Senior GRC Analyst — Security Compliance Monitoring
Job Description
Role purpose
Senior practitioner inside the Security Compliance Monitoring team. Beyond executing monitoring activities, you bring independent judgment, raise the quality bar for the more junior analysts, and partner with the Assistant Manager on complex or ambiguous work. The person we trust to think, not just do — and to coach the rest of the team to do the same.
Key responsibilities
- Lead the more complex control monitoring activities: those requiring interpretation, judgment on evidence sufficiency, or direct dialogue with control owners.
- Technical reviewer for junior analysts' work: spot-check evidence packages, validate findings, and provide constructive written feedback.
- Own end-to-end specific compliance workstreams (e.g. supplier security reviews, policy exception management, AI governance evidence) with minimal supervision.
- Coach junior analysts on framework interpretation, stakeholder communication, and thinking about control effectiveness, not just existence.
- Partner with the Assistant Manager on SOP design, quality reviews, and continuous improvement; surface patterns and recommend changes.
- Represent the offshore team in onshore meetings on assigned topics; support audit preparation as a senior point of contact.
Qualifications
Must-have qualifications
- 5+ years in GRC, IT audit, information security, or a closely related field, with clear progression in scope and responsibility.
- Solid command of ISO/IEC 27001 (Annex A, ISMS clauses) and the ability to interpret controls in context, not mechanically.
- Demonstrated track record working with ambiguity: situations where the standard answer doesn't fit and judgment is required.
- Strong written English; able to produce stakeholder-ready analyses, briefing notes, and audit narratives with limited rework.
- Relevant certification: ISO 27001 Lead Implementer / Lead Auditor, CISA, CISM, or equivalent.
Nice to have
- Exposure to AI governance (ISO/IEC 42001, NIST AI RMF), NIS2, or DORA programs.
- Experience mentoring junior colleagues without formal line-management responsibility.
Background in retail, wholesale, or comparably large enterprise
