IT Governance, Risk & Compliance Analyst

About the Role

Are you early in your IT or cybersecurity career and looking to step into the fast-growing field of Governance, Risk, and Compliance (GRC)?

You don’t need prior Governance, Risk and Compliance (GRC) experience to thrive in this role, just a solid grasp of fundamental IT concepts, a logical mindset and a desire to learn. We are looking for an ambitious, curious, and analytical individual to join our team. In this role, you will act as a key liaison between technical and business teams, helping build, maintain, and monitor our IT policies, risk management frameworks, and security compliance standards.

Whether your background is in IT Support 1st/2nd line, you hold a relevant degree, or an entry-level cyber role, this is an exceptional opportunity to gain hands-on broad exposure to enterprise IT architecture, data governance, and manufacturing tech environments.

What You’ll Be Doing

• Audit & Evidence Coordination: Serve as a primary point of contact for gathering, organizing, and evaluating audit evidence against key security frameworks (ISO 27001, Cyber Essentials, NIST CSF) and regulations (GDPR, SOX).
• Risk & Control Management: Maintain our Risk Register, execute routine control testing, track non-compliance tasks, and assist with Third-Party Risk Management (TPRM) assessments.
• Policy & Framework Support: Help draft, update, and review internal IT policies to ensure alignment with industry standards and UK regulations.
• Research & Advisory: Stay up to date on evolving regulatory changes and market standards (e.g., UK Government standards), reporting back on how changes affect the business.
• Cross-Functional Collaboration: Partner with technical teams and business stakeholders across the organisation to drive security best practices and keep our GRC platform up to date.

What We’re Looking For

Essential Experience & Skills:

• IT Background: Foundation in IT technical support, helpdesk, or IT operations (Tier 1/2 experience or a relevant university/college degree).
• Enterprise Tech Awareness: Foundational knowledge of fundamental IT environments and operational concepts (such as identity and access management, system backups and basic network logic.)
• Framework Knowledge: Basic understanding of security standards such as ISO 27001 or Cyber Essentials, and why they matter to a modern business.
• Analytical Problem Solver: Ability to dive into details, evaluate control effectiveness, and propose structured solutions.
• Strong Communication & Resilience: Excellent written and verbal communication skills, with the confidence to have constructive discussions around compliance and risk.
• Curiosity & Drive: A proactive mindset and a natural desire to research, learn, and master new security frameworks and standards.

Desirable (Nice-to-Haves):

• Industry certifications such as CompTIA Security+, CISA, or similar foundational security credentials.
• Experience working in regulated sectors (EMS/Manufacturing, Defence, Cybersecurity, or Financial Services).
• Proficiency in leveraging productivity and tracking tools to monitor action items, maintain project schedules and generate clear status reports for stakeholders.