Hybrid: Junior GRC & Security Compliance Analyst

Starling; Southampton; Hybrid; GBP 40,000 - 65,000; Full time

Benefits offered by this job

Salary sacrifice

Private Medical Insurance

Life insurance 4x salary

Pension scheme

Generous family-friendly policies

Refer a friend scheme

Perkbox membership

Cycle to Work

EV leasing

Volunteer time

Job summary

Engine by Starling is hiring for a Governance, Risk and Compliance (GRC) role to strengthen our information security program. You will support ISO 27001, SOC1/SOC2, CSTAR, and PCI DSS compliance, coordinate audit evidence, and assist in risk assessment across cross‑functional teams.

The role emphasizes proactive governance, policy maintenance, and ongoing security training. A minimum of 1 year in information security and familiarity with GRC tools are preferred.

Qualifications

• A minimum of 1 year of experience in an information security role.
• Proven experience in supporting and managing compliance efforts.
• Strong skills in security metrics and reporting.
• Experience with audit processes and evidence collection.
• A proactive, organised, and detail‑oriented approach to your work.
• Experience with GRC software is a plus.

Responsibilities

• Compliance Management: Learn and support the day-to-day management of our compliance programs, with a primary focus on ISO 27001, SOC1, SOC 2, CSTAR, and PCI DSS/3DS.
• Audit Support: Act as a key liaison for internal and external auditors, helping to gather evidence, prepare for audits, and track the timely remediation of any findings.
• Risk Management: Participate in our risk assessment process, helping to identify, analyse, and document information security risks. You’ll also assist in developing and monitoring risk treatment plans.
• Policy & Procedure Maintenance: Help to develop, update, and maintain our information security policies, standards, and procedures to ensure they are current, accurate, and aligned with compliance requirements.
• Evidence Collection & Review: Streamline the collection of evidence for our various compliance frameworks to ensure audit readiness.
• Cross‑Functional Collaboration: Work closely with our Engineering, Product and Security Operations teams to embed security controls into our processes and culture.
• Continuous Improvement: Identify opportunities to improve the effectiveness and efficiency of our GRC program and related processes.
• Security Awareness: Assist in the delivery and improvement of our security awareness training program for all employees.
• Third‑Party Risk Assessments: Support the end‑to‑end vendor management process by helping to evaluate the security posture of prospective and current vendors to ensure Engine’s security and compliance standards.
• A minimum of 1 year of experience in an information security role.
• Proven experience in supporting and managing compliance efforts.
• Strong skills in security metrics and reporting.
• Experience with audit processes and evidence collection.
• A proactive, organised, and detail‑oriented approach to your work.
• Experience with GRC software is a plus.

Skills

Compliance management

Audits & evidence collection

Security metrics & reporting

Audit processes

GRC software experience

Education

Foundational IT Risk or Audit certification

ISC2 Certified in Cybersecurity (CC)

ISO 27001 Foundation training

Tools

GRC software

Job description

Engine by Starling is hiring for a Governance, Risk and Compliance (GRC) role to strengthen our information security program. You will support ISO 27001, SOC1/SOC2, CSTAR, and PCI DSS compliance, coordinate audit evidence, and assist in risk assessment across cross‑functional teams.

The role emphasizes proactive governance, policy maintenance, and ongoing security training. A minimum of 1 year in information security and familiarity with GRC tools are preferred.