GRC Analyst

We’re looking for a contract GRC Analyst to support a client side engagement, reporting to the programme Security Architect. You will support the day-to-day management of cyber and technology risk across the programme, making sure risks are properly understood, clearly articulated and actively driven to resolution. Working closely with the Security Architect, you’ll turn technical findings and control gaps into business risks that decision-makers can act on, and help put consistent, repeatable risk management practice in place across the programme.

Scope of work

Risk identification and assessment Assess cyber, technology and business change risks arising across the programme, working with the Security Architect to understand design decisions and their security implications Write well-structured risk statements that set out the threat, the weakness being exploited, the existing controls and the potential impact on the business Convert technical findings, assessment outputs and control weaknesses into risks expressed in business terms

Risk registers and treatment Set up and maintain the programme’s cyber and technology risk registers, keeping them accurate, current and fit for governance Agree risk treatment plans with accountable owners, with clear actions, timescales and target risk positions Monitor progress on remediation and mitigation, following up on slipping actions and escalating where necessary

Framework and assurance support Support activity against the NCSC Cyber Assessment Framework (CAF), including gathering evidence, recording outcomes and tracking improvement actions Map risks and controls to relevant frameworks such as ISO 27001 & NIST

Governance, reporting and engagement Run risk review sessions and workshops with technical teams, delivery leads and business stakeholders Prepare concise risk reports and management information for [programme board / senior leadership] Help define and embed consistent risk methods, templates and governance processes across the programme

Key deliverables: A maintained, governance-ready cyber and technology risk register for the programme Agreed treatment plans for identified risks, with tracked progress to closure CAF evidence and remediation tracker Regular risk reporting to the project team Documented risk management approach and templates for ongoing use

What you’ll bring: Proven experience in a GRC, cyber risk, technology risk or information security risk analyst role Practical experience applying NIST guidance, including control mapping Hands-on experience running and maintaining risk registers and completing risk assessments The ability to write clear, meaningful risk statements and explain complex risks to non-technical audiences Experience following remediation actions through to completion and holding owners to account Confidence working independently from day one within a programme environment Strong written, reporting and stakeholder engagement skills