IT GRC Specialist – Risk, Controls & Governance

About the role

This senior-level position sits within a well‑established financial services organisation in the City of London. You will own day‑to‑day IT risk management, lead risk assessments and drive the development of control frameworks across a complex, global IT environment.

Key responsibilities

• Lead BAU IT risk management from identification, assessment, tracking to closure.
• Conduct periodic risk assessments for critical applications, infrastructure, cloud environments and operational risk.
• Develop and continuously improve IT risk and control governance methodologies.
• Provide change‑governance oversight for IT programmes and transformation initiatives.
• Produce senior‑stakeholder reports on risk posture, control effectiveness and key themes.
• Design, document, assess, test and attest IT controls, ensuring they are measurable and auditable.
• Coordinate control attestations, self‑assessments and align with internal policies, regulatory requirements (including DORA) and audit expectations.
• Act as the primary bridge between first‑line IT and second‑line functions such as Information Security and Operational Risk.

Required profile

• Significant experience in IT GRC, risk management or information security governance.
• Strong understanding of IT and information‑security risk frameworks, especially ISO 27001 and NIST.
• Proven ability to work with second‑line functions and manage audit/review cycles.
• Experience navigating complex, multi‑geography environments with outsourced IT partners.

Required skills

• ISO 27001 framework
• NIST risk framework
• DORA regulatory knowledge
• IT risk management
• IT controls design, testing and attestation
• Cloud environment risk assessment
• Control framework development (L1‑L3)

What we offer

• Hybrid working (City of London office and remote)
• Salary £80,000‑£90,000 per year plus bonus
• Excellent benefits package