Senior Governance, Risk and Compliance Analyst

Everfox; Greater London; Hybrid; GBP 82,000 - 106,000; Full time

Benefits offered by this job

Competitive annual leave

Pension matching

Private medical insurance (PMI)

Dental

Health cash plan

Income protection

Job summary

Everfox seeks a Senior Governance, Risk, and Compliance Analyst in London or Malvern. The role focuses on mapping security controls to regulatory requirements, leading audit activities, and driving ongoing compliance across on‑prem and cloud environments.

Hybrid work arrangement is available. The ideal candidate will have cloud security expertise (Azure), strong communication skills, and a proven track record in delivering certifications such as ISO 27001 and GDPR compliance, with experience in

Qualifications

• Bachelor’s degree or equivalent required.
• 5+ years in information security roles with cloud/on-premise experience.
• Experience coordinating external audits and certifications.

Responsibilities

• Lead governance, risk and compliance activities across programs.
• Coordinate audits with external auditors for ISO 27001, GDPR, NIST, and others.
• Support privacy program and GDPR compliance through PIAs and data mappings.
• Develop and maintain security controls mapping and evidence collection.

Skills

Governance & Compliance

Risk management

Privacy program

Security audits

Cloud security

Stakeholder communication

Auditing experience

Education

Bachelor’s degree

Tools

Azure

GRC tools

Job description

**Job Title:** Senior Governance, Risk, and Compliance Analyst **Job Location:** London, Hybrid (2-3 days per week) or Malvern, Hybrid **Description:** The Senior Governance, Risk, and Compliance Analyst is responsible for understanding security requirements to meet industry best practices with a focus on certification and regulatory requirements. As part of this role, this role is responsible for mapping these requirements to security controls and actionable practices across various functions within the company. In some instance this individual will be responsible for designing security controls that best fit our environment while maintaining security compliance. Finally applying automation to as many controls as practicable to ensure on-going compliance (e.g., evidence collection) and managing compliance programs from a centralized governance management system. This role is technical and analytical in nature and demands a fast learner with a history of technical knowledge and cloud security experience combined with business experience working in both on-premises and cloud product vendor environment (ideally Azure). The ideal candidate will be highly skilled in translating security governance and compliance requirements to a wide range of company functional units, helping these functional units understand the need for, and approach to comply with information security policies, required security controls and how to appropriately capture evidence of compliance on an on-going basis. This role requires extensive experience in successfully completing security audits for certification programs. The role should have experience working in a cloud product environment for several years. **Duties and Responsibilities:** **Governance and Compliance:** * Working with external security auditors for various certification programs including DCC CSM, Cyber Essentials, ISO 27001, JOSCAR, NIST 800-171/CMMC, GDPR, ITGC, and various others to facilitate successful internal and external security audits that lead to industry certifications.* Ensure all security controls required for several security certification programs including DCC CSM, Cyber Essentials, ISO 27001, among others are designed, operational, and properly mapped. This includes annual review and updating of existing IS Policies, Standards, and Procedures, as well as development of new documents as necessary to support GRC requirements.* Work with cross-functional teams to ensure all security controls are fully operational and compliant with evidence being captured on an on-going basis as part of compliance monitoring program.* Build awareness and accountability around IT governance, risk, and compliance control functions Contribute to developing and enhancing a mature security culture.* Report on status of security audits for various security programs, ensuring auditors are managed, and evidence is provided in a timely manner.* Deliver strong communication enterprise-wide with all levels of personnel, including executives, business functional heads and technical staff. **Risk Management:** * Contribute to Cybersecurity Risk Management activities including risk assessments, reporting, and remediation planning.* Analyze and lead enterprise security program overview discussions and coordinate gap remediation efforts with business functions.* Analyze key business processes to produce comprehensive risk scenarios that will be implemented by working with and through business leaders and information security risk architecture. Understanding of NIST 800-30 and 37 preferred.* Provide support with business continuity (BC) and disaster recovery (DR) program, assist with coordination and compliance for required BC/DR processes. **Privacy Program Support:** * Maintain awareness of GDPR to support the implementation and monitor privacy compliance programs to include Privacy Impact Analysis (PIA).* Understand the flow of information and how the information is utilized and use that knowledge to support the integrity of the Privacy compliance program. **People Management** * This role does not have direct reports. **Qualifications and Experience:** * Bachelor’s degree preferred or equivalent combination of education, training, and experience* 7+ years of work experience related to the Information Security disciplines, with a minimum of 5 years working in on-premises and cloud product vendor environment (ideally Azure).* Strong communication skills for various communicating at various levels in the organization.* Familiarity with common technical security controls and control frameworks such as DCC CSM, Cyber Essentials, ISO 27001, JOSCAR, NIST 800-171/CMMC, ITGC, among others.* Familiarity with ISO 42001 is a plus.* Industry recognized certifications are a plus, e.g., CISSP, CISM, GIAC, etc.* Team-oriented and will promote execution and change through influence and partnership.* Experience clearly articulating cybersecurity risk into business terms and presenting to company management.* Must be based in UK to support UK MOD customers.A reasonable estimate of the base salary range for this role is:£81,900.00-105,500.00 GBP The actual salary offered may vary within the range based on a candidates' unique experience, locale, and business needs. In addition to base salary and either bonus or commission, Everfox offers a generous benefits package including competitive annual leave, pension match, PMI, dental, health cash plan, income protection, in a hybrid work environment. Our Talent Acquisition team will provide specific information regarding salary and benefits offerings. \\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_\\_ *Don’t meet every single qualification? Studies show people are hesitant to apply if they don’t meet all requirements listed in a job posting. If there is something slightly different about your previous experience, but it otherwise aligns and you’re excited about this role, we encourage you to apply. You could be a great candidate for this or other roles on our team.* *Everfox is an equal employment opportunity employer and complies with all applicable federal, state, and local laws prohibiting discrimination. Everfox does not discriminate against any employee or applicant based on race, color, religion, sex, age, national origin, disability, veteran status, marital status, medical condition, or any other category protected by applicable law. If you are a qualified individual with a disability or a disabled veteran, you may request a reasonable accommodation if you are unable or limited in your ability to use or access the Company’s career webpage as a result of your disability. You may request reasonable accommodations by sending an email to* *[e-mail]**.* *Applicants must have the right to work in the location to which you have applied.*