Senior Governance, Risk & Compliance (GRC) Analyst - £80K

This is a hands-on, audit-focused GRC role for someone who can come in and make an immediate impact. The priority is supporting NIS2 audit readiness, strengthening the organisation's ISO 27001-aligned ISMS, coordinating evidence and identifying and closing control gaps.

Senior Governance, Risk & Compliance (GRC) Analyst – Information Security

Salary: up to £80,000
Location: Greater Manchester
Contract: 6-Month Fixed-Term Contract
Start: Immediate starts available

A large, established organisation is looking for an experienced Senior GRC Analyst to join its Information Security function on an initial six-month fixed-term basis.

This is a hands-on GRC role with a strong focus on NIS2, audit readiness, risk and control assurance. You'll be joining at an important stage of the organisation's regulatory and security programme, helping to assess current maturity, coordinate evidence, identify gaps and drive remediation.

We're particularly interested in candidates who have practical experience applying NIS2 requirements, rather than simply having an awareness of the directive. Experience working through a regulatory assessment, audit or readiness programme, and translating requirements into controls, evidence and actions, will be highly relevant.

What you'll do

• Support the organisation's NIS2 readiness programme, helping assess requirements, gather evidence and identify areas requiring further action.
• Translate NIS2 requirements into practical security controls, processes, policies and evidence.
• Conduct NIS2 and broader security gap and readiness assessments, tracking findings through to remediation.
• Work with stakeholders across Technology and the wider business to obtain and validate evidence against regulatory and security requirements.
• Maintain and continuously improve the organisation's ISO 27001-aligned ISMS, including policies, controls, processes and supporting documentation.
• Assess the design and operating effectiveness of information security controls.
• Support internal, external and third-party audits, coordinating evidence, findings and remediation activity.
• Conduct practical security risk assessments across projects, systems and technology changes.
• Maintain the cyber risk register, ensuring risks, treatments, owners and actions remain accurate and current.
• Produce clear GRC reporting and metrics for senior stakeholders and governance forums.
• Work with technical and non-technical stakeholders to turn regulatory requirements into practical, proportionate security improvements.

What we're looking for

You will have strong practical experience within Information Security Governance, Risk & Compliance, ideally gained within a large or complex organisation.

Essential:

• Proven hands-on experience supporting or leading security audits, compliance assessments or audit-readiness programmes.
• Practical experience working with NIS2, particularly around readiness assessments, evidence, controls, gap analysis and remediation.
• Good understanding of how NIS2 requirements translate into practical information security controls and governance processes.
• Practical experience with ISO 27001, including maintaining or developing an ISMS, controls, policies and supporting evidence.
• Experience identifying control gaps and coordinating remediation through to completion.
• Experience conducting security risk assessments and assessing control effectiveness.
• Strong evidence management skills and the ability to work through large volumes of audit and compliance information.
• A pragmatic approach, with the ability to translate regulatory requirements into practical actions.
• Confident stakeholder management skills across technical and non-technical teams.

Desirable:

• PCI DSS experience.
• ISO 27001 Lead Auditor or Lead Implementer.
• CISM, CRISC or CISSP.
• Experience working with GRC platforms.
• GDPR experience.
• Experience producing GRC reporting and presenting findings to senior stakeholders.

The right person

We're particularly interested in candidates who have personally worked through an audit, regulatory assessment or readiness exercise, rather than simply having high-level exposure to compliance.

You may have experience supporting a NIS2 readiness programme, preparing an organisation for an external audit, or helping establish the controls, processes and evidence required from a less mature starting point.

You'll be comfortable getting into the detail, challenging gaps, working with stakeholders to obtain evidence and driving actions through to completion.

The ability to start at short notice would be highly advantageous, with immediate starts available.

If you're an experienced GRC professional with practical NIS2 and audit experience, we'd be keen to hear from you.

Robert Walters Operations Limited is an employment business and employment agency and welcomes applications from all candidates