Governance, Risk and Compliance (GRC) Analyst

Employment Type: Full-Time
Experience: 2–4 years
About the Role
We are looking for a GRC Analyst to join our Information Security and Compliance team. You will run day-to-day governance, risk and compliance activities — risk assessments, ISMS maintenance, audit evidence, and third-party security reviews — with senior support on the more complex work.
This is a hands-on delivery role rather than a first job in security. You should be comfortable running a vendor assessment or an evidence collection cycle without step-by-step direction.
Key Responsibilities
Governance & Policy
Maintain the ISMS, control register and governance documentation.
Draft and update security policies, standards and procedures.
Coordinate security awareness activities and track governance actions.
Risk Management
Run information security risk assessments and maintain the risk register.
Track risk treatment plans and remediation through to closure.
Manage the security exception process.
Compliance & Audit
Support compliance activities across ISO/IEC 27001, SOC 2 and GDPR.
Collect and organise audit evidence; act as a point of contact during internal and external audits.
Track audit and assessment findings to closure.
Third-Party Risk
Run vendor security assessments and review supplier questionnaires.
Maintain supplier risk records and follow up on third-party remediation.
Reporting
Produce monthly security and compliance reporting for management.
Maintain compliance dashboards and documentation repositories.
What We’re Looking For
2–4 years in information security, risk, compliance, audit or IT governance.
Practical working knowledge of at least one major framework (ISO 27001, SOC 2 or NIST CSF).
Working understanding of GDPR and data protection obligations.
Confident with Excel and structured documentation; able to produce reporting for a management audience.
Strong written communication and attention to detail.
Comfortable working with both technical and non-technical stakeholders.
Degree in cyber security, computer science, IT or a related discipline — or equivalent practical experience.
Nice to Have
Hands-on use of a GRC platform (Vanta, Drata, Hyperproof, OneTrust, ServiceNow GRC or Archer).
Cloud security fundamentals (AWS or Azure), IAM and MFA concepts.
Exposure to Cyber Essentials, CIS Controls or AI governance.
Jira or Azure DevOps; Power BI or Excel dashboards.
A certification such as ISC2 CC, CompTIA Security+, ISO 27001 Foundation / Lead Auditor or SC-900.
German is a strong plus
What We Offer
Ownership of real GRC workstreams across the full lifecycle.
Mentorship from senior security professionals and support for certifications.
Clear progression towards Senior GRC Analyst or Risk & Compliance Specialist.
Collaborative and inclusive working environment.