Head of Cyber & Resilience

About the role
SustainGRC is governance intelligence infrastructure: one platform and one data model for governance, risk, audit, sustainability, and cyber and resilience, with more than 40 modules already built.
We’re looking for a founding-team leader to own our Cyber & Resilience domain:Third-Party Risk Management and Supply Chain Mapping
Cyber Controls & Assurance and Continuous Controls Monitoring
Vulnerability & Patch Management and Asset Management
Cyber and Operational Incident Management
Business Continuity Management
Data Protection & Privacy
Regulatory Operations
This is not an engineering or security operations role. It’s for a GRC practitioner who has run or implemented platforms such as Archer, ServiceNow IRM, MetricStream or OneTrust, and knows what regulated organisations need from them.
It’s also a role for entrepreneurs. If you’re looking for a conventional 9-to-5 position, this won’t be the right fit.
What you’ll do
Own the domain. Assess our modules against ISO 27001, ISO 22301, NIST CSF and operational resilience regulations such as DORA. Decide what’s ready, what needs to change and what gets built next.
Lead in front of clients. Run demos, workshops and implementations with CISOs, CROs, Heads of Operational Resilience and audit committees.
Build the practice. Shape the delivery methodology, guide sales and marketing on positioning, and open doors through your network.
What we’re looking for
Senior experience in cyber risk, operational resilience, third-party risk or business continuity, in financial services or other regulated sectors
Hands-on experience implementing or running an enterprise GRC platform
An understanding of how cyber governance connects to internal audit, third-party risk and board accountability
The credibility to hold a room with a CISO or an audit committee
Entrepreneurial appetite: you want to build, not inherit
What we offer
Founding-team equity
A share of practice revenue from day one, with salary introduced as the practice grows
A live product and an active, qualified pipeline
Real influence over the product roadmap and go-to-market
A global, remote role with clients across multiple markets
We’ll start with a 30-minute conversation about your experience and the market.

Work arrangement
Yes