Security GRC Manager

Hello. We’re Teya.

Teya was founded on a simple belief: local businesses deserve better.

They are the cafés, restaurants, salons, shops and entrepreneurs that bring character to our high streets, create jobs and keep communities moving. Yet for too long, financial services has made life harder for them - with clunky tools, poor support and complexity that gets in the way of running a business.

Teya exists to change that.

We’re building a financial platform for local businesses across Europe - one built around simple tools, thoughtful design and real human support. Our Members rely on us to help them run their business with confidence, and that responsibility shapes the way we work.

We move fast. We care about quality. We stay close to the detail. And we believe great performance and genuine hospitality should go hand in hand.

If you want to build meaningful products, solve real problems and make a genuine difference for local businesses, we’d love to hear from you

Your mission

Teya is a regulated payments fintech serving small businesses across Europe. Security, audit and regulatory trust are what keep our licences, card-scheme access and market access. Security at Teya is three connected teams: Security Engineering builds and runs technical controls, Security Operations runs monitoring and incident response, and Security GRC owns policy, risk and regulatory alignment.

As Security GRC Manager, reporting to the CISO, you will lead a team of three that turns PCI DSS, SWIFT CSP, ISO 27001, PCI PIN, PCI MPoC and UK and EU regulation into clear, engineer-able and increasingly automated ways of working. The function is mid-transformation. Vanta is being rolled out, the risk approach is being redefined, findings are being consolidated and third-party risk is being rebuilt with Procurement. Your job is to finish that shift, make it stick, and make GRC an accelerator for engineering rather than a toll gate. For the next two to three years, the priority is PCI DSS and SWIFT CSP excellence, built to scale towards the expectations of a regulated UK and European financial entity.

Responsibilities

• Lead and develop the Security GRC team, running a two-week sprint cadence and balancing roadmap work against heavy unplanned demand

• Represent Security GRC to auditors, assessors, regulators, the CISO and senior stakeholders

• Lead UK regulatory coverage, including operational resilience and FCA expectations, partnering with the team’s GRC Lead for EU regulation and DORA

• Own the ISMS policies and build one mapped control set across all frameworks, so teams get one evidence request instead of several

• Own the security risk methodology, scenario library and risk register, working with 2nd-line Risk and the OpRes and DORA programmes

• Run third-party security assessments with Procurement, Privacy and Legal, including the exceptions and risk acceptance path

• Plan the annual audit programme and lead PCI DSS (with the QSA) and SWIFT CSP assessments

• Own the consolidated findings register so issues are closed, not re-raised audit after audit

• Make Vanta the source of truth for evidence and lead governed automation of control assurance, including AI-assisted evidence review with named human owners

• Own the Significant Change procedure for PCI-scoped changes and oversee access and joiner-mover-leaver controls

• Report GRC metrics, risks and audit status to Security leadership

Requirements

• 7+ years in information security, with substantial GRC leadership in regulated financial services; UK banking or payments strongly preferred

• Hands-on ownership of a PCI DSS or equivalent programme, including the QSA relationship and Report on Compliance end to end

• Experience of UK regulation, including operational resilience, and ideally a regulatory authorisation or supervisory review

• A track record of designing and running a security risk register, governance forum and third-party security risk programme

• Experience automating assurance at scale, with human accountability and auditability built in

• Enough technical depth in infrastructure, cloud, identity and network controls to challenge evidence and work credibly with engineers

• Clear, plain-language communication with engineers, executives, auditors and regulators

• A partner mindset: you advise, enable and persuade rather than block

• Experience with SWIFT CSP, PCI PIN, PCI MPoC, ISO 27001, DORA or Vanta is a plus

The Perks

• We trust you, so we offer flexible working hours, as long as it suits both you and your team.

• Physical and mental health support through our partnership with WellHub, giving free access to over 1,500 gyms in the UK, 1-1 therapy, meditation sessions, and digital fitness and nutrition apps.

• Our company offers extended and improved maternity and paternity leave choices, giving employees more flexibility and support.

• Cycle-to-Work Scheme. • Health and Life Insurance.

• Pension Scheme.

• 25 days of Annual Leave (plus Bank Holidays).

• Office snacks every day.

• Friendly, comfortable, and informal office environment in Central London.

Teya is proud to be an equal opportunity employer.

We are committed to creating an inclusive environment where everyone regardless of race, ethnicity, gender identity or expression, sexual orientation, age, disability, religion, or background can thrive and do their best work. We believe that a diverse team leads to better ideas, stronger outcomes, and a more supportive workplace for all.

If you require any reasonable adjustments at any stage of the recruitment process whether for interviews, assessments, or other parts of the application—we encourage you to let us know. We are committed to ensuring that every candidate has a fair and accessible experience with us.