Hybrid Security Assurance Analyst — ISO/NIST & GRC

Caraffi; Reading; Hybrid; GBP 60,000 - 85,000; Full time

Job summary

Caraffi, a global retail organisation, is seeking a Security Assurance Analyst to join its Cyber Security function in Reading or Dublin on a hybrid basis (2 days a week). The role supports a major technology transformation and helps strengthen enterprise security posture.

You’ll deliver security assurance across projects and third‑party suppliers, ensuring controls, documentation and governance are applied, coordinating testing, and maintaining risk management tools and repositories.

Qualifications

• Minimum 3 years’ experience in an information security role with a focus on assurance.
• Experience supporting security accreditation programmes (ISO 27001, PCI, Cyber Essentials).
• Understanding of GDPR, PCI and how regulations influence project requirements.

Responsibilities

• Support the assurance team in conducting project security reviews across major technology initiatives
• Maintain key assurance repositories including supplier registers and project assurance lists
• Coordinate penetration testing logistics and ensure required documentation is completed to the right standard
• Validate that security controls are implemented and compliant prior to go-live
• Support third-party assurance reviews for new and existing suppliers
• Populate and maintain the Third-Party Risk Management tool, ensuring data accuracy and completeness
• Collate and track third-party documentation (SOC, PCI, ISO 27001 etc.) and flag outdated reports
• Work with the Risk Management team to ensure third-party risks are accurately reflected in the GRC platform
• Contribute to continuous improvement of security assurance processes and governance

Skills

GRC platforms

TPRM modules

Security by design

Penetration testing

Remediation guidance

ISO 27001

NIST

GDPR

PCI DSS

Stakeholder communications

Agile delivery

Waterfall delivery

Tools

Power BI

OneTrust

Job description

Caraffi, a global retail organisation, is seeking a Security Assurance Analyst to join its Cyber Security function in Reading or Dublin on a hybrid basis (2 days a week). The role supports a major technology transformation and helps strengthen enterprise security posture.

You’ll deliver security assurance across projects and third‑party suppliers, ensuring controls, documentation and governance are applied, coordinating testing, and maintaining risk management tools and repositories.