GRC Security Analyst

What success looks like in this role: Key Responsibilities Governance Assist in the development, review, and maintenance of information security policies, standards, procedures, and guidelines in line with frameworks such as ISO 27001 and NIST CSF. Support periodic policy review cycles, ensuring documentation is kept current, version-controlled, and accessible to relevant stakeholders. Contribute to security awareness initiatives by preparing training materials, tracking completion rates, and maintaining associated records. Maintain governance trackers and document repositories, ensuring accuracy and completeness at all times. Support the preparation of governance reports, dashboards, and meeting packs for internal and client stakeholders. Risk Management Support the conduct of information security risk assessments under the guidance of senior team members, contributing to the identification and evaluation of threats, vulnerabilities, and business impacts. Maintain and update the risk register, ensuring risks are accurately documented, assigned, and tracked through treatment to closure. Assist with third-party and vendor risk assessments by gathering required information, reviewing responses, and documenting findings. Support business continuity and disaster recovery documentation, review cycles, and testing activities. Help prepare risk reports and escalate identified risks to senior analysts or management as appropriate. Compliance Support compliance activities against applicable frameworks and standards including ISO 27001, NIST CSF, CIS Controls, PCI-DSS, GDPR, and client-specific requirements. Assist in the planning and coordination of internal and external audits — gathering evidence, preparing documentation packages, and tracking audit findings through to remediation. Conduct periodic compliance checks and control walkthroughs to verify that controls are in place and operating as expected. Maintain compliance calendars and support the team in meeting regulatory deadlines, audit schedules, and periodic review obligations. Track and follow up on corrective action plans arising from audit findings, ensuring timely closure and accurate record-keeping. Security Control Assessment Assist in conducting periodic assessments of security controls across people, process, and technology dimensions. Document control observations, gaps, and weaknesses identified during assessments and support the preparation of remediation recommendations. Coordinate with technical and operational teams to gather evidence of control effectiveness and maintain supporting records for audit readiness. Reporting & Metrics Maintain and update GRC dashboards, trackers, and metrics on a regular basis, ensuring data accuracy and completeness. Prepare routine GRC reports, meeting packs, and status updates for review by senior analysts or management before distribution to clients.