The Head of Technology GRC is responsible for building, leading and continuously developing the Group Technology GRC function, translating the Technology Risk, Governance & Assurance strategy into effective services, processes, controls and assurance activity across the Group.

The role provides a unique opportunity to shape and lead the long-term Technology GRC capability of one of the UK's largest retail technology estates, building on a significant transformation programme and establishing a sustainable second-line function operating across a complex multi-fascia environment.

This is a leadership role with accountability for the performance, capability and day-to-day operation of the Technology GRC function and the transition from programme delivery to a sustainable long-term operating model. The role leads a multi-disciplinary team spanning technology risk, controls and assurance, policy and governance, compliance and third-party technology risk, ensuring the function operates as a coherent service with clear priorities, ownership, standards and measurable outcomes.

The Head will lead the areas requiring senior GRC judgement and oversight while building team capability and delegating operational ownership appropriately. They will be responsible for ensuring GRC services are delivered consistently, that risks and control weaknesses receive effective challenge and escalation, and that the function continues to evolve as the Group's technology environment, operating model and risk profile mature.

The function sits within Information Security for organisational purposes but operates as an independent second-line GRC function, providing objective challenge and assurance across the wider technology control environment. This includes controls relating to cyber security, ITGC, identity and access management, technology change, operations, resilience, third parties, data and emerging technologies.

The role is central to the transition from transformation-led delivery to a sustainable, long-term operating model for Technology Risk, Governance & Assurance across the Group. The Head of Technology GRC will establish, operate and embed the services, frameworks, assurance processes, governance structures and capabilities required to support first-line ownership and provide effective second-line oversight across a complex multi-fascia technology estate.

The Director of Technology Risk, Governance & Assurance retains accountability for the overall Technology Risk, Governance & Assurance strategy and the independent opinion provided to Executive leadership, the Audit & Risk Committee and external stakeholders. The Head of Technology GRC is accountable for the delivery, capability and operational effectiveness of the function.

• Job Title – Head of Technology GRC
• Location – BL9 8RR
• Reports To – Director of Technology Risk, Governance & Assurance
• Direct Reports – Controls and Assurance Lead; Technology Risk Lead; Policy Lead
• Working rota – Monday-Friday
• Working hours – 40 Hours

What You'll Be Doing:

• Lead and develop the Group Technology GRC function, providing clear direction, leadership and operational oversight across technology risk, controls and assurance, policy and governance, compliance and third-party technology risk.
• Set and manage priorities across the GRC portfolio, balancing risk, regulatory requirements, assurance commitments, business demand and available capacity, and making clear trade-offs where demand exceeds capacity.
• Set clear accountabilities and performance expectations for the GRC leadership team, ensuring each service has clear ownership, delivery measures, priorities and escalation routes, and holding Leads accountable for delivery and quality.
• Translate the Technology Risk, Governance & Assurance strategy into an effective and sustainable operating model, services, processes and capabilities that are consistently applied across the Group.
• Build and mature a high-performing second-line function that provides independent challenge, oversight and assurance across the technology control environment while maintaining clear separation from first-line operational responsibilities.
• Establish and continuously improve the Technology GRC service catalogue, e
•