Audit readiness and control translation: We hold ISO 27001, 27017 and 27018, Cyber Essentials Plus, Defence Cyber Certification, SOC 2 and IRAP. With the Head of GRC, you’ll map each control to the systems and practices that satisfy it, explain our setup to auditors in their terms, and agree remediation where there’s a gap. You’ll produce the evidence for each audit cycle, including device compliance, access reviews, firewall rule audits, physical security assessments and monthly HR security reviews. You’ll also keep a runbook of what each audit needs, where the evidence comes from and when it’s due. For our FedRAMP programme and US-restricted systems (including GCC High), which are run by our US DevSecOps engineers, you’ll coordinate where corporate IT touches that boundary.