GRC Analyst

G.Digital; Manchester; On-site; GBP 45,000 - 65,000; Full time

Job summary

A large public sector organisation in Manchester is seeking an Analyst to join its Information Security team on a permanent basis. The role blends security architecture, compliance, policy development, risk management and stakeholder engagement.

You will design and maintain security architectures, lead audits, write policies, conduct risk assessments, support third‑party risk, and deliver security awareness training while collaborating with IT, data protection, legal and operations.

Qualifications

• Operational security background in a security role.
• Experience writing and implementing security policies and conducting audits.
• Familiarity with GDPR, ISO 27001, Cyber Essentials Plus, and NCSC CAF is preferred.
• Experience working with IT teams to improve controls.
• Public sector or higher education environments desirable.

Responsibilities

• Designing and maintaining security architectures aligned with guidelines and sector best practice.
• Leading internal security audits and contributing to external assurance.
• Writing and maintaining information security policies and standards.
• Conducting risk assessments and managing the security risk register.
• Supporting third-party security risk management.
• Delivering security awareness training across the organisation.
• Collaborating with IT, data protection, legal and operational teams to embed security at every level.

Skills

Security architecture

Compliance management

Policy development

Risk management

Stakeholder engagement

Security audits

Security awareness training

DevSecOps familiarity

SIEM tooling

Tools

SIEM tooling

DevSecOps practices

Job description

A large, well-established public sector organisation in Manchester is looking for an Analyst to join their Information Security team on a permanent basis.

This is a broad and genuinely interesting security role blending security architecture, compliance, policy development, risk management and stakeholder engagement. If you want a role where you're shaping how security is done rather than just maintaining it, this is worth a look.

What you'll be doing:

Designing and maintaining security architectures aligned with NCSC guidance and sector best practice. Leading internal security audits and contributing to external assurance including Cyber Essentials. Writing and maintaining information security policies and standards. Conducting risk assessments and managing the security risk register. Supporting third-party security risk management. Delivering security awareness training across the organisation. Working across IT, data protection, legal and operational teams to embed security at every level.

What they're looking for:

A proven background in an operational security role, Security Architect, Security Analyst or Compliance Lead.

Strong knowledge of GDPR, ISO 27001, Cyber Essentials Plus and NCSC CAF.

An industry-recognised certification such as CISSP, CISM, ISO 27001 Lead Implementer or equivalent.

Experience writing and implementing security policies, conducting audits and working with IT teams to improve controls.

Familiarity with DevSecOps, SIEM tooling, or higher education / public sector environments is desirable but not essential.