GRC Analyst

GRC Analyst

Location: London - Hybrid

We are working with a growing, technology-led organisation operating within the financial services sector to recruit a Senior GRC Analyst to join its Information Security team.

This role offers the opportunity to take ownership of enterprise technology risk management while playing a key role in external audits, security assurance and compliance activities.

The initial focus will be split between Enterprise Risk Management and Audit & Assurance, with the position evolving towards a greater focus on audit and assurance over time.

Key Responsibilities

• Support external audits covering ISO 27001, SOC 1 and SOC 2, including evidence collection, control testing and direct engagement with auditors.
• Take ownership of the Enterprise Risk Management Framework, including the risk register, risk appetite, exception management and risk reporting.
• Conduct technology and information security risk assessments, identifying control gaps and recommending remediation.
• Monitor control effectiveness, manage audit findings and track remediation actions through to closure.
• Work closely with external auditors, control owners and senior stakeholders, including presenting risk updates to the Risk Committee.
• Support wider GRC activities, including third-party risk assessments, security policies, ISMS maintenance and AI governance.

Requirements

• Experience in Information Security, GRC, Technology Risk or a related field.
• Hands-on experience supporting external audits, particularly ISO 27001, SOC 1 and/or SOC 2 Type II.
• Strong understanding of technology risk assessments, control testing, risk mitigation and remediation tracking.
• Experience maintaining an ISMS and supporting security certifications.
• Experience conducting or supporting third-party security risk assessments.
• Ability to communicate technical risks and findings clearly to senior stakeholders.
• Strong documentation, organisational and stakeholder management skills.

Desirable

• Experience within financial services or another regulated environment.
• Certifications such as ISO 27001 Lead Auditor/Implementer, CISA or CRISC.
• Familiarity with DORA and AI governance.

Interested?

If you have a background in technology risk, external audits and security assurance, we'd be happy to discuss the opportunity in more detail.