The GRC Analyst strengthens PCI Pal's central Information Security function by providing structured governance, risk and compliance analysis across audit, assurance, control management and strategic change. The role turns requirements, evidence, risks and delivery updates into accurate, traceable information that supports timely decisions by the GRC Lead and CISO. The role works in close partnership with the Information Security Project Manager to track ongoing and strategic initiatives, maintain clear ownership and delivery visibility, and provide concise, evidence-based updates. It remains a GRC role: the Analyst provides assurance, analysis and tracking, while the Project Manager retains responsibility for project governance, planning and delivery coordination. Job requirements Relevant experience in GRC, information security compliance, risk management, internal audit or assurance. Working knowledge of at least one major framework, such as PCI DSS, ISO/IEC 27001, SOC 2 or NIST CSF, with the ability to apply requirements in practice. Experience reviewing policies, audit reports, control narratives and evidence, and translating findings into clear actions. Strong organisation and tracking skills, including the ability to maintain plans, actions, risks, dependencies and status reporting across multiple concurrent initiatives. Strong written and verbal communication skills, with the ability to produce concise, accurate updates for operational and senior stakeholders. A collaborative working style and the confidence to challenge incomplete evidence, unclear ownership or unsupported status updates. High attention to detail, sound analytical judgement and the ability to manage priorities with limited supervision. Experience operating within a PCI DSS Level 1 service provider, regulated technology or cloud services environment. Familiarity with ISO/IEC 42001, ISO 9001, HIPAA/HITECH, Cyber Essentials or related assurance frameworks. Experience using GRC, audit, project tracking or evidence automation platforms, such as Drata, Jira, ServiceNow GRC, Archer or OneTrust. Experience supporting programme governance, PMO reporting or strategic transformation initiatives in partnership with a Project Manager. Experience reviewing AI-generated content, data annotation, quality assurance or AI governance workflows. Relevant qualification or certification in information security, risk, audit, compliance or project delivery. Job responsibilities Support the CISO, GRC Lead and wider Information Security team with risk, compliance and control analysis. Maintain governance artefacts including policies, standards, control mappings, risk registers, Statements of Applicability and supporting records. Review security policies, procedures, control narratives and evidence for accuracy, completeness, consistency and alignment with applicable frameworks. Identify control gaps, emerging risks and compliance issues, and provide practical recommendations with clear owners and target dates. Monitor relevant regulatory and industry developments, assess potential business impact and support the controlled update of affected requirements and documentation. Governance, Risk
Information Security GRC Analyst in Suffolk employer: PCI Pal
At PCI Pal, we pride ourselves on being an excellent employer that fosters a collaborative and innovative work culture. Our UK team enjoys a hybrid working model that promotes flexibility while providing opportunities for professional growth through mentorship and hands-on experience with cutting-edge technologies. With a focus on secure payments and modern UI frameworks, employees are empowered to make meaningful contributions in a supportive environment that values continuous learning and best practices.
