Global
Head of Governance, Risk and Compliance (Cyber Security)
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Accepting applications until: 28 August 2026
Job Description
Your Role: Head of Governance, Risk and Compliance – Cyber Security
This is a builder role. You'll shape how GRC works at Global from the ground up, creating a modern, engineering-led function that fits a fast-moving, creative business rather than a heavily regulated institution.
As Head of Governance, Risk and Compliance – Cyber Security at Global, you will lead the strategy, operating model and future team for GRC, working directly with the Director of Cyber Security with wider cyber security team and senior leaders across Technology, Consumer and the wider business. You will be curious and inventive about how AI and automation can be used thoughtfully to solve real GRC problems and remove unnecessary friction.
Key Responsibilities
Set the GRC strategy and operating model (30%)
- Define and own the cyber GRC vision, principles and multi-year roadmap.
- Design practical governance forums and decision pathways, establish a clear security policy framework and lifecycle, and agree the future team structure, capabilities and hiring plan.
Build risk, control and compliance frameworks (30%)
- Create and embed simple, outcome-focused frameworks for security and enterprise risk management, control design and assurance, and compliance coordination.
- Ensure risks have clear owners and treatment plans, controls are measurable and effective, and evidence management is scalable and reusable.
Establish GRC engineering, tooling and automation (25%)
- Lead the move towards policy as code, automated control testing, workflow-driven assurance and integration of GRC into engineering and business processes.
- Use data, tooling and automation to reduce manual, document-heavy tasks and improve visibility of risk and compliance posture.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Lead stakeholder engagement, culture and reporting (15%)
- Partner with Technology, Product, Legal, Procurement, Privacy, Audit and business teams to embed GRC into day-to-day work.
- Own security culture, awareness and behaviour-change activities, and provide clear, concise risk and compliance reporting and insights for senior leaders and boards.
What You'll Love About This Role
- Think Big: Shape what 'great' GRC looks like for a leading media and entertainment company, creating a function that is modern, data-driven and fit for a digital world.
- Own It: You'll have the mandate to design and implement the strategy, operating model, processes and shape the tooling we use.
- Keep it Simple: Your focus will be on practical, lightweight frameworks that help people make good decisions, not on bureaucracy. You'll strip out red tape and build approaches that teams genuinely want to use.
- Better Together: Work closely with engineers, product teams, commercial leaders and support functions to embed GRC into everyday workflows and build a strong, collaborative security culture.
What Success Looks Like
In your first few months, you'll have:
- Agreed a clear, phased GRC strategy and roadmap with the Director of Cyber Security and key stakeholders.
- Established simple, repeatable governance and risk processes that leaders find helpful, not burdensome.
- Reviewed our security policy and standards framework.
- Launched or enhanced core GRC tooling, automation or data flows to reduce manual effort and improve visibility.
- Delivered clear, concise risk and compliance updates for senior stakeholders, improving shared understanding of priorities.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
What You'll Need
- Strategic and hands-on: Experience setting GRC strategy and operating models, combined with a willingness to roll up your sleeves and build frameworks, content and processes yourself.
- Modern GRC mindset: Strong background in security governance, risk and compliance in technology-led organisations, with an interest in GRC engineering, automation and policy-as-code approaches.
- Pragmatic risk leadership: Ability to not let perfect be the enemy of good, keeping things proportionate and outcomes-focused rather than checkbox-driven.
- Influence and collaboration: Excellent stakeholder skills, able to build credibility with engineers, product teams, legal, procurement, audit and senior executives.
- AI-curious and inventive: A genuine curiosity about how AI and related technologies can safely augment GRC processes, and an ability to spot practical use cases that reduce friction and improve outcomes.
- Delivery focus: Comfortable in fast-paced, changing environments, with a track record of turning ideas into working practices, tooling and measurable improvements.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location