GRC Analyst Jobs

Specialists who ensure organisations meet regulatory requirements and manage risk effectively. A critical role in the cyber security ecosystem, bridging the gap between IT and business.

Open roles
0
Salary range
£40k – £58k

GRC Analysts play a vital role in the cyber security landscape by ensuring that organisations comply with regulatory requirements and manage risks effectively. They work closely with IT, legal, and business teams to identify, assess, and mitigate potential threats. This role is particularly important in highly regulated industries such as finance, healthcare, and government, where compliance is non-negotiable.

What the role does

Inside the role of a GRC Analyst

A typical week for a GRC Analyst is a mix of risk assessments, compliance audits, and policy development.

  1. 01
    Conduct risk assessments and identify potential vulnerabilities.
  2. 02
    Review and update compliance policies and procedures.
  3. 03
    Collaborate with cross-functional teams to address security gaps.
  4. 04
    Prepare and present compliance reports to senior management.
  5. 05
    Stay updated on the latest regulatory changes and industry best practices.
Salary on the board

£40k – £58k

Based on advertised midpoints across the 9 UK listings priced in pounds in the last 12 months. Base salary only.

Salary visibility
60% of listings advertise a salary.
By seniority
£k base
Mid
40
53
6 jobs
Skills & tools

What hiring managers ask for

% of 8 listings posted in the last 12 months that mention each skill, extracted from job descriptions.

Compliance
75%
Risk Assessment
50%
ISO 27001
38%
GDPR
38%
Risk Management
38%
GRC
25%
Audit Support
25%
Governance
25%
Cybersecurity
25%
Security Audits
25%
Compliance Assessments
25%
Assurance Reviews
25%
Career ladder

From Junior to Principal

A typical UK progression for grc analysts. Years are guidance — strong people move faster, and many senior folks sidestep into research, product or management.

  1. Level 1

    Junior GRC Analyst

    0–2 yrs

    Assists in risk assessments and compliance tasks, gaining foundational knowledge of regulatory requirements.

  2. Level 2

    GRC Analyst

    2–5 yrs

    Leads risk assessments and compliance audits, developing and implementing policies to mitigate risks.

  3. Level 3

    Senior GRC Analyst

    5–8 yrs

    Manages complex compliance projects, advises on regulatory changes, and mentors junior analysts.

  4. Level 4

    Principal GRC Analyst

    8+ yrs

    Strategic leader in GRC, driving organisational compliance initiatives and influencing policy at a high level.

Pathway

How to become a GRC Analyst

There's no single route, but most people follow some version of these steps.

  1. 1

    Foundational Knowledge

    Gain a solid understanding of regulatory requirements and risk management principles.

  2. 2

    Practical Experience

    Apply knowledge in real-world scenarios through risk assessments and compliance audits.

  3. 3

    Leadership Skills

    Develop leadership and project management skills to lead compliance initiatives.

  4. 4

    Specialisation

    Specialise in specific areas of GRC, such as data privacy or cybersecurity frameworks.

  5. 5

    Strategic Influence

    Influence organisational strategy and policy, ensuring alignment with regulatory requirements.

No GRC Analyst Jobs jobs right now

We don't have any matching roles at the moment, but new jobs are added daily.

Latest jobs

Appvia logo

AWS Senior Platform Engineer (SC Eligible) – 1–2 Days a Month in Office

2 weeks ago

Appvia London £75,000 – £90,000 pa

Design, build and operate secure AWS platforms using Terraform, Kubernetes/EKS and CI/CD for public and private sector clients. You will own technical delivery in your area, create reusable modules and deployment patterns, and mentor less experienced engineers within multi-disciplinary consulting teams.

Hybrid Permanent
Cambridge University Press & Assessment (CUPA) logo

Cyber Security Lead

Last month

Cambridge University Press & Assessment (CUPA) Cambridge £71,800 – £91,600 pa

Owns the cyber security agenda for English Learning Technology, setting strategy and priorities while advising senior leaders on cyber risk across applications, platforms, suppliers and services. Leads security governance, assurance and incident response, and builds and develops a small security operations team, working closely with the central security function.

Hybrid Permanent
identifi Global Resources logo

Elastic SIEM & SOC Security Engineer/Architect

Today

identifi Global Resources Harrow

Hands-on architect role at an Elastic partner, designing SOC and SIEM architectures on Elastic/ELK for UK Defence and NATO clients. You own the architecture with the client and stay close to delivery, supporting greenfield builds and recovering existing environments alongside a team of 30+ SMEs, mostly working remotely with occasional client-site visits.

Hybrid Permanent Clearance Required
RiverSafe logo

Senior Security Consultant (Delivery & Growth)

3 weeks ago

RiverSafe London

Client-facing consulting role leading end-to-end security engagements across security architecture, cloud security, DevSecOps, application security and security operations. You'll run workshops, design controls in AWS/Azure/GCP, produce risk-based deliverables and help identify follow-on work, contributing to proposals and account growth.

Hybrid Permanent
Bridewell logo

Client Lead

3 weeks ago

Bridewell London

Owns the technical relationship between a customer and their managed security service, handling queries, escalations, projects and service improvements. Requires deep Microsoft Security stack knowledge and collaboration with customers and their suppliers to evolve Security Operations capabilities. The role is designed to integrate closely with other Managed Security Service functions, promoting cross-team collaboration and thought leadership.

Hybrid Permanent
Bridewell logo

Senior Microsoft Purview Consultant

Yesterday

Bridewell London

Consulting role focused on designing and deploying Microsoft Purview solutions across Microsoft 365 and Azure, covering DLP, Information Protection, Insider Risk Management, eDiscovery and data classification. Works directly with C-level stakeholders and compliance teams to align data governance and regulatory requirements, producing technical designs and documentation.

Hybrid Permanent
FAQs

Common questions

  • A degree in a relevant field such as cyber security, law, or business is typically required. Professional certifications like CRISC or CISM are also valuable.

  • Highly regulated industries such as finance, healthcare, and government are major employers of GRC Analysts.

  • Key skills include risk assessment, compliance knowledge, project management, and strong communication abilities.

  • Salary ranges can vary based on experience and location. For specific figures, refer to the salary section on this page.

Hiring grc analysts?

Post your role in 90 seconds and reach the specialist audience that already reads this page.