GRC Analyst

About This Role

Working with a growing, technology-led organization in the financial services sector, this role offers the opportunity to take ownership of enterprise technology risk management while playing a key role in external audits, security assurance, and compliance activities. The initial focus will be split between Enterprise Risk Management and Audit & Assurance, with the position evolving towards a greater focus on audit and assurance over time.

Responsibilities

• Support external audits covering ISO 27001, SOC 1, and SOC 2, including evidence collection, control testing, and direct engagement with auditors
• Take ownership of the Enterprise Risk Management Framework, including the risk register, risk appetite, exception management, and risk reporting
• Conduct technology and information security risk assessments, identifying control gaps and recommending remediation
• Monitor control effectiveness, manage audit findings, and track remediation actions through to closure
• Work closely with external auditors, control owners, and senior stakeholders, including presenting risk updates to the Risk Committee
• Support wider GRC activities, including third-party risk assessments, security policies, ISMS maintenance, and AI governance

Requirements

• Experience in Information Security, GRC, Technology Risk, or a related field
• Hands-on experience supporting external audits, particularly ISO 27001, SOC 1, and/or SOC 2 Type II
• Strong understanding of technology risk assessments, control testing, risk mitigation, and remediation tracking
• Experience maintaining an ISMS and supporting security certifications
• Experience conducting or supporting third-party security risk assessments
• Ability to communicate technical risks and findings clearly to senior stakeholders
• Strong documentation, organizational, and stakeholder management skills

Nice to have:

• Experience within financial services or another regulated environment
• Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, or CRISC
• Familiarity with DORA and AI governance

About the Company

This organization is a growing, technology-led company operating within the financial services sector.