What you will be doing

• Own and develop IT control frameworks (SOX, ITGC, ISO27001, COBIT, ITIL, NIST)
• Lead all internal and external IT audits end-to-end (readiness, execution, remediation)
• Maintain SOX narratives, RACMs, and control documentation
• Manage IT risk register and perform risk assessments
• Embed controls across change, access, incident, and operational processes
• Lead user access reviews and enforce segregation of duties
• Oversee GDPR-aligned data privacy controls and DPIAs
• Maintain and test Incident Response Plan (including tabletop exercises)
• Deliver executive reporting on risks, audits, and compliance posture
• Monitor regulatory changes and update controls accordingly
• Drive control automation and continuous improvement
• Deliver security and compliance awareness activities
• Partner with IT, InfoSec, Finance, Audit, Legal and business stakeholders
• Support NIS2 and UK/EU regulatory alignment where applicable
• Implement and optimise GRC / control automation tooling
• Own third-party / supplier assurance for technology risk
• Define and report KPIs (audit findings, remediation SLAs, control effectiveness)
• Provide oversight on emerging risks including AI governance and new technologies

What we need from you

• 5+ years in IT audit, controls, governance or compliance
• Experience in regulated / FTSE or enterprise environments
• Strong knowledge of SOX, ITGCs, ISO27001, COBIT, ITIL, NIST
• Audit management and control framework implementation experience
• Understanding of GDPR and data privacy requirements
• Relevant certifications (CISA, CRISC, CISSP desirable)
• Degree in IT, Information Systems or related field

Person Profile

• Self-starter with strong ownership mindset
• Strong stakeholder management and communication skills
• High attention to detail and analytical thinking
• Able to influence and embed controls across teams
• Organised and capable of managing multiple priorities
•