Hands-On GRC Lead: Security, Risk & Compliance

Sokin; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Job summary

Sokin is hiring a hands-on Security GRC Lead to scale its security program. You will own governance, risk, and compliance end to end, from framework development to control implementation, evidence automation, and audit delivery with a small team.

In practice you'll operate in AWS/GCP/Azure consoles, Jira and GitHub, collaborating with engineering to ensure controls are true, not just documented, and to drive remediation and reporting to the CISO and board.

Qualifications

• 4+ years in GRC, information security, or compliance; 1 year hands-on in security engineering or IT operations preferred.
• Direct experience running SOC 2 and/or ISO 27001 audits from the compliance side, including evidence collection and auditor management.
• Technical literacy: reading IAM policies, understanding a SIEM alert, following a CI/CD pipeline in GitHub, and evaluating control explanations.

Responsibilities

• Own and mature the compliance program across SOC 2, ISO 27001, PCI DSS, GDPR, with awareness of DORA and FCA/PRA resilience requirements.
• Run Vanta day-to-day: control mapping, evidence review, remediation tracking, and API integrations where needed.
• Build and maintain the risk register, drive remediation with named owners and deadlines in Jira.
• Maintain policy library in Confluence reflecting actual technical implementation, not templated language.
• Lead vendor/third-party risk assessments with appropriate risk tiering for payments.
• Coordinate external audits and pen tests: scoping, evidence, auditor liaison, and remediation of findings.
• Work in GitHub on control-relevant engineering practices rather than relying on screenshots.

Skills

GRC management

SOC 2 audits

ISO 27001 audits

Vanta

Jira & Confluence

GitHub

Tools

Vanta

Drata

GitHub

Jira

Confluence

Job description

Sokin is hiring a hands-on Security GRC Lead to scale its security program. You will own governance, risk, and compliance end to end, from framework development to control implementation, evidence automation, and audit delivery with a small team.

In practice you'll operate in AWS/GCP/Azure consoles, Jira and GitHub, collaborating with engineering to ensure controls are true, not just documented, and to drive remediation and reporting to the CISO and board.