Senior GRC Analyst

Senior GRC Analyst (Audit and Assurance) | Poland, Remote

You’ll prepare and run the external audit programme for ISO 27001, SOC 1 and SOC 2 at an enterprise SaaS company trusted by major global banks. In the first phase, you’ll also own the enterprise risk register and present risk reporting to the Executive Leadership Team.

• Salary: competitive, plus annual performance bonus
• Level: Senior, reporting to the Security GRC Manager

Senior GRC Analyst - What you’ll actually do:

• Lead audit readiness, including evidence collection and control walkthroughs, and track findings to closure
• Test control design and operating effectiveness, and close the gaps you find
• Own the risk register and the frameworks for risk appetite, exceptions and prioritisation
• Run Information Security risk assessments across technology and physical locations
• Support third-party risk assessments and client audits
• Help review higher-risk AI use cases and shape responsible AI standards

Over time, risk management moves to another team member so you can focus mainly on audit and assurance.

Senior GRC Analyst - What you’ll need:

• At least five years in Information Security or a comparable role
• Hands-on support of external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including control testing and direct work with auditors
• Technology risk management experience, with the ability to explain technical findings in business terms
• Experience supporting an established ISMS and maintaining accreditations
• Experience managing or supporting third-party security assessments
• Fluent English and confidence working with UK stakeholders and external auditors

Nice to have:

• Financial services or another regulated industry
• ISO 27001 Lead Auditor or Lead Implementer, CISA or CRISC
• IT audit experience at a Big Four or comparable firm
• Familiarity with DORA

What’s in it for you

• Private medical insurance, healthcare cashback scheme and 4x salary life assurance
• Unlimited annual holiday and enhanced family leave
• Work abroad for up to 6 weeks a year
• Learning and development budget

If you meet most but not all of the essentials, we’d still like to hear from you.