Hands-On Security GRC Lead: Cloud, Audits & Automation

Sokin; Greater London; Hybrid; GBP 90,000 - 150,000; Full time

Job summary

Sokin is scaling its security function and seeking a hands-on Security GRC Lead to own governance, risk, and compliance end-to-end. You will work across SOC 2, ISO 27001, PCI DSS, GDPR with exposure to DORA and regulatory regimes in multiple regions.

You will operate in AWS/GCP/Azure consoles, Jira, GitHub, and Confluence, collaborating with engineering to ensure controls are true, not just documented, and driving remediation with owners and deadlines.

Qualifications

• 4+ years in GRC, information security, or compliance, with hands-on in security engineering or IT operations
• Direct experience running SOC 2 and/or ISO 27001 audits, including evidence collection and auditor management
• Working technical literacy: reading IAM policies, SIEM alerts, CI/CD pipelines in GitHub, and evaluating control explanations
• Hands-on experience with GRC automation platforms (Vanta, Drata, Secureframe) beyond uploading evidence
• Comfortable using Jira and Confluence daily as the system of record
• Understanding payments-specific risk: PCI DSS scoping, third-party processor risk, financial services regulatory expectations
• Strong written communication for policies, board summaries, and customer-facing security answers

Responsibilities

• Own and mature our compliance program across SOC 2, ISO 27001, PCI DSS, GDPR, with awareness of DORA and FCA/PRA operational resilience
• Run Vanta day-to-day: mapping controls, automated evidence review, remediation tracking, integration health
• Maintain risk register with scoring methodology and track remediation in Jira
• Design and run vendor/third-party risk assessments with appropriate risk tiering
• Lead external audits and pen test coordination: scoping, evidence, auditor liaison, findings remediation
• Work in GitHub on control-relevant engineering practices rather than submitting screenshots
• Investigate control failures and monitoring alerts to understand root cause in cloud infra
• Own security questionnaire responses using a library approach for customers/partners

Skills

GRC management

Audits & compliance

Cloud security literacy

Cross-functional collaboration

Regulatory understanding

Technical writi ng ability

Vendor risk assessments

Tools

Vanta

Jira

Confluence

GitHub

CI/CD

Job description

Sokin is scaling its security function and seeking a hands-on Security GRC Lead to own governance, risk, and compliance end-to-end. You will work across SOC 2, ISO 27001, PCI DSS, GDPR with exposure to DORA and regulatory regimes in multiple regions.

You will operate in AWS/GCP/Azure consoles, Jira, GitHub, and Confluence, collaborating with engineering to ensure controls are true, not just documented, and driving remediation with owners and deadlines.