GRC risk Analyst

GRC/ Third Party Risk Analyst

Remote - occassional ad hoc travel to Cheltenham

Dureaction - 6 months

Day rate - £350 - 425 a day

We are looking for a detail-driven GRC / Third-Party Risk Analyst to join our team on a full-time basis. In this role, you will be the core driver of our supplier security program, helping streamline, scale, and accelerate third-party security assessments without compromising security standards. You will partner closely with procurement, legal, IT, and internal business owners to evaluate third-party risks and challenge vendor security claims effectively.

Key Responsibilities

• Accelerate Third-Party Assessments: Drive end-to-end third-party and vendor security risk assessments from initial scoping to final risk rating in a timely manner. [
• Due Diligence & Questionnaires: Administer, review, and score security questionnaires, vendor self-assessments, and risk artifacts.
• Evidence & Contract Review: Inspect security documentation (e.g., SOC 2 reports, policies, technical whitepapers) and review security/data protection clauses in third-party contracts.
• ISO 27001 Validation: Validate ISO 27001 certifications, Statements of Applicability (SoA), and supporting audit reports to confirm true control coverage rather than taking claims at face value.
• Challenge & Identify Gaps: Critically interrogate supplier security posture, spot discrepancies or weak controls, and document residual risks or compensatory controls.
• Remediation & Tracking: Track open findings, follow up with internal and external stakeholders, and support risk treatment or waiver workflows.

Required Skills & Qualifications

• Experience: 2–4+ years of experience in Information Security, GRC (Governance, Risk, and Compliance), or Third-Party Risk Management (TPRM).
• Framework Knowledge: Solid working knowledge of ISO 27001 (mandatory validation experience) alongside familiarity with frameworks like NIST CSF or SOC 2.
• Critical Evaluation: Proven ability to read technical security evidence, cross-examine vendor responses, and push back against superficial or incomplete security assertions.
• Contract & Risk Acumen: Understanding of third-party risk scoring models, data protection principles, and security schedules in commercial contracts.
• Communication: Strong interpersonal and stakeholder-management skills to bridge the gap between technical security findings and non-technical business/procurement teams.