GRC Analyst – Controls Testing & Assurance

Established in 1981 with a single store in the Northwest of England, the JD Group is a leading omni-channel retailer of Sports Fashion, Outdoors and Gyms. JD Sports Fashion Plc was listed on the London Stock Exchange in 1996 and has been an FTSE100 publicly quoted company since 2019. We want to be the leading global omnichannel retailer in the sports and outdoor industry.

The GRC Analyst will sit within the second line of defence and is responsible for testing and assessing the design and operating effectiveness of IT General Controls (ITGCs) and cybersecurity controls across JD Sports. The role is focused on executing control testing, evaluating evidence, identifying control gaps and supporting audit readiness. The GRC Analyst will work closely with Technology, Internal Controls and Audit teams to ensure that the JD Sports control environment meets regulatory audit and internal risk management and control requirements.

Responsibilities

• Plan, execute and document risk-based testing of IT General Controls and cybersecurity controls across key domains including identity and access management, change management, computer operations and third-party risk.
• Assess controls for design adequacy and operating effectiveness in line with recognised frameworks such as COBIT, SOX ITGC, ISO 27001 and NIST.
• Collect, review and evaluate control evidence, applying professional scepticism and audit rigour.
• Identify control deficiencies and gaps, articulating root causes, risk impact and recommended remediation actions.
• Maintain accurate and complete working papers and test documentation.
• Support the development and maintenance of the Technology Controls Framework and ITGC and cybersecurity control library.
• Monitor and track control remediation activity, escalating overdue or high-risk items to senior stakeholders.
• Operate and provide input into Control Self-Assessment (CSA) processes.
• Support the GRC Controls Lead with internal and external auditors during IT audit cycles.
• Support preparation for inspections and audits, ensuring documentation and evidence packs are accurate, complete and audit-ready.
• Build effective working relationships and support cross-functional collaboration with other teams.
• Support in the development of clear and concise testing reports and exception summaries.
• Maintain GRC tooling, dashboards and metrics relating to ITGC and cybersecurity control coverage.
• Present findings and recommendations with clarity and confidence.
• Identify opportunities to improve the efficiency and effectiveness of the ITGC testing programme.
• Stay current with changes to relevant regulatory requirements, audit standards and industry best practice.

Qualifications

• 2-5 years of demonstrable experience in controls testing, IT audit, or GRC function.
• Strong understanding of IT General Controls domains.
• High-level and working knowledge of cybersecurity control domains.
• Ability to assess both control design and operating effectiveness.
• Experience collecting, evaluating and challenging control evidence.
• Strong written and verbal communication skills.
• Organised and methodical approach to workload management.

Required Skills

• Relevant professional certifications such as CISA, CRISC, CISSP or equivalent.
• Familiarity with audit frameworks and standards.
• Experience in a retail, e-commerce or large global enterprise environments.
• Familiarity with GRC tooling platforms.

Preferred Skills

• Independence and objectivity.
• Analytical thinking.
• Stakeholder engagement.
• Attention to detail.
• Continuous improvement.