Governance, Risk and Compliance Analyst

Vista Global; London; On-site; GBP 45,000 - 65,000; Full time

Job summary

Une entreprise dynamique recherche un GRC Analyst pour garantir la conformité aux obligations réglementaires et améliorer la gestion des risques IT. Le candidat idéal aura une formation solide en sécurité de l'information et une expérience pratique en évaluation des risques. Vous serez responsable de l'audit, de la gestion des risques, et de la formation sur les normes de confidentialité, travaillant en étroite collaboration avec les équipes internes et les fournisseurs externes.

Qualifications

• Expérience de 2-3 ans dans le domaine GRC ou en sécurité des informations.
• Certifications pertinentes comme ISO27001 Lead Implementer, CIPP, CRISC sont un plus.
• Connaissance des cadres comme CIS 8.0, ISO 27001, NIST CSF, GDPR.

Responsibilities

• Maintenir et améliorer le Système de gestion de la sécurité de l'information (ISMS).
• Surveiller la conformité avec les cadres de sécurité.
• Coordinater les audits internes et externes.

Skills

Gestion des risques

Audit

Évaluation de la conformité

Compréhension des lois sur la confidentialité

Interprétation des exigences légales

Education

Baccalauréat en sécurité de l'information ou domaine connexe

Tools

Plateformes GRC

OneTrust

Job description

Job Profile

We are seeking a dedicated and detail-oriented Governance, Risk and Compliance (GRC) Analyst to join our team. In this role, you will need to ensure that we meet regulatory obligations, align with frameworks and security standards, and manage and maintain IT risk across the organization and supply chain. You will collaborate with cross-functional teams within the organization as well work closely with external vendors, auditors and clients to embed GRC practices, maintain security controls and reassure adherence to frameworks and policies.

Your Responsibilities

• Maintain and improve our Information Security Management System (ISMS).
• Monitor compliance with security frameworks.
• Support the IT and Information Security policy lifecycle.
• Maintain the IT Security risk register.
• Manage risk and track risk mitigation across the various Teams within the organization’s technology department.
• Conduct security reviews and risk assessments of suppliers and partners.
• Complete audits for clients and assist in the review process with their corresponding audit teams.
• Coordinate internal and external audits.
• Audit internal processes for compliance.
• Work closely with the Privacy Analyst to assist with DPIAs, RoPAs and data subject workflows.
• Maintain the GRC platform.
• Maintain security awareness training platform and assist in the delivery of relevant training.
• Assist with the creation and maintenance of metrics relevant to control effectiveness and maturity.
• Stay up-to-date with relevant frameworks and regulatory requirements.

Required Skills, Qualifications, and Experience

• Bachelor’s degree in Information Security, or related field. Relevant certifications (e.g., ISO27001 Lead Implementer, CIPP, CRISC etc.) are a plus.
• At least 2-3 years of experience in GRC, Information Security, or related fields.
• Hands-on experience with GRC platforms, OneTrust is a bonus.
• Experience with risk management and risk assessment methodologies.
• Knowledge of frameworks like CIS 8.0, ISO 27001, NIST CSF, GDPR, NIS2, or similar.
• Experience in auditing, reporting, and investigating privacy breaches.
• Ability to interpret and apply complex legal and regulatory requirements.
• Experience working with cross-functional teams to implement privacy measures.
• Providing clear guidance and training to employees on privacy standards.
• Exposure to cloud-native environments and associated risk controls.
• Exposure in Artificial Intelligence systems and associated risk controls is a bonus.
• Strong understanding of privacy laws and frameworks (e.g., GDPR, CCPA).