ServiceNow Architect - GRC / Integrated Risk Management

The ServiceNow GRC / IRM Architect serves as the senior-most technical authority for the organisation's ServiceNow Integrated Risk Management (IRM) and Governance, Risk & Compliance (GRC) ecosystem. This role is responsible for designing, implementing, and governing scalable, enterprise-grade solutions that protect the business, satisfy global regulators, and provide leadership with real-time risk intelligence.

The Architect will act as a strategic partner to Risk, Audit, Legal, Privacy, and CISO functions — driving a multi-year roadmap to automate and modernise the GRC programme, and embedding AI-driven risk capabilities across the platform.

2.1 Platform Architecture & Design

• Serve as the authoritative solution architect for the ServiceNow IRM/GRC platform — leading end-to-end design and delivery across Policy & Compliance, Risk Management, Audit Management, Issues Management, Vendor Risk, BCM, and AI Control Tower
• Define and maintain the enterprise IRM architecture and multi-year technology roadmap aligned to the organisation's regulatory strategy and risk appetite
• Ensure all solutions are scalable, secure, compliant, and aligned with ServiceNow platform best practices and CSDM / CMDB data models
• Minimise customisation; drive OOTB adoption and enforce architectural governance throughout the implementation lifecycle

2.2 Risk & Compliance Programme Design

• Design enterprise risk frameworks including risk registers, control libraries, risk appetite statements, and automated control testing workflows
• Architect third-party / vendor risk management programmes — assessment workflows, scorecards, continuous monitoring, and due diligence processes
• Configure and govern the AI Control Tower module for AI model risk management, AI inventory, and AI governance controls aligned to EU AI Act, DORA, and SEC requirements
• Own the BCM / DR module blueprint — integrating risk assessment workflows with operational recovery planning to strengthen organisational resilience

2.3 Integration & Technical Delivery

• Define integration strategies with SIEM/SOAR tools (Splunk, Microsoft Sentinel), vulnerability management platforms (Qualys, Tenable), ERP systems (SAP), and identity platforms
• Architect integrations with the ServiceNow SecOps suite — Vulnerability Response and Security Incident Response — to create a unified cyber-risk posture
• Ensure control-to-asset accuracy via CMDB / CSDM alignment and service mapping

2.4 Stakeholder Engagement & Leadership

• Lead GRC workshops, design sessions, and architecture reviews with Audit, Legal, Privacy, Risk, and CISO stakeholders
• Act as a trusted advisor to senior client and executive stakeholders on GRC and risk transformation initiatives
• Mentor GRC developers and consultants; conduct code and design reviews; set development standards

3.1 Education

• Bachelor's degree in Information Technology, Computer Science, Information Security, Risk Management, or a related field (required)
• Master's degree (MBA, MSc Cybersecurity, or MSc Risk Management) is strongly preferred for Principal-level roles

3.2 Experience

• 10–14 years of total professional experience in IT, with a minimum of 5 years of hands-on ServiceNow IRM / GRC implementation experience
• Demonstrated experience as a lead or architect on a minimum of 2 enterprise-scale GRC / IRM implementations, covering multiple modules
• 2–3 years in a lead or architect capacity, with accountability for solution design and delivery governance
• Prior experience in regulated industries is strongly preferred:
• Banking, Financial Services & Insurance (BFSI)
• Healthcare / Life Sciences
• Defence & Government
• Energy & Utilities
• Experience migrating from legacy GRC platforms (RSA Archer, MetricStream, ServiceNow SRM) is advantageous

4.1 ServiceNow IRM / GRC Modules

• Policy & Compliance Management — policy libraries, control frameworks, attestation campaigns
• Risk Management — risk registers, scoring models, heat maps, risk appetite configuration
• Audit Management — audit planning, engagements, findings, workpapers, audit universe
• Issues Management — issue tracking, remediation workflows, exception handling
• Vendor / Third-Party Risk Management — vendor assessments, scorecards, continuous monitoring
• Business Continuity Management (BCM) — BIA, business continuity plans, DR workflows
• AI Control Tower — AI model governance, AI inventory, model risk controls
• Operational Resilience — critical service mapping, impact analysis, DORA compliance workflows

4.2 Platform & Scripting

• ServiceNow scripting: Business Rules, Client Scripts, Script Includes, UI Policies, Flow Designer, IntegrationHub
• Scoped applications, domain separation, ACL design, and security model configuration
• CMDB / CSDM data model alignment and service mapping for risk-to-service linkage
• Performance Analytics, GRC Dashboards, Workspaces, and Employee-facing Portals
• NowAssist / GenAI integration within GRC workflows; AI-driven risk prediction configuration

4.3 Integrations

• REST, SOAP, MID Server, and IntegrationHub spokes for GRC data flows
• SIEM platforms: Splunk, Microsoft Sentinel
• Vulnerability management: Qualys, Tenable / Nessus
• ERP integration: SAP GRC, Oracle
• Identity & access management platforms (Active Directory, Okta, SailPoint)