Senior Director – Technology GRC

Job Description

We are hiring a Senior Director – Technology GRC to lead governance, risk and compliance across Cloud, Product and Technology within our Trust and Intelligence organization. This senior leadership role will strengthen how we build and sustain customer confidence by embedding cybersecurity, data protection, compliance and responsible AI governance into the development and operation of our products, technology platforms and cloud services. The Senior Director will establish and mature the Technology GRC operating model, partnering closely with Product, Engineering, Cloud Operations, Cybersecurity, Data Protection, Legal and enterprise risk and compliance stakeholders.

Role overview

As Senior Director – Technology GRC, you will lead the governance, risk and compliance capability for IFS Cloud, Product and Technology. Your remit covers the security, data protection, compliance and responsible AI governance requirements applicable to our products, technology environment and cloud services.

You will define and oversee a consistent Technology GRC framework that enables Product, Engineering, Cloud and Technology teams to identify, assess, manage and evidence risk throughout the product and service lifecycle. You will partner with enterprise-level control owners to align the Technology GRC program with wider company frameworks and obligations, providing subject-matter leadership and escalation for material technology risks.

Your mandate is to make security, data protection, compliance and AI governance integral to how products and cloud services are designed, developed, released and operated. Success requires rigorous oversight, practical business enablement and strong influence across technical and non-technical stakeholders.

Duties and accountabilities

Technology GRC strategy and operating model

• Develop and execute the GRC strategy and roadmap for Cloud, Product and Technology, aligned with the wider Trust and Intelligence strategy.
• Establish the Technology GRC operating model, including decision rights, governance forums, risk ownership, escalation routes and accountability across Product, Engineering, Cloud and Technology.
• Translate enterprise risk, security, privacy and compliance requirements into practical technology standards, controls and governance processes.
• Define measurable reporting for technology risk, control effectiveness, remediation, compliance readiness and customer assurance.
• Advise senior Product and Technology leaders on the risk and compliance implications of product strategy, technology investment and cloud-service decisions.

Cybersecurity governance for Cloud, Product and Technology

• Establish and oversee cybersecurity governance requirements for product development, technology platforms and cloud services.
• Partner with Cybersecurity, Engineering and Cloud Operations to embed security requirements into architecture, secure development, release and operational processes.
• Oversee governance for technology security risks, control gaps, exceptions and remediation commitments.
• Ensure relevant security controls are clearly owned, consistently evidenced and regularly assessed.
• Provide GRC oversight for material cybersecurity risks affecting products, technology platforms and cloud services.

Data protection and compliance for Cloud, Product and Technology

• Embed privacy and data-protection requirements into product design, architecture, engineering and cloud operations.
• Partner with Data Protection and Legal specialists to interpret regulatory and contractual requirements for technical teams.
• Oversee governance for data classification, data handling, retention, access, cross-border processing and related technology controls.
• Support compliance obligations relevant to cloud and software services, including GDPR, CCPA, SOC 2, ISO 27001, FedRAMP and NIST-based requirements, where applicable.
• Monitor remediation of technology-related data-protection and compliance gaps through closure.

AI governance for products and technology

• Establish and mature governance standards for the use of AI within IFS products and technology.
• Translate responsible AI principles and applicable AI requirements into product development controls, documentation and approval processes.
• Establish proportionate risk-assessment and governance requirements for AI use cases, including higher-risk or customer-impacting applications.
• Partner with Product, Engineering, AI/ML, Cybersecurity, Data Protection and Legal teams to address security, privacy, transparency, auditability, model and data risks.
• Define governance gates and evidence requirements across the AI lifecycle, including design, development, testing, release, monitoring and material change.
• Oversee governance for agentic and autonomous capabilities, including controls addressing unintended behavior, data exposure, prompt-based attacks, traceability and human oversight.

Controls, assurance and compliance readiness

• Establish and maintain a coherent technology control framework aligned with applicable security, privacy, compliance and customer assurance requirements.
• Coordinate technology control assessments, evidence reviews, gap analysis and remediation monitoring.
• Work with Internal Audit, external auditors, certification teams and enterprise compliance stakeholders on audits and assurance activity affecting Cloud, Product and Technology.
• Improve control automation, continuous monitoring and evidence collection where practical.
• Oversee technology risk acceptance and control exceptions within delegated authority, escalating material or out-of-tolerance risks through the appropriate governance process.

Customer trust and assurance

• Partner with customer assurance, sales, security and product stakeholders to strengthen the articulation of the company’s Cloud, Product and Technology trust posture.
• Ensure customer-facing assurance is supported by accurate control design, operating evidence and clear accountability.
• Identify recurring customer or market concerns and translate them into improvements in technology controls, governance and assurance practices.
• Support strategic customer discussions where senior Technology GRC leadership is required.

Leadership and stakeholder engagement

• Lead and develop a high-performing Technology GRC team with expertise across cybersecurity governance, data protection, compliance, assurance and AI governance.
• Build effective working relationships across Product, Engineering, Cloud, Technology, Cybersecurity, Data Protection, Legal, Internal Audit and customer-facing teams.
• Establish clear accountability for technology risks and controls, ensuring that GRC enables ownership rather than absorbing it.
• Provide concise, decision-oriented reporting to senior leadership and relevant governance forums.
• Escalate material risks, overdue remediation and control weaknesses through established enterprise governance channels.

What success looks like

• Security, data protection, compliance and AI governance requirements are embedded in product development and cloud-service operations rather than addressed retrospectively.
• Cloud, Product and Technology leaders have clear visibility of their most significant risks, control gaps, remediation commitments and accepted exceptions.
• Technology controls are consistently owned, evidenced and assessed, improving audit, certification and customer assurance readiness.
• Product and technology teams engage Technology GRC early when developing new products, services, architecture or AI capabilities.
• AI capabilities are governed through proportionate standards, risk assessments, development gates and monitoring requirements.
• Customer trust is strengthened through a clear, credible and evidence-based Trust and Intelligence posture.
• Technology GRC is viewed as a rigorous and pragmatic partner that protects customers and the company while enabling responsible innovation.

Qualifications

Required skills and experience

• Significant leadership experience in technology GRC, cybersecurity governance, product security, cloud compliance, data protection or a closely related discipline.
• Demonstrated experience designing and implementing GRC programs within a software, SaaS, cloud or technology-led organization.
• Strong understanding of cybersecurity and data-protection requirements across product development, technology operations and cloud services.
• Practical experience establishing technology control frameworks and supporting audits, certifications, customer assurance and remediation programs.
• Working knowledge of relevant frameworks and requirements, such as ISO 27001, SOC 2, NIST, GDPR, CCPA and FedRAMP, as applicable.
• Experience integrating security, privacy and compliance controls into product development or technology-delivery lifecycles.
• Experience governing AI/ML, generative AI or other emerging technologies within products or technology environments.
• Strong risk-assessment and governance experience, including risk acceptance, control exceptions, remediation and executive escalation.
• Demonstrated ability to advise and influence senior Product, Engineering, Cloud and Technology leaders.
• Experience leading and developing multidisciplinary teams.
• Strong written and verbal communication skills, including translating technical, regulatory and risk requirements into clear business decisions.

Scope and expectations

 Senior leadership role accountable for the GRC program supporting Cloud, Product and Technology within Trust and Intelligence.

Scope includes cybersecurity governance, technology risk, product and cloud compliance, data-protection controls, customer assurance and governance for AI used within products and technology.

Establishes Technology GRC standards and governance mechanisms within the parameters of wider enterprise policies, risk appetite and delegated authority; provides Technology GRC reporting and recommendations to senior leaders and relevant governance forums.

 Leads and develops the Technology GRC team and influences a wider network of risk and control owners across Product, Engineering, Cloud and Technology.

The role does not own company-wide financial, operational, people, legal or corporate compliance; it works in partnership with the relevant enterprise owners.

Nice to have

• Experience in enterprise software, SaaS or cloud services serving highly regulated or security-conscious customers.
• Experience supporting SOC 2, ISO 27001, FedRAMP or similar assurance and certification programs.
• Familiarity with EU cybersecurity, data-protection and AI regulations relevant to global software and cloud providers.
• Experience with secure development, cloud-control assurance, product security or DevSecOps governance.
• Experience with responsible AI frameworks, AI risk management or governance of agentic and autonomous systems.
• Relevant professional certifications such as CISA, CISM, CISSP, CRISC, CGEIT, CDPSE, CIPM, CIPP/E, ISO 27001 Lead Implementer or ISO 27001 Lead Auditor.

Additional Information

We embrace flexibility and hybrid work opportunities to support diverse needs and lifestyles, while also valuing inclusive workplace experiences. By fostering a sense of community, we drive innovation, strengthen connections, and nurture belonging. Our commitment ensures you can work in a way that suits you best, while also engaging with colleagues to share ideas and build meaningful relationships.