Lead and manage the GRC program and team across third-party risk, internal audit, compliance, and ISMS. Develop policies, run risk assessments (SOC2, ISO27001, PCI-DSS), maintain risk registers and CAPAs, manage client security questionnaires and business continuity planning, build security KPIs, and drive cross-functional compliance and improvement initiatives.