Junior Information Security & GRC Analyst

Starling Bank; Cardiff; Hybrid; GBP 45,000 - 70,000; Full time

Benefits offered by this job

33 days holiday

Birthday day off

Private medical insurance

Pension scheme

Life insurance

Perkbox membership

Cycle to Work

EV leasing

Job summary

Engine by Starling is seeking an early-career security professional to help maintain and mature our governance, risk, and compliance program. You will work hands-on across ISO 27001, SOC1/2, CSTAR and PCI DSS, collaborating with Engineering, Product and Security Operations to embed controls.

The role emphasises risk assessment, evidence collection, audit readiness, and ongoing security awareness for all staff, with a hybrid working arrangement.

Qualifications

• 1+ year in an information security role.
• Experience supporting and managing compliance efforts.
• Strong skills in security metrics and reporting.
• Experience with audit processes and evidence collection.
• Proactive, organized and detail-oriented work style.

Responsibilities

• Support day-to-day management of our compliance programs (ISO 27001, SOC1, SOC2, CSTAR, PCI DSS/3DS).
• Liaise with internal/external auditors; gather evidence and track remediation.
• Assist in risk assessment, identify and document information security risks.
• Develop and maintain information security policies, standards, and procedures.
• Streamline evidence collection for audit readiness.
• Collaborate with Engineering, Product and Security Operations to embed security controls.
• Identify opportunities to improve GRC processes and training.

Skills

Information security

Audits & controls

Security metrics

Proactive & detail-oriented

GRC software

Education

Foundational IT risk/audit certs

ISC2 Cybersecurity (CC)

ISO 27001 Foundation training

Tools

GRC software

Job description

Engine by Starling is seeking an early-career security professional to help maintain and mature our governance, risk, and compliance program. You will work hands-on across ISO 27001, SOC1/2, CSTAR and PCI DSS, collaborating with Engineering, Product and Security Operations to embed controls.

The role emphasises risk assessment, evidence collection, audit readiness, and ongoing security awareness for all staff, with a hybrid working arrangement.