GRC Analyst

Hub; København; On-site; DKK 600,000 - 800,000; Full time

Job summary

Hub seeks a GRC Analyst to manage daily risk and control operations, maintain our documentation library and support audit coordination within our Trust Office. You will collaborate with the GRC Officer, CTO and Product Team.

You will perform control testing, maintain risk indicators, and help keep our security documentation current to enable customers to review security reviews themselves. This role requires strong communication and cross-functional collaboration.

Qualifications

• 3+ years in governance of risk and compliance, IT audit, or risk management.
• Solid understanding of ISO 27001, SOC 2 and risk methodologies.
• Ability to translate vulnerability data into actionable risk assessments.
• Ability to balance security with business agility and engineering workflows.

Responsibilities

• Execute routine security control testing and maintain Key Risk Indicators.
• Maintain the public security trust center and standard security documentation.
• Assist with routine customer inquiries, security questionnaires and vendor assessments.
• Support external audits and regular policy reviews (e.g., ISMS ISAE 3000).
• Evaluate third-party vendors and cloud subprocessors against security standards.
• Be the first point of contact for vulnerability disclosures and coordinate remediation with engineering.

Skills

Communication skills

Risk assessment

Security controls understanding

Cross-functional collaboration

Job description

We are seeking a GRC Analyst to manage our daily risk and control operations, maintain our documentation library and support audit coordination within our Trust Office. In this role, you'll help build and be part of our governance operating model as we scale our compliance and security efforts.

You'll work closely with the GRC Officer, CTO and partner heavily with the Product Team.

Key Responsibilities

• Control Testing & Risk Tracking: Execute routine security control testing and maintain Key Risk Indicators.

• Trust Center Maintenance: Keep our public security trust center and standard security documentation up-to-date so existing and potential customers can self-service security reviews.

• Customer Compliance: Assist with routine incoming customer inquiries, security questionnaires and vendor assessments.

• Audit and Policy Support: Assist with external audit readiness (state certifications such as MitID Broker, NSIS, FTN and our ISMS ISAE 3000) and perform regular policy reviews.

• Vendor Risk Management: Evaluate third-party vendors and cloud subprocessors to ensure they meet our security standards before onboarding.

• Vulnerability Triage: Serve as the first point of contact for vulnerability disclosures, assessing severity and coordinating remediation with engineering.

Requirements

• 3+ years of experience in governance of risk and compliance, IT audit, or risk management.

• Solid understanding of core security controls and frameworks (e.g., ISO 27001, SOC 2, risk methodologies).

• Ability to translate technical vulnerability data into actionable risk assessments.

• Ability to balance security requirements with business agility, finding solutions that work with engineering workflows rather than blocking them.

• Strong written and verbal communication skills.

• It's a plus if you are familiar with hyperscalers and cloud platforms, in a SaaS setup like MS Azure, AWS or Google Cloud.

• Experience with process automation and configuring AI agents is a plus.