I'm working with a global financial services organisation looking to appoint a VP of Cybersecurity Governance, Risk & Compliance, reporting directly to the CISO.
I'll be upfront. We're not looking for a traditional GRC leader. If your experience has primarily involved maintaining existing governance frameworks, managing audits and overseeing compliance processes, unfortunately I won't be able to consider you for this opportunity.
The reason is that the CISO wants someone who has genuinely modernised a GRC function, introduced more sophisticated approaches to risk management and can work extremely closely with security engineering and architecture teams.
The CISO wants someone who understands the technology behind the risks being assessed, can engage with engineers on technical controls and security architecture, and translate that understanding into more meaningful risk assessments and decisions.
AI and automation are also central to the vision for the function, particularly how they can improve risk assessments, control monitoring and the wider approach to GRC.
This is also a significant leadership opportunity. You'll inherit a team of around eight people, with the responsibility to develop and motivate the team, raise standards and introduce new ways of working.
This is what the CISO is looking for in a GRC leader:
- A proven leader who has built, developed and motivated high-performing GRC teams.
- Someone who can demonstrate they've modernised or transformed a GRC function, rather than simply maintained one.
- Strong technical credibility, with experience working closely alongside security engineering, architecture and technology teams.
- Experience introducing more advanced risk assessment methodologies that go beyond traditional compliance-led approaches.
- An understanding of how AI and automation can be used to improve risk management and GRC processes.
- Strong experience across security governance, policies, standards, risk management, control assurance and regulatory requirements.
- Experience within financial services or another highly regulated environment is essential.
- Someone who can communicate technical risk effectively to the CISO and wider executive leadership.
Location: Candidates must be based in the Greater Toronto Area.
Work authorisation: Applicants must be Canadian citizens or Canadian permanent residents. Visa sponsorship is not available.
If you've led GRC transformation, developed strong teams and enjoy working closely with engineering to improve how security risk is managed, I'd be interested in speaking with you.
