Information Security Analyst (GRC) - Engine by Starling

Starling Bank; City of Westminster; Hybrid; GBP 45,000 - 65,000; Full time

Job summary

A leading bank in the UK is seeking a governance and compliance specialist to ensure adherence to security standards like ISO 27001 and PCI DSS. This role involves managing compliance programs, supporting audits, and collaborating across teams to enhance security practices. Ideal candidates will have at least 3 years of information security experience and relevant certifications. The position offers a flexible hybrid work model, contributing to a rapidly growing technology-driven banking environment.

Benefits

33 days holiday including public holidays

Birthday leave

Flexible annual leave options

Paid volunteering time

Company-enhanced pension scheme

Life insurance and income protection

Private medical insurance with benefits

Family-friendly policies

Referral incentives

Perkbox membership

Cycle to Work scheme

Qualifications

• Minimum of 3 years experience in an information security role.
• Experience supporting compliance for ISO 27001, SOC 2, and PCI DSS.
• Strong skills in security metrics and reporting.

Responsibilities

• Support day-to-day management of compliance programs.
• Act as key liaison for internal and external auditors.
• Participate in risk assessment processes.

Skills

Information security expertise

Compliance management

Security metrics and reporting

Audit processes

Proactivity and detail orientation

GRC software experience

Education

CompTIA Security+

CISA

CRISC

CISSP

Job description

In this role you will be instrumental in helping us maintain and mature our governance, risk, and compliance program. You'll play a crucial part in ensuring our ongoing adherence to security standards and regulations, building a foundation of trust for our clients and stakeholders. This is a hands‑on role, ideally suited to someone who can engage with stakeholders across our business.

Responsibilities

• Compliance Management – support the day‑to‑day management of our compliance programs, with a primary focus on ISO 27001, SOC 2, and PCI DSS/3DS.
• Audit Support – act as a key liaison for internal and external auditors, helping to gather evidence, prepare for audits, and track the timely remediation of any findings.
• Risk Management – participate in our risk assessment process, helping to identify, analyse, and document information security risks. Assist in developing and monitoring risk treatment plans.
• Policy & Procedure Maintenance – help develop, update, and maintain our information security policies, standards, and procedures to ensure they are current, accurate, and aligned with compliance requirements.
• Evidence Collection & Review – automate and streamline the collection of evidence for our various compliance frameworks to ensure audit readiness.
• Cross‑Functional Collaboration – work closely with Engineering, Product and Security Operations teams to embed security controls into our processes and culture.
• Continuous Improvement – identify opportunities to improve the effectiveness and efficiency of our GRC program and related processes.

Essential Requirements

• A minimum of 3 years of experience in an information security role.
• Proven experience in supporting and managing compliance efforts for ISO 27001, SOC 2, and PCI DSS.
• Strong skills in security metrics and reporting.
• Experience with audit processes and evidence collection.
• A proactive, organised, and detail‑oriented approach to your work.
• Experience with GRC software is a plus.

Desired Qualifications

• CompTIA Security+
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Systems Security Professional (CISSP)

Interview Process

1. Stage 1 – 45 min with BISO.
2. Stage 2 – 60 min with Team Members.
3. Stage 3 – Final with CTO.

Company Overview

At Engine by Starling, we are on a mission to find and work with leading banks all around the world who have the ambition to build rapid‑growth businesses on our technology. Engine is Starling's software‑as‑a‑service (SaaS) business, the technology that was built to power Starling, and two years ago we split out as a separate business. Starling has seen exceptional growth and success, and a large part of that is down to the fact that we have built our own modern technology from the ground up. This SaaS technology platform is now available to banks and financial institutions all around the world, enabling them to benefit from the innovative digital features and efficient back‑office processes that have helped achieve Starling's success. As a company, everyone is expected to roll up their sleeves to help deliver great outcomes for our clients. We are an engineering‑led company and we're looking for people who will be excited by the potential for Engine's technology to transform banking in different markets around the world. We have a hybrid approach to working – our preference is that candidates are located within commutable distance of one of our offices so that we can interact and collaborate in person.

Benefits

• 33 days holiday (including public holidays, which can be taken when it works best for you)
• An extra day’s holiday for your birthday
• Annual leave increases with length of service, and you can choose to buy or sell up to five extra days off
• 16 hours paid volunteering time a year
• Salary sacrifice, company‑enhanced pension scheme
• Life insurance at 4× your salary & group income protection
• Private medical insurance with VitalityHealth, including mental‑health support and cancer care; partner benefits include discounts with Waitrose, Mr & Mrs Smith and Peloton
• Generous family‑friendly policies
• Incentives – referral‑friend scheme
• Perkbox membership giving access to retail discounts, a wellness platform for physical and mental health, and weekly free and boosted perks
• Access to initiatives like Cycle to Work, salary‑sacrifice gym partnerships and electric‑vehicle (EV) leasing

Engine by Starling is an equal‑opportunity employer, and we're proud of our ongoing efforts to foster diversity & inclusion in the workplace. Individuals seeking employment at Engine by Starling are considered without regard to race, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, physical or mental disability, military or veteran status, or any other characteristic protected by applicable law. When you provide us with this information, you are doing so at your own consent, with full knowledge that we will process this personal data in accordance with our Privacy Notice. By submitting your application, you agree that Engine by Starling and Starling will collect your personal data for recruiting and related purposes. Our Privacy Notice explains what personal information we will process, where we will process your personal information, its purposes for processing your personal information, and the rights you can exercise over our use of your personal information.