Senior IT Security & GRC Analyst

Sanderson; England; On-site; GBP 65,000 - 90,000; Full time

Job summary

Sanderson is seeking a Senior IT Security Analyst to join its Information Security function in the UK. The role spans governance, risk, compliance and security assurance, with exposure to technical security work and business stakeholder engagement.

You will support audits, strengthen governance, and help automate evidence collection and reporting. The ideal candidate has 2–5 years of information security experience, solid ISO 27001 knowledge, and relevant certifications.

Qualifications

• Experience with ISO 27001 controls and compliance processes.
• Knowledge of cyber governance, risk management and assurance.
• Experience supporting audits and coordinating remediation.
• Exposure to risk assessments, risk registers and control reviews.
• Experience handling security questionnaires and supplier assurance.

Responsibilities

• Support development and improvement of information security policies, standards and controls.
• Coordinate internal and external security audits and track remediation.
• Maintain risk registers and work with stakeholders on mitigation.
• Contribute to governance and assurance activities across the business.
• Support customer and third‑party security assurance activities.

Skills

ISO 27001

GRC

Security governance

Risk management

Audits

Security controls

Stakeholder communication

Automation mindset

Education

ISO 27001 Foundation/Lead Implementer

Security+

CISA

Tools

Microsoft security technologies

Security governance tools

Cloud security tooling

Microsoft Defender

Azure Security Center

Job description

Sanderson is seeking a Senior IT Security Analyst to join its Information Security function in the UK. The role spans governance, risk, compliance and security assurance, with exposure to technical security work and business stakeholder engagement.

You will support audits, strengthen governance, and help automate evidence collection and reporting. The ideal candidate has 2–5 years of information security experience, solid ISO 27001 knowledge, and relevant certifications.