Information Security GRC Analyst

About the role

We are looking for an Information Security GRC Analyst to join our Cyber & IT Risk team. Reporting to the Cyber & IT Risk Team Lead, you will identify, assess and mitigate cybersecurity, IT and business process risks while supporting the implementation of our control strategies.

Key responsibilities

• Build and maintain the audit function within Information Security.
• Manage and mature the Information Security & IT risk control framework.
• Document and report control failures and gaps, providing remediation guidance.
• Develop security policies, standards and procedures to centralise control activities.
• Perform risk assessments across the organisation and recommend mitigation strategies.
• Ensure remediation plans are executed by risk and control owners.
• Support compliance with ISO 27001, NIST, GDPR and other relevant standards.
• Audit processes and prepare management reports summarising findings.

Required profile

• Bachelor’s degree in a relevant field.
• At least 4 years of experience in Information Security, IT risk and compliance.
• Proven experience in GRC environments, defining and executing control frameworks.
• Experience documenting security procedures, policies and standards.
• Hands‑on experience conducting security assessments and compliance audits.

Required skills

• ISO 27001
• NIST frameworks
• GDPR compliance
• Risk assessment methodology
• Audit and control testing
• Security policy development
• Control framework implementation