GRC Analyst

GRC Analyst Location: UK Remote (100% Remote) Salary: £50,000 - £60,000 + 12.5% Bonus We're partnering with a leading UK-based financial services and asset management organisation to recruit a GRC Analyst into their growing Information Security function. This is an excellent opportunity to join a business that continues to invest heavily in cyber security, governance, risk management, and regulatory compliance. Working as part of a highly collaborative security team, you'll play a key role in identifying, assessing and managing information security risks across the organisation. This position offers broad exposure to security governance, risk assessment, third-party assurance, regulatory compliance, audit activities, and the ongoing development of enterprise security controls. The Role As a GRC Analyst, you'll work closely with Cyber Security, IT, Risk, Compliance and business stakeholders to ensure security risks are appropriately identified, assessed and managed. You'll support the delivery and continuous improvement of the organisation's security governance framework while helping drive a strong security culture across the wider business. This is an ideal opportunity for someone who enjoys balancing technical security knowledge with business engagement, risk management and governance activities. Key Responsibilities

• Conduct information security risk assessments across technology, projects, suppliers and business processes.
• Evaluate the effectiveness of existing security controls and recommend improvements where required.
• Produce clear and concise risk assessment reports, findings and recommendations for both technical and non-technical audiences.
• Monitor and track risk mitigation activities, ensuring agreed actions are delivered effectively.
• Support the ongoing development and maintenance of the Information Security Risk Framework.
• Assist with third-party supplier security reviews and vendor risk assessments.
• Contribute to governance reporting, risk metrics and management information.
• Support internal and external audits, compliance assessments and security assurance activities.
• Work with stakeholders across the organisation to embed security best practices and improve risk awareness.
• Stay informed of emerging cyber threats, regulatory developments and evolving security standards. About You We're looking for an experienced GRC or Information Security professional who combines strong analytical skills with the ability to communicate effectively across the business. You'll ideally have:
• Experience within Information Security, Cyber Security, IT Risk, Governance, Risk & Compliance, or a related field.
• A strong understanding of information security risk management principles and methodologies.
• Experience conducting risk assessments, control reviews, audits or assurance activities.
• Knowledge of recognised security frameworks and standards such as ISO 27001, NIST, CIS Controls or PCI-DSS.
• Excellent stakeholder management and communication skills.
• The ability to translate technical security risks into clear business-focused recommendations.
• Strong report writing and documentation skills.
• Experience working with cloud technologies and understanding associated security risks.
• A proactive and inquisitive approach to problem solving. Desirable Experience
• Professional certifications such as CISSP, CISM, CRISC, Security+, ISO 27001 Lead Auditor or ISO 27001 Lead Implementer.
• Experience within regulated environments such as financial services.
• Knowledge of third-party risk management and supplier assurance.
• Experience using GRC platforms and risk management tools.
• Understanding of operational resilience, business continuity and data protection requirements. What's on Offer?
• £50,000 - £60,000 basic salary
• 12.5% annual bonus
• 100% remote working within the UK
• Excellent work-life balance
• Ongoing training and professional certification support
• Exposure to enterprise-scale security governance and risk programmes
• Clear opportunities for career development and progression
• The chance to make a genuine impact within a mature and evolving cyber security function