Latest AI JobsBrowse Jobs
Wordsmith logo

GRC Lead

WordsmithEdinburghG&A
Apply on company site
Salary
Not listed
Job type
Full-time
Posted
10 Jul 2026
Status
Open · checked 7d ago

About this role

Wordsmith is hiring a GRC Lead in Edinburgh to direct security, compliance, and AI governance for an AI-powered command centre designed for corporate legal teams. This senior position suits an experienced compliance and security professional ready to shape the future of a rapidly growing technology company.

Role Overview

The GRC Lead takes full ownership of security and compliance at Wordsmith. Responsibilities include defining the multi-year IT and infrastructure security strategy, managing certification programs, and integrating responsible AI frameworks into product development. Operating from the Edinburgh office, this leader bridges engineering, legal, and go-to-market teams to uphold high enterprise trust standards.

Key Responsibilities

Security Strategy & Leadership: Direct the multi-year IT security and compliance roadmap, budget, and tooling decisions alongside engineering and company leadership.
IT & Infrastructure Security: Oversee security architecture encompassing identity and access management, endpoint protection, cloud and network security, and lead incident response.
Compliance & Certification: Manage SOC 2 Type II, ISO 27001/27017/27018, and ISO 42001 frameworks from policies and controls to audit execution.
AI Governance: Execute the AI governance program, conducting AI Impact Assessments and evaluating model and AI vendor risks.
Privacy Operations: Oversee GDPR compliance, DPIAs, RoPA maintenance, sub-processor management, and Data Subject Request fulfilment.
Third-Party & Vendor Risk: Evaluate third-party tools and vendors for security, privacy, and AI risks prior to adoption.
Team & Function Building: Establish the initial processes and automation tooling, with a long-term mandate to build and lead a dedicated team.
Executive & Board Reporting: Translate technical risks into business concepts for leadership and board reporting.
Customer & Deal Support: Serve as the primary security voice for enterprise sales, managing security questionnaires, DPAs, and the Trust Center.
Automation & Tooling: Implement lean, automation-first tools like Vanta for continuous monitoring and evidence collection.

Requirements

Possess 8 to 10+ years of professional background in security, IT, or compliance, featuring hands-on experience scaling a function at a fast-growing SaaS or tech firm.
Demonstrated background serving as the sole or founding owner of a security or compliance program.
Comprehensive, practical expertise spanning SOC 2, the ISO 27000 series, and ideally ISO 42001.
Solid foundation in core IT security principles, including identity and access management, device security, and cloud or network infrastructure.
Working knowledge of GDPR and associated privacy regulations.
Experience communicating security postures and roadmaps to executives, boards, or investors.
Capability to build and manage a team or a clear strategy for scaling one.
Ability to manage budgets and vendor choices strategically.
Strong communication skills to bridge security, engineering, legal, and commercial departments.

Nice to Have

Previous experience holding a title such as Head of Security or Director of Security/IT.
Possession of relevant industry certifications such as CISSP, CISM, AIGP, CIPP/E, CIPT, CCSK, or FIP.
Background working in legal tech, artificial intelligence, or regulated SaaS environments.
Experience creating AI risk or impact assessment frameworks from the ground up.
Familiarity with compliance and privacy tools like Datagrail, MineOS, Whistic, or SafeBase.

Skills and Tools

SOC 2 Type II
ISO 27001, ISO 27017, ISO 27018, and ISO 42001
GDPR, DPIAs, and RoPA maintenance
Identity and access management, endpoint security, and cloud infrastructure
Vanta, Datagrail, MineOS, Whistic, and SafeBase

Salary and Benefits

Competitive compensation package
Employee benefits
Meaningful equity opportunities

About the Company

Wordsmith develops the AI-enabled command centre utilized by demanding enterprise legal departments globally. Operating as an in-office team in Edinburgh, the company fosters close collaboration across product, engineering, and legal departments.

How to Apply

Interested candidates should visit the official Wordsmith careers page to submit an application for the GRC Lead position.

Questions candidates ask

Where is this job located?

This role is based in Edinburgh. The team works primarily in the office to foster close collaboration across departments.

What certifications are managed in this role?

The GRC Lead oversees SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, and ISO 42001 certifications.

What level of experience is required?

Candidates must have 8 to 10+ years of experience in security, IT, or compliance roles, specifically with a background scaling a function at a fast-growing tech company.

Is remote work permitted?

No, this is an in-office team located in Edinburgh where employees default to working from the office.

What are the primary responsibilities regarding AI?

The role includes running the AI governance program, managing AI Impact Assessments, evaluating model and AI vendor risks, and embedding responsible AI practices into product shipping.

Ready to apply?

The application is on the official Wordsmith careers page.

Apply on company site