Cyber GRC Analyst

Cyber GRC Analyst | 12 Month Contract | Remote (EU)

We are hiring a Cyber GRC Analyst for a large organisation that is building out its own in-house Cyber Security function. This is an urgent backfill with an immediate start, on an initial 12 month contract, and the role is fully remote for candidates based in the EU.

ABOUT THE ROLE

Our client is taking ownership of cyber security in-house from its wider parent group, which means this role sits right at the centre of how the new function is shaped. You will own cyber risk, controls assurance, compliance and governance activity, and work directly with business and technology owners across the organisation.

Day to day you will be running cyber security risk assessments, assessing and testing security controls, managing third party and supplier risk, tracking remediation through to closure, supporting audits, and building out policy and governance.

Please note: this is not a SOC, Security Engineering or pure IT Audit position. It sits squarely in Cyber GRC, Cyber Risk and Security Assurance, with a genuine balance across risk, controls, compliance and governance.

WHAT YOU WILL BE DOING

• Delivering cyber security risk assessments across the business and technology estate
• Assessing, testing and providing assurance over security controls
• Owning third party and supplier risk management end to end
• Providing compliance oversight against applicable frameworks and regulatory obligations
• Tracking remediation actions with business and technology owners and driving them to closure
• Supporting internal and external audit activity
• Developing, maintaining and embedding cyber policies, standards and governance processes
• Engaging stakeholders at all levels and translating technical risk into business language

WHAT WE ARE LOOKING FOR

• A background in Cyber GRC, Cyber Risk or Security Compliance
• Experience running cyber security risk assessments
• Security controls assessment, testing and assurance experience
• Third party and supplier risk management
• Compliance oversight and remediation tracking
• Audit support experience
• Policy and governance work
• Strong stakeholder management skills
• Working knowledge of NIS2, GDPR, NIST CSF or equivalent frameworks

NICE TO HAVE

• Experience in a regulated industry such as aviation, financial services or critical national infrastructure
• Secure by Design
• Cloud security controls and modern IT architecture
• Cyber resilience, including BCM, DR and cyber recovery
• Structured control testing methodologies
• Policy and standards lifecycle management
• Power BI
• GRC platforms such as ServiceNow GRC, Archer or SureCloud
• Certifications such as CISSP, CISA, CRISC or ISO 27001 Lead Implementer / Lead Auditor

IS THIS ROLE FOR YOU?

This role will suit someone who owns risk and controls rather than operates them. If your background is primarily SOC operations, incident response or security engineering, or if your experience is compliance checkbox work without hands-on risk assessment and controls assurance, this one is unlikely to be the right fit.