Head of GRC

About this role

This is JD. Born in 1981. Built for Now.

At JD, we don’t just sell sneakers and outdoor gear, we set trends, break boundaries, and build communities. Whether you're on the shop floor, behind the scenes, or driving innovation, every role here plays a part in shaping the future of our industry.

We’re fast-paced, fearless, and unapologetically ambitious. We celebrate authenticity, thrive on collaboration, and never stop pushing forward, if you’re ready to bring your energy, ideas, and personality to a team that values them.

This is your moment. This is JD. Are you in?

The Head of Technology GRC is responsible for building, leading and continuously developing the Group Technology GRC function, translating the Technology Risk, Governance & Assurance strategy into effective services, processes, controls and assurance activity across the Group.

The role provides a unique opportunity to shape and lead the long-term Technology GRC capability of one of the UK's largest retail technology estates, building on a significant transformation programme and establishing a sustainable second-line function operating across a complex multi-fascia environment.

This is a leadership role with accountability for the performance, capability and day-to-day operation of the Technology GRC function and the transition from programme delivery to a sustainable long-term operating model. The role leads a multi-disciplinary team spanning technology risk, controls and assurance, policy and governance, compliance and third-party technology risk, ensuring the function operates as a coherent service with clear priorities, ownership, standards and measurable outcomes.

The Head will lead the areas requiring senior GRC judgement and oversight while building team capability and delegating operational ownership appropriately. They will be responsible for ensuring GRC services are delivered consistently, that risks and control weaknesses receive effective challenge and escalation, and that the function continues to evolve as the Group's technology environment, operating model and risk profile mature.

The function sits within Information Security for organisational purposes but operates as an independent second-line GRC function, providing objective challenge and assurance across the wider technology control environment. This includes controls relating to cyber security, ITGC, identity and access management, technology change, operations, resilience, third parties, data and emerging technologies.

The role is central to the transition from transformation-led delivery to a sustainable, long-term operating model for Technology Risk, Governance & Assurance across the Group. The Head of Technology GRC will establish, operate and embed the services, frameworks, assurance processes, governance structures and capabilities required to support first-line ownership and provide effective second-line oversight across a complex multi-fascia technology estate.

The Director of Technology Risk, Governance & Assurance retains accountability for the overall Technology Risk, Governance & Assurance strategy and the independent opinion provided to Executive leadership, the Audit & Risk Committee and external stakeholders. The Head of Technology GRC is accountable for the delivery, capability and operational effectiveness of the function.

• Job Title – Head of Technology GRC
• Location – BL9 8RR
• Reports To – Director of Technology Risk, Governance & Assurance
• Direct Reports – Controls and Assurance Lead; Technology Risk Lead; Policy Lead
• Working rota – Monday-Friday
• Working hours – 40 Hours

What You'll Be Doing

• Lead and develop the Group Technology GRC function, providing clear direction, leadership and operational oversight across technology risk, controls and assurance, policy and governance, compliance and third-party technology risk.
• Set and manage priorities across the GRC portfolio, balancing risk, regulatory requirements, assurance commitments, business demand and available capacity, and making clear trade-offs where demand exceeds capacity.
• Set clear accountabilities and performance expectations for the GRC leadership team, ensuring each service has clear ownership, delivery measures, priorities and escalation routes, and holding Leads accountable for delivery and quality.
• Translate the Technology Risk, Governance & Assurance strategy into an effective and sustainable operating model, services, processes and capabilities that are consistently applied across the Group.
• Build and mature a high-performing second-line function that provides independent challenge, oversight and assurance across the technology control environment while maintaining clear separation from first-line operational responsibilities.
• Establish and continuously improve the Technology GRC service catalogue, ensuring each service has defined scope, ownership, customers, outputs, measures and escalation routes.
• Establish, maintain and continually improve the Group Technology Control Framework, ensuring control requirements remain proportionate, risk-based and aligned to business, regulatory and audit expectations.
• Agree and lead the annual technology assurance programme with the Director of Technology Risk, Governance & Assurance, providing independent oversight of control effectiveness across ITGC, Provision 29, cyber security, identity and access management, technology change, operations, resilience, third-party technology risk, data and emerging technology domains.
• Own the ongoing lifecycle of technology control deficiencies, ensuring issues are appropriately assessed, remediated, validated, risk accepted where necessary and ultimately closed in a controlled and auditable manner.
• Embed Controls by Design and point-of-change governance across the technology lifecycle, ensuring risk, control and assurance requirements are considered before new technology, services or material changes are introduced.
• Ensure GRC provides effective challenge and oversight without assuming first-line accountability for risk, controls, remediation or operational delivery.
• Lead the operation and continuous improvement of technology risk management processes, ensuring technology risks are identified, assessed, reported and managed consistently across the Group.
• Maintain a forward-looking view of technology risk, regulatory developments and emerging threats, translating these into practical control, governance and assurance requirements that support informed decision making.
• Oversee the development and maintenance of technology risk, governance and information security policies, standards and methodologies, ensuring they remain aligned to organisational objectives, regulatory obligations and industry good practice.
• Ensure effective governance structures, reporting and decision-making forums are established and maintained, providing clear visibility of technology risk, control performance, assurance outcomes and remediation progress.
• Lead the GRC aspects of third-party technology risk management, including due diligence, supplier assurance, contractual control obligations, independent assurance reporting and remediation of identified gaps.
• Oversee the effective operation and continuous development of the Group's GRC tooling estate, ensuring risk, control, issue, assurance and evidence data remains accurate, reliable and supports meaningful management reporting.
• Develop and maintain effective relationships with Technology, Information Security, Finance, Internal Audit, Procurement, Legal and external assurance partners, ensuring clear accountability, constructive challenge and strong cross-functional collaboration.
• Act as the senior operational contact for internal and external audit on Technology GRC matters, coordinating responses, evidence and follow-up while supporting the Director in senior stakeholder engagement and reliance activity.