Junior GRC Analyst: ISO/SOC Audits & Risk (Hybrid)

Starling; Cardiff; Hybrid; GBP 42,000 - 65,000; Full time

Benefits offered by this job

Private Medical Insurance

Company pension scheme

Life insurance

Volunteering/charity leave

Job summary

Engine by Starling is seeking a governance, risk and compliance specialist to help maintain and mature our security program. You will collaborate with Engineering, Product and Security Operations to embed controls and support audit readiness.

The role requires hands‑on involvement with ISO 27001, SOC1/SOC2, CSTAR and PCI DSS frameworks, plus a proactive, organised approach to risk management and policy maintenance.

Qualifications

• 1 year of experience in information security or similar.
• Experience supporting and managing compliance efforts.
• Strong skills in security metrics and reporting.
• Experience with audit processes and evidence collection.
• A proactive, organised, and detail‑oriented approach.
• GRC software experience is a plus.
• Foundational certificates in IT Risk or Audit welcome.
• ISC2 Certified in Cybersecurity (CC) a bonus.
• ISO 27001 Foundation training is desirable.

Responsibilities

• Learn and support day‑to‑day management of compliance programs (ISO 27001, SOC1, SOC2, CSTAR, PCI DSS/3DS).
• Act as liaison for internal and external auditors and track remediation.
• Participate in risk assessment and document information security risks.
• Maintain information security policies, standards and procedures.
• Streamline evidence collection for audit readiness.
• Collaborate with Engineering, Product and Security Operations to embed controls.
• Identify opportunities to improve GRC processes and effectiveness.
• Assist in security awareness training delivery.

Skills

ISO 27001

SOC1

SOC2

PCI DSS

GRC software

Security metrics & reporting

Audit processes

Stakeholder engagement

Risk assessment

Tools

GRC software

Job description

Engine by Starling is seeking a governance, risk and compliance specialist to help maintain and mature our security program. You will collaborate with Engineering, Product and Security Operations to embed controls and support audit readiness.

The role requires hands‑on involvement with ISO 27001, SOC1/SOC2, CSTAR and PCI DSS frameworks, plus a proactive, organised approach to risk management and policy maintenance.