GRC Analyst

About This Role

This GRC Analyst role supports the Security GRC Manager in preparing and executing the external audit program, including ISO 27001, SOC 1, and SOC 2. Initially, the role will also involve owning the Enterprise Risk Management Framework, encompassing security commitment, client and regulatory obligations, and identifying, assessing, and monitoring security and business risk. The position is well-suited to a structured, detail-oriented professional comfortable operating at both operational and strategic levels.

Responsibilities

• Own the enterprise risk register and the frameworks governing risk appetite, exception management, and risk prioritisation
• Ensure the effective identification, quantification, communication, and management of technology risk, with an emphasis on root cause analysis and remediation recommendations
• Conduct Information Security risk assessments across the technology estate and physical locations, and contribute to the end-to-end risk management lifecycle
• Present risk reporting to Duco’s Executive Leadership Team at Risk Committee meetings
• Support audit readiness activities, including evidence collection and control walkthroughs, for ISO 27001, SOC 1, and SOC 2 audits
• Continuously monitor and test control design and operating effectiveness, identifying gaps and strengthening the risk posture and regulatory compliance
• Track audit findings and remediation actions through to closure
• Maintain compliance with Duco’s security certifications and accreditations (ISO 27001, SOC 1, SOC 2)
• Support client audits and wider assurance activities
• Support the review of complex or higher-risk AI use cases and the formulation of recommendations to senior stakeholders
• Contribute to the development of practical technical standards for responsible AI across the full lifecycle: development, testing, validation, deployment, monitoring, and retirement
• Support the development and maintenance of the Information Security Policy Framework in alignment with risk appetite, applicable legislation, and industry standards
• Support the assessment and completion of third-party risk assessments
• Maintain a sound understanding of the current and emerging threat landscape
• Promote adherence to security policies and foster a strong Information Security culture across the organisation

Requirements

• A minimum of 5 years’ experience in Information Security or a comparable role
• Demonstrable hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including evidence collection, control testing, and direct engagement with auditors
• Proven experience in technology risk management and information security, with a focus on risk identification, assessment, and mitigation