Remote GRC & Third-Party Risk Analyst

Viqu Limited; Cheltenham; Remote; GBP 65,000 - 78,000; Full time

Job summary

VIQU Limited is seeking a GRC/Third-Party Risk Analyst to lead supplier security activities. The role focuses on accelerating third-party assessments, validating ISO 27001, and challenging vendor security claims while collaborating with procurement, legal, and IT teams.

You will evaluate risk evidence, score governance controls, and drive remediation workflows to maintain security standards across the vendor landscape. Remote role with occasional travel to Cheltenham.

Qualifications

• 2-4+ years of experience in Information Security, GRC, or Third-Party Risk Management (TPRM).
• Solid working knowledge of ISO 27001 with validation experience, plus familiarity with NIST CSF or SOC 2.
• Ability to read security evidence, cross-examine vendor responses, and challenge claims.
• Understanding of third-party risk scoring, data protection principles, and security schedules in contracts.
• Strong communication to bridge technical findings with non-technical teams.

Responsibilities

• Drive end-to-end third-party and vendor security risk assessments from scoping to final risk rating.
• Review security questionnaires, vendor self-assessments, and risk artifacts.
• Inspect security documentation (SOC 2, policies, whitepapers) and review clauses in contracts.
• Validate ISO 27001 certifications, SoA, and audit reports to confirm coverage.
• Identify gaps, residual risks, and compensating controls; support remediation tracking.
• Track findings and support risk treatment or waiver workflows.

Skills

InfoSec experience

GRC/TPRM

ISO 27001

SOC 2

Contract risk

Stakeholder comms

Job description

VIQU Limited is seeking a GRC/Third-Party Risk Analyst to lead supplier security activities. The role focuses on accelerating third-party assessments, validating ISO 27001, and challenging vendor security claims while collaborating with procurement, legal, and IT teams.

You will evaluate risk evidence, score governance controls, and drive remediation workflows to maintain security standards across the vendor landscape. Remote role with occasional travel to Cheltenham.