Security GRC Associate: Third-Party Risk & AI Controls

Academic Key; Greater London; On-site; GBP 50,000 - 70,000; Full time

Job summary

Trainline is hiring a Security GRC Associate in London to run third‑party security risk assessments, review assurance evidence, and document risks. You will collaborate with Procurement, Legal, Privacy and Enginering to embed security requirements in onboarding and renewals, while supporting ISO 27001 assurance and risk management improvements.

With experience in GRC and a strong grasp of ISO27001, you’ll help shape risk-based supplier assurance, monitor remediation, and contribute to automation

Qualifications

• Experience in information security, GRC, third‑party risk management or a related cyber security discipline.
• Hands‑on experience running third‑party security assessments, reviewing supplier assurance documentation or supporting vendor risk processes.
• Working knowledge of security standards and frameworks, particularly ISO 27001, ISO 27002 and NIST CSF.
• Experience working with stakeholders across functions, such as Procurement, Legal, Technology and business teams.
• Strong analytical and problem‑solving skills, a sharp eye for detail, and the ability to manage several assessments and competing priorities at once.
• Clear written and verbal communication, with the confidence to explain security requirements to technical and non‑technical audiences.
• A proactive, curious mindset and a real interest in improving how security governance and risk management are delivered.

Responsibilities

• Run third‑party security risk assessments for new and existing suppliers, including SaaS and cloud providers, technology partners and business‑critical vendors.
• Review supplier assurance evidence, such as ISO 27001 certificates, SOC 2 reports, security questionnaires and penetration test summaries, and judge whether the controls in place are adequate.
• Identify and document third‑party security risks and recommend proportionate ways to reduce them.
• Help assess the security risks of AI tools, applications and third‑party AI integrations, working with the wider GRC and InfoSec teams to review controls and track remediation.
• Partner with Procurement, Legal, Privacy and Engineering to build security requirements into supplier onboarding, procurement and contract renewals.
• Keep third‑party risk records up to date, track remediation actions, and elevate material risks to stakeholders and governance forums.
• Help shape a risk‑based approach to ongoing supplier assurance, including periodic reassessments and monitoring of critical suppliers.
• Help improve our Third‑Party Risk Management framework, including supplier risk classification, assessment methods, questionnaires and reporting.
• Support ISO 27001 assurance work, such as control assessments, evidence gathering, audit preparation and remediation tracking, and help maintain our unified internal control framework.
• Help build and improve our GRC tooling, using automation and AI to speed up questionnaire reviews, evidence analysis, control mapping and risk reporting.

Skills

Information security

GRC

Third-party risk management

Stakeholder management

ISO 27001 / ISO 27002

NIST CSF

Analytical thinking

Communication skills

Problem-solving

SaaS / cloud risk assessments

Education

Relevant cert

Tools

ServiceNow GRC

Archer

LogicGate

Vanta

Compyl

Job description

Trainline is hiring a Security GRC Associate in London to run third‑party security risk assessments, review assurance evidence, and document risks. You will collaborate with Procurement, Legal, Privacy and Enginering to embed security requirements in onboarding and renewals, while supporting ISO 27001 assurance and risk management improvements.

With experience in GRC and a strong grasp of ISO27001, you’ll help shape risk-based supplier assurance, monitor remediation, and contribute to automation