Grc Risk Analyst

Viqu Limited; Cheltenham; Remote; GBP 65,000 - 78,000; Full time

Job summary

VIQU Limited is seeking a GRC/Third-Party Risk Analyst to lead supplier security activities. The role focuses on accelerating third-party assessments, validating ISO 27001, and challenging vendor security claims while collaborating with procurement, legal, and IT teams.

You will evaluate risk evidence, score governance controls, and drive remediation workflows to maintain security standards across the vendor landscape. Remote role with occasional travel to Cheltenham.

Qualifications

• 2-4+ years of experience in Information Security, GRC, or Third-Party Risk Management (TPRM).
• Solid working knowledge of ISO 27001 with validation experience, plus familiarity with NIST CSF or SOC 2.
• Ability to read security evidence, cross-examine vendor responses, and challenge claims.
• Understanding of third-party risk scoring, data protection principles, and security schedules in contracts.
• Strong communication to bridge technical findings with non-technical teams.

Responsibilities

• Drive end-to-end third-party and vendor security risk assessments from scoping to final risk rating.
• Review security questionnaires, vendor self-assessments, and risk artifacts.
• Inspect security documentation (SOC 2, policies, whitepapers) and review clauses in contracts.
• Validate ISO 27001 certifications, SoA, and audit reports to confirm coverage.
• Identify gaps, residual risks, and compensating controls; support remediation tracking.
• Track findings and support risk treatment or waiver workflows.

Skills

InfoSec experience

GRC/TPRM

ISO 27001

SOC 2

Contract risk

Stakeholder comms

Job description

GRC/ Third Party Risk Analyst

Remote - occassional ad hoc travel to Cheltenham

Dureaction - 6 months

Day rate - £350 - 425 a day

We are looking for a detail-driven GRC / Third-Party Risk Analyst to join our team on a full-time basis. In this role, you will be the core driver of our supplier security program, helping streamline, scale, and accelerate third-party security assessments without compromising security standards. You will partner closely with procurement, legal, IT, and internal business owners to evaluate third-party risks and challenge vendor security claims effectively.

Key Responsibilities

• Accelerate Third-Party Assessments: Drive end-to-end third-party and vendor security risk assessments from initial scoping to final risk rating in a timely manner. [
• Due Diligence & Questionnaires: Administer, review, and score security questionnaires, vendor self-assessments, and risk artifacts.
• Evidence & Contract Review: Inspect security documentation (e.g., SOC 2 reports, policies, technical whitepapers) and review security/data protection clauses in third-party contracts.
• ISO 27001 Validation: Validate ISO 27001 certifications, Statements of Applicability (SoA), and supporting audit reports to confirm true control coverage rather than taking claims at face value.
• Challenge & Identify Gaps: Critically interrogate supplier security posture, spot discrepancies or weak controls, and document residual risks or compensatory controls.
• Remediation & Tracking: Track open findings, follow up with internal and external stakeholders, and support risk treatment or waiver workflows.

Required Skills & Qualifications

• Experience: 2-4+ years of experience in Information Security, GRC (Governance, Risk, and Compliance), or Third-Party Risk Management (TPRM).
• Framework Knowledge: Solid working knowledge of ISO 27001 (mandatory validation experience) alongside familiarity with frameworks like NIST CSF or SOC 2.
• Critical Evaluation: Proven ability to read technical security evidence, cross-examine vendor responses, and push back against superficial or incomplete security assertions.
• Contract & Risk Acumen: Understanding of third-party risk scoring models, data protection principles, and security schedules in commercial contracts.
• Communication: Strong interpersonal and stakeholder-management skills to bridge the gap between technical security findings and non-technical business/procurement teams.