Senior GRC Analyst

EG Group; Horwich; Hybrid; GBP 60,000 - 85,000; Full time

Benefits offered by this job

Hybrid working

Discretionary bonus

Generous annual leave

Free secure on-site parking

Wellbeing facilities

Annual leave buy back

Job summary

Cumberland Farms is seeking an experienced Senior GRC Analyst to join our Information Security team. You will support governance, risk and compliance, focusing on NIS2 audit readiness, risk assessments, ISMS, and policy governance.

This hands-on role requires delivering audit-ready outcomes and collaborating with multiple stakeholders across the business. You will work independently, manage competing priorities, and drive structured information security activities, with opportunities for growth

Qualifications

• Significant practical experience in Information Security Governance, Risk and Compliance at Senior Analyst, Consultant, or equivalent level.
• Experience supporting regulatory, certification, or external security audit readiness, including evidence coordination and remediation management.
• Hands‑on experience with ISO 27001‑aligned ISMS and policy/control governance.
• Experience conducting project and technology security risk assessments and assessing control design/effectiveness.

Responsibilities

• Coordinate NIS2 audit readiness by coordinating evidence and remediation activity.
• Conduct security risk assessments across projects, systems and technology changes.
• Maintain and improve ISMS aligned to ISO 27001.
• Review and update information security policies and control frameworks.
• Assess design and operation of security controls and track improvements.
• Maintain the cyber risk register with up-to-date records.
• Coordinate audit findings, remediation activity and third‑party assessments.
• Produce GRC reporting for senior stakeholders.

Skills

GRC governance

Regulatory compliance

NIS2

ISO 27001

Risk assessments

Stakeholder management

Auditing

Policy governance

Education

CISM

CRISC

CISSP

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

GRC platforms

Job description

Company: EG Group

About the Role:

Cumberland Farms is looking for an experienced Senior GRC Analyst to join our Information Security team. Reporting to the Head of Information Security, you will provide specialist support across a range of information security governance, risk, and compliance workstreams.

The role will have a particular focus on NIS2 audit readiness, security risk assessments, ISMS and policy governance, cyber risk management, control assurance, and security awareness. You will work closely with stakeholders across Technology, Legal, Data Protection, Finance, HR, Project Delivery, and wider business operations, taking ownership of defined workstreams and delivering clear, practical, and audit-ready outcomes.

This is a hands-on, delivery-focused opportunity for an experienced GRC professional who can work independently, manage competing priorities, and bring structure and momentum to complex information security activities.

Why Join Cumberland Farms?

• Discretionary performance-based bonus scheme
• Grow your career – gain accredited qualifications, apprenticeships, and progression opportunities within a global organisation
• Hybrid working – up to 2 days per week (dependent on role and business needs)
• Salary Sacrifice Schemes – Cycle to Work and Car Scheme available
• Enhanced Maternity & Paternity leave
• Generous annual leave entitlement
• Annual leave buy back scheme – purchase up to 5 additional days
• Discounted gym membership – stay healthy and save on fitness costs
• One paid volunteering day per year
• Wellbeing facilities – space to relax and recharge
• Free secure on-site parking
• Dress Down Fridays
• Free VDU eye test

What you’ll be doing:

• Support NIS2 audit readiness by coordinating evidence, conducting readiness reviews, and tracking remediation activity.
• Conduct proportionate security risk assessments across projects, systems, and technology changes, identifying risks and recommending practical controls.
• Support the maintenance and continuous improvement of the ISO 27001-aligned Information Security Management System (ISMS).
• Review and maintain information security policies, standards, procedures, and control frameworks to ensure they remain current and aligned to business requirements.
• Assess the design and operating effectiveness of security controls, identifying gaps and tracking improvement actions through to completion.
• Maintain the cyber risk register, ensuring risks, treatments, actions, ownership, and review dates remain accurate and up to date.
• Coordinate audit findings, remediation activity, assurance evidence, and third-party security assessments, while supporting security awareness and phishing simulation campaigns.
• Produce GRC reporting and metrics for senior stakeholders and governance forums, while continuously improving GRC processes, templates, and guidance.

This list is not exhaustive and may be added to or amended from time to time.

What we’re looking for:

• Significant practical experience in Information Security Governance, Risk and Compliance at Senior Analyst, Consultant, or equivalent level.
• Demonstrable experience supporting regulatory, certification, or external security audit readiness, including evidence coordination and remediation management.
• Hands‑on experience with ISO 27001-aligned Information Security Management Systems and information security policy and control governance.
• Experience conducting project and technology security risk assessments and assessing control design and operating effectiveness.
• Strong analytical and evidence-management skills, with the ability to translate regulatory and framework requirements into practical actions.
• Confident communication and stakeholder management skills, with the ability to engage technical and non‑technical stakeholders and present to governance forums.
• A pragmatic and business‑focused approach, with the confidence to challenge weak controls, incomplete evidence, or unclear ownership.
• Relevant qualifications such as CISM, CRISC, CISSP, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor would be advantageous, as would experience with NIS2, GRC platforms, or GDPR.

Who is Cumberland Farms?

Cumberland Farms has a proud heritage dating back to 1939 and today is part of a global retail organization serving customers and communities across multiple markets including the U.S., U.K., Germany and Benelux. With operations spanning convenience retail, foodservice, fuel, and other retail formats, our business is supported by a broad network of stores, sites, distribution operations, and support teams.

As our global organization transitions under the Cumberland Farms brand, our businesses, including those historically operating as EG Group, are coming together with shared values, capabilities, and a commitment to delivering exceptional experiences for our customers and colleagues.

Together, we are building on the strength and heritage of our businesses while creating a more connected global organization with a clear strategic direction and a continued focus on supporting our customers, colleagues, and communities across all the markets we serve.

Please note - the successful applicant will be subject to a DBS check which will be funded by EG Group.