Principal GRC (H/F)

Job Description

OVO is seeking an experienced GRC Principal to provide leadership, compliance continuity, and strategic assurance. Reporting CISO you will balance day-to-day compliance and assurance stability, with continuous improvement of our risk levels and risk management practices.

As an Operator of Essential Services under NIS regulations, OVO requires a seasoned GRC professional capable of managing a complex regulatory landscape while providing hands-on guidance to a newly formed security GRC team.

You will:

• Provide day-to-day leadership to the security GRC function, ensuring clear direction and role clarity.
• Develop and manage strong stakeholder relationships (business) and reporting.
• Be a thought leader connecting security teams to wider issues of risk.
• Deliver GRC vision and people management.
• Manage and track security risks within the corporate GRC framework.
• Manage a complex regulatory environment.
• Provide continuity and continuous improvement for our Information Security Management System (ISMS), streamlining and simplifying existing processes.
• Focus is on the now, but consider the horizon: navigating shifting external risks and a complex regulatory landscape.
• Lead solution design and delivery of enterprise compliance initiatives collaborating with Security Architecture and Assurance and the broader Security teams (ISO 27001 certification and Cybersecurity Assessment Framework).
• Collaborate with GRC Security Architecture and Assurance to enable and track risk-reduction, focused security control improvement through automation and assurance.
• Lead the preparation for board level risk updates, translating technical risk into executive-level insights.
• Review the "Three Lines of Defence" model to ensure clear delineation between 1st-line operations and 2nd-line oversight.
• Collaborate and consult with risk management, compliance and DPO functions to ensure alignment.
• Act as:
  -Compliance, controls and audit partner to business.
  -Legal and regulatory partner to business.

Your team will collaborate with business, Tech and security to deliver:

• Policies and standards (top level/ISMS).
• Communications and engagement.
• Third party risk management (compliance/legal/contractual).
• Security assurance and audit-readiness against controls.
• Horizon scanning legal, regulatory and compliance.

Your key outcomes will be

• Unified governance: ownership of a living, breathing ISMS that satisfies multiple regulatory requirements without redundant effort.
• Strategic reporting: delivering clear risk reporting to leadership that enables fast, informed business decisions.
• Cultural transformation: engaged stakeholders and a measurable reduction in "human-factor" risk, moving beyond "tick-box" training to a high-engagement security awareness program.
• Cross-functional partnerships: seamless collaboration with other teams such as Risk, Business Continuity, and Fraud to ensure a straightforward experience for OVO regarding compliance.

Systems

• GRC Platforms: for centralising the risk register and Common Control Framework (CCF).
• Learning Management Systems (LMS): to drive and track the awareness program.
• Collaboration and Workflow: management and task tracking.
• Reporting Tools: to visualise KRIs and compliance health tracking.

You'll be successful in this role if you...

• Can think strategically as well as pragmatically.
• Can communicate effectively across different levels and areas of a business (business, risk, Tech, security).
• Are adept at building stakeholder relationships.
• Can cut through complexity to bring clarity and simplicity.
• Are comfortable with and bring clarity to ambiguity.
• Have experience working in a fast-evolving business.
• Are in your element and comfortable working alongside agile, Tech-driven teams.
• Able to coach and train others in identifying and delivering on security risk and regulatory requirements.
• Developed common control frameworks that consider multiple compliance and regulatory requirements.
• Have experience with managing security GRC teams and risk through mergers and acquisitions.
• Brought cohesion and purpose to newly integrated teams.
• You understand that security can break a business if done ineffectively and seek the middle-ground between compliance that protects OVO while enabling it to move fast and continue to grow.
• You can explain a complex technical risk to a non-technical audience in a way that makes them understand it and how they can help fix it.
• You build impactful narratives that make employees care and see their place in the security culture.
• You think in frameworks and processes, you don't just solve a problem once, you assist in building the systems that prevent it from reoccurring.

Essential

• Regulated Environments: Proven experience as a Security GRC or Risk Manager within UK regulated sectors (e.g., Utilities, Financial Services, or Critical National Infrastructure).
• Regulatory Fluency: Understanding of NIS regulations, GDPR, and Ofgem requirements, as well as the forthcoming Cyber Security and Resilience Bill.
• Framework Expertise: Practical experience operating within a Three Lines of Defence model.
• Executive Presence: The ability to engage confidently with Board-level stakeholders regarding risk appetites and strategic trade-offs.
• Agility: A "player-coach" mindset-equally comfortable in strategic boardrooms and technical operational reviews.
• Comfortable with Ambiguity: you can navigate shifting regulatory landscapes and provide a steady structure for the team.

Desirable

• Experience managing or restructuring security functions during organisational change.
• Experience with mergers and acquisitions.
• Experience managing risk within agile cloud-native technology estates.

Let's talk about what's in it for you

We keep our pay ranges broad on purpose to give us, and you, flexibility to match your experience to our zero carbon mission.

You'll be eligible for an on-target bonus of 15%. We have one OVO bonus plan that focuses on the collective performance of our people to deliver our Plan Zero goal.

We also offer plenty of green benefits and progressive policies to help you feel like you belong at OVO...and there's flex pay. We'll give you 9% Flex Pay on top of your salary - 4% of this is auto enrolled into your pension, and the remaining 5% is yours to do what you like with. You can use this to buy from our extensive range of flexible benefits, including our green benefits which we've put at the heart of our offering, add to your pension or even take it as cash.

Here's a taster of what's on offer:

For starters, you'll get 34 days of holiday (including bank holidays).

For your health
With benefits like a healthcare cash plan or private medical insurance depending on your career level, critical illness cover, life assurance, health assessments, and more

For your wellbeing
With gym membership, travel insurance, workplace ISA, will writing services, dental insurance, and more

For your lifestyle
With extra holiday buying, discount dining, home & tech loans, and supporting your favourite charities with give-as-you-earn donations

For your home
Get up to £400 towards any OVO Energy plan, plus great discounts on solar, smart thermostats and EV chargers

For your commute
Nab a great deal on ultra-low emission car leasing, plus our cycle to work scheme and public transport season ticket loans

Want to hear about our full range of flexible benefits and progressive people policies? Our People Team can tell you everything you need to know.

For your Belonging

To find better ways to support our people, we need to listen to each other's experiences and find ways to build a truly inclusive and diverse workplace. As part of this, we have 8 Belonging Networks at OVO. Led by our people, for our people - so when you join OVO, you can play a part - big or small - with any of the Networks. It's up to you.

Oh, and one last thing...

We'd be thrilled if you tick off all our boxes, yet we also believe it's just as important we tick off all of yours. And if you think you have most of what we're looking for but not every single thing, go ahead and hit apply. We'd still love to hear from you!

If you have any additional requirements, there's a space to let us know on the application form; we want to make the process as easy and comfortable for you as possible.