Supporting the integrity and currency of MyPass's third-party provider, risk, policy, and CAPA registers is the core of this GRC Analyst role. The person in this role ensures all entries are reviewed, updated, or progressed to closure on schedule with appropriate evidence, and supports the Senior Corporate Services Manager's ISMS ownership and audit obligations. This position provides broader coordination support across compliance platforms, training campaigns, system access, Google Workspace guidance, and process documentation.
Responsibilities
Monitor the policy lifecycle to ensure review deadlines are met
Coordinate the policy review and approval process across all business areas
Publish approved policies in Confluence and Drata
Maintain the controlled document register, published versions, and master files
Maintain controlled templates within the master files and Google Gallery
Coordinate the timely review of risks within Drata
Support the Senior Corporate Services Manager with risk assessment scheduling, expediting evidence with stakeholders, and preparing documentation for risk closure
Monitor and report on risk review completion status
Monitor and report on Drata control readiness, identifying failing or at-risk technical, operational, and people controls
Create and manage Jira tickets for control issues requiring remediation, coordinating with control owners through to resolution
Coordinate personnel compliance within Drata, including monitoring onboarding and offboarding status against required timeframes
Maintain the Drata evidence register, ensuring evidence is current, complete, and mapped to the correct controls
Maintain the third-party provider register covering software vendors, IT service providers, and other third-party providers
Coordinate vendor due diligence and periodic performance reviews with relevant stakeholders
Ensure vendor contract records, renewals, and review evidence are current and accurately maintained
Own the CAPA register within QT9, covering corrective actions arising from ISO audits, risk treatments, and incidents
Expedite the collection of evidence from stakeholders to support timely CAPA closure
Prepare and present evidence for review by the Senior Corporate Services Manager prior to closure, flagging any gaps or inconsistencies identified
Maintain CAPA reporting and manage CAPA workflows end to end
Support the internal audit programme, providing CAPA status and evidence to the Lead Auditor and internal auditors as required
Coordinate the rollout of new KnowBe4 training campaigns
Monitor the validity of training modules to ensure content remains current
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Prepare and distribute KnowBe4 completion and compliance reports
Coordinate and undertake system access reviews on a rolling schedule across managed platforms
Support timely remediation of identified access issues with relevant stakeholders
Provide guidance to users on Google Workspace functionality, including templates and shared drives
Undertake analysis of user needs for shared drives to inform structure and access decisions
Provide project support as required across Corporate Services initiatives, including coordination, documentation, and status reporting
Document GRC standard operating procedures in Confluence, keeping content current as processes evolve
Support external audit processes, including ISO 27001 certification and surveillance audits
Maintain documentation, configurations, and evidence in accordance with ISMS requirements
Understand own contribution to the effectiveness of the ISMS
Understand own responsibilities within the ISMS (e.g. Acceptable Use of Assets Policy, Information Security Policy)
Understand the consequences of non-compliance with the requirements of the ISMS
Understand information security guidelines related to own job role
Requirements
Minimum of 3 years' experience in a GRC, risk, or compliance role involving information security or regulatory obligations
