GRC Analyst – Governance, Risk & Compliance

About the role

We are seeking a GRC Analyst to join a fast‑scaling, payments‑focused organisation in the United Kingdom. Working remotely, you will be at the centre of governance, risk and compliance operations, translating complex regulatory requirements into practical, day‑to‑day processes.

Key responsibilities

• Own audit readiness activities, maintain continuous evidence collection and coordinate external auditors for SOC 2, PCI DSS and ISO 27001.
• Handle external security and compliance requests, including vendor assessments, security questionnaires and RFP responses.
• Support enterprise risk and compliance programmes aligned with GDPR, DORA, NIS2 and the EU AI Act.
• Maintain the policy lifecycle – updates, exception handling, violation tracking and remediation.
• Contribute to certification efforts and expand into new compliance frameworks as the business evolves.
• Collaborate with engineering and security teams to operationalise controls and strengthen vulnerability management.
• Ensure continuous compliance visibility through structured documentation and ongoing monitoring.

Required profile

• 3‑5 years of experience in GRC, compliance or information security governance.
• Hands‑on experience supporting external audits such as SOC 2, PCI DSS or ISO 27001.
• Familiarity with GDPR, DORA, NIS2 and emerging EU compliance standards.
• Experience managing vendor risk assessments and third‑party due diligence.
• Strong organisational skills and ability to manage multiple compliance workflows.

Required skills

• SOC 2, PCI DSS, ISO 27001 frameworks
• GDPR, DORA, NIS2, EU AI Act regulations
• Continuous control monitoring and evidence management
• Vendor risk assessment processes
• GRC platforms such as Vanta, Drata, OneTrust