, and accountability.

Qualifications & Requirements

• Minimum of six years of relevant experience in IT governance, risk management, compliance, or a related field.
• Bachelor’s degree in Engineering, Computer Science, Information Technology, or an equivalent discipline.
• Preferred certifications include those in audit and assurance, risk management, KPI-P, compliance, and internal control frameworks.
• Strong analytical, communication, and leadership skills with the ability to influence stakeholders at all levels.
• Demonstrated expertise in IT governance frameworks, risk assessment methodologies, and compliance standards.