Head of GRC

This is JD. Born in 1981. Built for Now.

At JD, we don’t just sell sneakers and outdoor gear, we set trends, break boundaries, and build communities. Whether you're on the shop floor, behind the scenes, or driving innovation, every role here plays a part in shaping the future of our industry. We’re fast-paced, fearless, and unapologetically ambitious. We celebrate authenticity, thrive on collaboration, and never stop pushing forward, if you’re ready to bring your energy, ideas, and personality to a team that values them. This is your moment. This is JD. Are you in?

The Head of Technology GRC is responsible for building, leading and continuously developing the Group Technology GRC function, translating the Technology Risk, Governance & Assurance strategy into effective services, processes, controls and assurance activity across the Group. The role provides a unique opportunity to shape and lead the long-term Technology GRC capability of one of the UK's largest retail technology estates, building on a significant transformation programme and establishing a sustainable second-line function operating across a complex multi-fascia environment. This is a leadership role with accountability for the performance, capability and day-to-day operation of the Technology GRC function and the transition from programme delivery to a sustainable long-term operating model. The role leads a multi-disciplinary team spanning technology risk, controls and assurance, policy and governance, compliance and third-party technology risk, ensuring the function operates as a coherent service with clear priorities, ownership, standards and measurable outcomes. The Head will lead the areas requiring senior GRC judgement and oversight while building team capability and delegating operational ownership appropriately. They will be responsible for ensuring GRC services are delivered consistently, that risks and control weaknesses receive effective challenge and escalation, and that the function continues to evolve as the Group's technology environment, operating model and risk profile mature. The function sits within Information Security for organisational purposes but operates as an independent second-line GRC function, providing objective challenge and assurance across the wider technology control environment. This includes controls relating to cyber security, ITGC, identity and access management, technology change, operations, resilience, third parties, data and emerging technologies. The role is central to the transition from transformation-led delivery to a sustainable, long-term operating model for Technology Risk, Governance & Assurance across the Group. The Head of Technology GRC will establish, operate and embed the services, frameworks, assurance processes, governance structures and capabilities required to support first-line ownership and provide effective second-line oversight across a complex multi-fascia technology estate. The Director of Technology Risk, Governance & Assurance retains accountability for the overall Technology Risk, Governance & Assurance strategy and the independent opinion provided to Executive leadership, the Audit & Risk Committee and external stakeholders. The Head of Technology GRC is accountable for the delivery, capability and operational effectiveness of the function. • Job Title – Head of Technology GRC • Location – BL9 8RR • Reports To – Director of Technology Risk, Governance & Assurance • Direct Reports – Controls and Assurance Lead; Technology Risk Lead; Policy Lead • Working rota – Monday-Friday • Working hours – 40 Hours What You'll Be Doing: • Lead and develop the Group Technology GRC function, providing clear direction, leadership and operational oversight across technology risk, controls and assurance, policy and governance, compliance and third-party technology risk. • Set and manage priorities across the GRC portfolio, balancing risk, regulatory requirements, assurance commitments, business demand and available capacity, and making clear trade-offs where demand exceeds capacity. • Set clear accountabilities and performance expectations for the GRC leadership team, ensuring each service has clear ownership, delivery measures, priorities and escalation routes, and holding Leads accountable for delivery and quality. • Translate the Technology Risk, Governance & Assurance strategy into an effective and sustainable operating model, services, processes and capabilities that are consistently applied across the Group. • Build and mature a high-performing second-line function that provides independent challenge, oversight and assurance across the technology control environment while maintaining clear separation from first-line operational responsibilities. • Establish and continuously improve the Technology GRC service catalogue, ensuring each service has defined scope, ownership, customers, outputs, measures and escalation routes. • Establish, maintain and continually improve the Group Technology Control Framework, ensuring control requirements remain proportionate, risk-based and aligned to business, regulatory and audit expectations. • Agree and lead the annual technology assurance programme with the Director of Technology Risk, Governance & Assurance, providing independent oversight of control effectiveness across ITGC, Provision 29, cyber security, identity and access management, technology change, operations, resilience, third-party technology risk, data and emerging technology domains. • Own the ongoing lifecycle of technology control deficiencies, ensuring issues are appropriately assessed, remediated, validated, risk accepted where necessary and ultimately closed in a controlled and auditable manner. • Embed Controls by Design and point-of-change governance across the technology lifecycle, ensuring risk, control and assurance requirements are considered before new technology, services or material changes are introduced. • Ensure GRC provides effective challenge and oversight without assuming first-line accountability for risk, controls, remediation or operational delivery. • Lead the operation and continuous improvement of technology risk management processes, ensuring technology risks are identified, assessed, reported and managed consistently across the Group. • Maintain a forward-looking view of technology risk, regulatory developments and emerging threats, translating these into practical control, governance and assurance requirements that support informed decision making. • Oversee the development and maintenance of technology risk, governance and information security policies, standards and methodologies, ensuring they remain aligned to organisational objectives, regulatory obligations and industry good practice. • Ensure effective governance structures, reporting and decision-making forums are established and maintained, providing clear visibility of technology risk, control performance, assurance outcomes and remediation progress. • Lead the GRC aspects of third-party technology risk management, including due diligence, supplier assurance, contractual control obligations, independent assurance reporting and remediation of identified gaps. • Oversee the effective operation and continuous development of the Group's GRC tooling estate, ensuring risk, control, issue, assurance and evidence data remains accurate, reliable and supports meaningful management reporting. • Develop and maintain effective relationships with Technology, Information Security, Finance, Internal Audit, Procurement, Legal and external assurance partners, ensuring clear accountability, constructive challenge and strong cross-functional collaboration. • Act as the senior operational contact for internal and external audit on Technology GRC matters, coordinating responses, evidence and follow-up while supporting the Director in senior stakeholder engagement and reliance activity. • Lead the transition of Technology GRC from transformation programme into a permanent Group capability, embedding governance, risk management, controls and assurance services across a complex multi-fascia technology estate. • Build organisational capability and awareness by promoting a strong culture of technology risk management, governance, accountability and continuous improvement across the Group. • Support the Director of Technology Risk, Governance & Assurance in providing Executive leadership, the Audit & Risk Committee, external auditors and other stakeholders with confidence in the effectiveness and maturity of the Group's technology control environment through a robust and independently operated second-line assurance capability. What Success Looks Like • Technology change is delivered safely and at pace, with effective risk assessment, Controls by Design and proportionate governance embedded before solutions enter production. • Technology risk decisions are evidence-based, transparent and defensible, with material risks and exceptions escalated through clear governance and informed decision-making. • First-line ownership of technology risks and controls is embedded across the Group, with clear accountability, timely execution and minimal dependency on GRC intervention. • A trusted, risk-based assurance programme provides confidence in the effectiveness of the technology control environment, supporting strong audit outcomes and timely remediation of identified weaknesses. • Technology risks arising from operational change, supplier dependencies, contractual commitments, ageing technology and emerging risks are identified early enough to support proactive business decisions. • Control monitoring, testing, evidence collection, workflow and attestation are increasingly automated, reducing administrative burden and enabling greater focus on judgement, challenge and risk management. • GRC data, tooling and AI provide reliable insight into risks, controls, issues and assurance outcomes, supporting informed Executive and Board decision-making. • The Technology GRC function operates as a sustainable, trusted and internally capable second-line function, providing confidence to Executive leadership, the Audit & Risk Committee and external auditors.

What We're Looking For:

Leadership & Behaviour • A pragmatic and outcome-focused leader who can balance strategic thinking with operational delivery. • Demonstrable experience building, developing and leading high-performing teams. • Strong judgement, credibility and resilience, with the confidence to provide constructive challenge where supported by evidence. • Ability to influence senior stakeholders, suppliers and control owners whilst maintaining independence and objectivity. • Comfortable operating in complex environments and translating ambiguity into clear priorities and outcomes. • Leads through ownership and accountability, taking responsibility for outcomes and driving issues through to resolution. • Comfortable moving between strategic discussions and detailed operational matters, knowing when to remain at altitude and when to become directly involved. • Demonstrates strong personal curiosity and a willingness to understand the detail behind risks, controls, findings and remediation activities. • Builds capability in others through coaching, mentoring and leading by example rather than creating dependency. • Identifies emerging issues early, escalates proportionately and acts before problems become audit findings, programme delays or operational incidents. • Operates with a high degree of autonomy, judgement and pragmatism, balancing governance discipline with commercial and operational realities. • Comfortable holding a position that may be unpopular where evidence, risk or control effectiveness supports that position.

Experience & Skills • Experience leading a Technology GRC, Technology Risk, IT Controls, Technology Assurance or IT Audit function within a complex organisation. • Strong understanding of technology risk, governance and controls, including ITGC and UK Corporate Governance Code Provision 29 requirements. • Experience designing and operating technology control frameworks and second-line testing and assurance programmes. • Experience embedding Controls by Design and integrating controls into technology delivery and change processes. • Experience managing technology control deficiencies through remediation, risk acceptance, validation and closure. • Experience operating GRC platforms and using risk, control and assurance data to support decision-making and reporting. • Experience of third-party technology risk and assurance, including interpretation of SOC reports and independent assurance outputs. • Experience applying relevant frameworks and regulatory requirements, including NIST, PCI DSS, data protection and emerging AI governance requirements. • Experience operating in multi-entity or multi-fascia environments where governance is established centrally and executed locally. • Relevant degree or equivalent professional experience, with certifications such as CISA, CRISC, CISM, CIA or CISSP desirable. • 10+ years of progressive experience in governance, risk, compliance, or audit, with at least 3 years in a Head of, leadership or equivalent role.

We know our colleagues work tirelessly to make JD Sports the success it is today and in turn, we offer them some amazing benefits including staff Discount On JD Group and other brands within the organisation and personal development opportunities to learn and develop at work.

Thank you for your time

#JD