Security GRC Manager

Overview

As Security GRC Manager at Teya, you lead a small team shaping governance, risk and compliance for a regulated payments fintech. You translate complex frameworks into actionable engineering work and automated controls. You collaborate with auditors, regulators and engineering to scale compliance while reducing friction. You will drive PCI DSS and SWIFT CSP excellence and help the business navigate UK and EU regulatory expectations. This role offers a chance to accelerate secure growth in a mission-driven fintech that supports local businesses.

Pay / Benefits

• flexible working hours
• WellHub health support (gym access, therapy, fitness apps)
• extended maternity/paternity leave
• Cycle-to-Work Scheme
• Health and Life Insurance
• Pension Scheme

Responsibilities

• Lead and develop the Security GRC team with a two-week sprint cadence
• Represent GRC to auditors, regulators, and senior stakeholders
• Own UK regulatory coverage including operational resilience and FCA expectations
• Own ISMS policies and unify control sets across frameworks
• Own security risk methodology, risk register and scenario library
• Coordinate third-party security assessments with Procurement, Privacy and Legal
• Plan annual audits and lead PCI DSS and SWIFT CSP assessments
• Maintain consolidated findings and ensure timely closure
• Make Vanta the source of truth for evidence and automate control assurance
• Oversee Significant Change procedures and access controls
• Report GRC metrics and audit status to Security leadership

Key requirements

• 7+ years in information security with substantial GRC leadership in regulated financial services
• Hands-on ownership of a PCI DSS or equivalent programme including QSA
• Experience with UK regulation (operational resilience) and regulatory engagement
• Track record designing and running security risk governance and third-party risk programmes
• Experience automating assurance at scale with clear accountability
• Technical depth in infrastructure, cloud, identity and network controls
• Clear, plain-language communication with engineers, executives, auditors and regulators
• Partner mindset: advise, enable and persuade
• Experience with SWIFT CSP, PCI PIN, PCI MPoC, ISO 27001, DORA or Vanta is a plus

• clear and effective communication
• strategic influencing and persuasion
• collaborative, cross-functional partnering
• PCI DSS
• SWIFT CSP
• ISO 27001

…