Senior Governance, Risk & Compliance (GRC) Analyst

This is ahands-on, audit-focused GRC role for someone who can come in and make an immediate impact. The priority is supportingNIS2 audit readiness, strengthening the organisation'sISO 27001-aligned ISMS, coordinating evidence and identifying and closing control gaps.

Salary: up to £80,000
Location: Greater Manchester
Contract: 6-Month Fixed-Term Contract
Start: Immediate starts available

A large, established organisation is looking for an experiencedSenior GRC Analyst to join its Information Security function on an initial six-month fixed-term basis.

This is ahands-on GRC role with a strong focus on NIS2, audit readiness, risk and control assurance. You'll be joining at an important stage of the organisation's regulatory and security programme, helping to assess current maturity, coordinate evidence, identify gaps and drive remediation.

We're particularly interested in candidates who havepractical experience applying NIS2 requirements, rather than simply having an awareness of the directive. Experience working through a regulatory assessment, audit or readiness programme, and translating requirements into controls, evidence and actions, will be highly relevant.

• Support the organisation'sNIS2 readiness programme, helping assess requirements, gather evidence and identify areas requiring further action.
• TranslateNIS2 requirements into practical security controls, processes, policies and evidence.
• Conduct NIS2 and broader securitygap and readiness assessments, tracking findings through to remediation.
• Work with stakeholders across Technology and the wider business to obtain and validate evidence against regulatory and security requirements.
• Maintain and continuously improve the organisation'sISO 27001-aligned ISMS, including policies, controls, processes and supporting documentation.
• Assess the design and operating effectiveness of information security controls.
• Supportinternal, external and third-party audits, coordinating evidence, findings and remediation activity.
• Conduct practical security risk assessments across projects, systems and technology changes.
• Maintain the cyber risk register, ensuring risks, treatments, owners and actions remain accurate and current.
• Produce clear GRC reporting and metrics for senior stakeholders and governance forums.
• Work with technical and non-technical stakeholders to turn regulatory requirements into practical, proportionate security improvements.

You will have strong practical experience withinInformation Security Governance, Risk & Compliance, ideally gained within a large or complex organisation.

Essential:

• Proven hands-on experience supporting or leadingsecurity audits, compliance assessments or audit-readiness programmes.
• Practical experience working withNIS2, particularly around readiness assessments, evidence, controls, gap analysis and remediation.
• Good understanding of howNIS2 requirements translate into practical information security controls and governance processes.
• Practical experience withISO 27001, including maintaining or developing an ISMS, controls, policies and supporting evidence.
• Experience identifying control gaps and coordinating remediation through to completion.
• Experience conducting security risk assessments and assessing control effectiveness.
• Strong evidence management skills and the ability to work through large volumes of audit and compliance information.
• A pragmatic approach, with the ability to translate regulatory requirements into practical actions.
• Confident stakeholder management skills across technical and non-technical teams.

Desirable:

• PCI DSS experience.
• ISO 27001 Lead Auditor or Lead Implementer.
• CISM, CRISC or CISSP.
• Experience working with GRC platforms.
• GDPR experience.
• Experience producing GRC reporting and presenting findings to senior stakeholders.

We're particularly interested in candidates who havepersonally worked through an audit, regulatory assessment or readiness exercise, rather than simply having high-level exposure to compliance.

You may have experience supporting aNIS2 readiness programme, preparing an organisation for an external audit, or helping establish the controls, processes and evidence required from a less mature starting point.

You'll be comfortable getting into the detail, challenging gaps, working with stakeholders to obtain evidence and driving actions through to completion.

The ability tostart at short notice would be highly advantageous, with immediate starts available.

If you're an experienced GRC professional with practical NIS2 and audit experience, we'd be keen to hear from you.

Robert Walters Operations Limited is an employment business and employment agency and welcomes applications from all candidates