Security GRC Analyst: Architecture, Policy & Risk

G.Digital; Manchester; On-site; GBP 45,000 - 65,000; Full time

Job summary

A large public sector organisation in Manchester is seeking an Analyst to join its Information Security team on a permanent basis. The role blends security architecture, compliance, policy development, risk management and stakeholder engagement.

You will design and maintain security architectures, lead audits, write policies, conduct risk assessments, support third‑party risk, and deliver security awareness training while collaborating with IT, data protection, legal and operations.

Qualifications

• Operational security background in a security role.
• Experience writing and implementing security policies and conducting audits.
• Familiarity with GDPR, ISO 27001, Cyber Essentials Plus, and NCSC CAF is preferred.
• Experience working with IT teams to improve controls.
• Public sector or higher education environments desirable.

Responsibilities

• Designing and maintaining security architectures aligned with guidelines and sector best practice.
• Leading internal security audits and contributing to external assurance.
• Writing and maintaining information security policies and standards.
• Conducting risk assessments and managing the security risk register.
• Supporting third-party security risk management.
• Delivering security awareness training across the organisation.
• Collaborating with IT, data protection, legal and operational teams to embed security at every level.

Skills

Security architecture

Compliance management

Policy development

Risk management

Stakeholder engagement

Security audits

Security awareness training

DevSecOps familiarity

SIEM tooling

Tools

SIEM tooling

DevSecOps practices

Job description

A large public sector organisation in Manchester is seeking an Analyst to join its Information Security team on a permanent basis. The role blends security architecture, compliance, policy development, risk management and stakeholder engagement.

You will design and maintain security architectures, lead audits, write policies, conduct risk assessments, support third‑party risk, and deliver security awareness training while collaborating with IT, data protection, legal and operations.