GRC Analyst

Idura; København; On-site; DKK 600,000 - 800,000; Full time

Job summary

Idura is seeking a GRC Analyst to manage daily risk and control operations, maintain our documentation library and support audit coordination within our Trust Office. You’ll work closely with the GRC Officer, CTO and partner heavily with the Product Team.

You will collaborate to scale our governance operating model and strengthen security practices across a SaaS environment, balancing risk and business agility while facilitating security reviews.

Qualifications

• 3+ years in governance, risk & compliance, IT audit, or risk management.
• Solid understanding of ISO 27001, SOC 2, and risk methodologies.
• Ability to translate vulnerability data into actionable risk assessments.

Responsibilities

• Execute routine security control testing and track key risk indicators.
• Maintain the public security trust center and security documentation up-to-date.
• Assist with customer inquiries, security questionnaires and vendor assessments.
• Support external audits and policy reviews.
• Evaluate third-party vendors and cloud subprocessors for security standards.
• Serve as first contact for vulnerability disclosures and coordinate remediation.

Skills

Governance & compliance

Risk assessment

Security controls

Communication skills

Cloud platforms

Audit coordination

Job description

We are seeking a GRC Analyst to manage our daily risk and control operations, maintain our documentation library and support audit coordination within our Trust Office. In this role, you'll help build and be part of our governance operating model as we scale our compliance and security efforts.
You’ll work closely with the GRC Officer, CTO and partner heavily with the Product Team.

Key Responsibilities

• Control Testing & Risk Tracking: Execute routine security control testing and maintain Key Risk Indicators.
• Trust Center Maintenance: Keep our public security trust center and standard security documentation up-to-date so existing and potential customers can self-service security reviews.
• Customer Compliance: Assist with routine incoming customer inquiries, security questionnaires and vendor assessments.
• Audit and Policy Support: Assist with external audit readiness (state certifications such as MitID Broker, NSIS, FTN and our ISMS ISAE 3000) and perform regular policy reviews.
• Vendor Risk Management: Evaluate third-party vendors and cloud subprocessors to ensure they meet our security standards before onboarding.
• Vulnerability Triage: Serve as the first point of contact for vulnerability disclosures, assessing severity and coordinating remediation with engineering.

Requirements

• 3+ years of experience in governance of risk and compliance, IT audit, or risk management.
• Solid understanding of core security controls and frameworks (e.g., ISO 27001, SOC 2, risk methodologies).
• Ability to translate technical vulnerability data into actionable risk assessments.
• Ability to balance security requirements with business agility, finding solutions that work with engineering workflows rather than blocking them.
• Strong written and verbal communication skills.
• It’s a plus if you are familiar with hyperscalers and cloud platforms, in a SaaS setup like MS Azure, AWS or Google Cloud.
• Experience with process automation and configuring AI agents is a plus.