Security GRC Analyst (ISO 27001 & Risk)

Clue; West of England; Hybrid; GBP 60,000 - 70,000; Full time

Job summary

Clue is seeking a Security Governance, Risk and Compliance Analyst to maintain our ISO 27001 ISMS, manage the risk register, and coordinate customer security assurance and incident responses. You will work between the CISO, DevSecOps, and IT Operations to ensure evidence, obligations and governance are current.

You will help drive risk-based decision making, oversee supplier assessments, and ensure regulatory and contractual security requirements are met while embracing AI tools appropriately.

Qualifications

• Experience working within an ISO 27001 ISMS, ideally in a SaaS organisation.
• Maintaining a risk register and treatment plans with senior risk owners.
• Responding to customer security questionnaires and due diligence.
• Coordinating incident response and regulatory notifications.
• Managing third-party risk and supplier assurance processes.

Responsibilities

• Administer the information security policy and ISMS documentation.
• Maintain ISO 27001:2022 certification and related evidence.
• Lead customer security assurance and due diligence responses.
• Coordinate risk register reviews and risk treatment with sponsors.
• Oversee incident coordination, notifications and post-incident actions.
• Manage third-party risk assessments and supplier reviews.
• Maintain governance cadence across security forums and reporting.

Skills

Information security

Customer assurance

Third-party governance

Incident management

Technical literacy

Communication

Education

ISO27001 Lead Implementer/Lead Auditor, CISM, CRISC, CISMP or equivalent

Tools

TPRM platform

Job description

Clue is seeking a Security Governance, Risk and Compliance Analyst to maintain our ISO 27001 ISMS, manage the risk register, and coordinate customer security assurance and incident responses. You will work between the CISO, DevSecOps, and IT Operations to ensure evidence, obligations and governance are current.

You will help drive risk-based decision making, oversee supplier assessments, and ensure regulatory and contractual security requirements are met while embracing AI tools appropriately.