InfoSec GRC Analyst

This is an excellent opportunity for someone who enjoys engaging with a broad range of IT disciplines and stakeholders and thrives in a collaborative team environment. As part of the Cyber Governance and Tech Risk team, reporting to the InfoSec GRC Lead, the successful candidate will be responsible for GRC activities, with a particular emphasis on Third Party Risk Management (TPRM) and Exception Management.

Key responsibilities include:

• Overseeing access management for external staff.
• Supporting the management of third-party cyber incidents within the supply chain.
• Enhancing supporting data related to supply chain risk.
• Managing the Exception Management processes to ensure robust review and effective challenge of approval requests.

What you’ll do:

• Work closely with the Global Information Security team to assess the effectiveness of controls, identify gaps, risk rate findings, and support mitigation planning.
• Support the Third-Party Risk Management (TPRM) framework, including the management of escalations and remediation activities.
• Run the exception management processes to ensure issues and approvals are appropriately tracked and reviewed.
• Translate technical cyber risk topics into clear, business-friendly language for non-technical stakeholders.
• Liaise with the business and key stakeholders to perform assessments and identify risk exposures.
• Oversee supply chain due diligence, manage findings, and communicate issues to relevant stakeholders for resolution.
• Ensure that resilience requirements and considerations are appropriately integrated into TPRM activities.
• Oversee reporting and management information (MI) on risk reduction progress and remediation status.
• Respond to client security questionnaires, RFIs, RFPs, and audit requests as needed.
• Document and design workflows to support a range of information security activities.

The knowledge, experience, and qualifications you need:

• Strong stakeholder engagement skills, enabling effective collaboration across Information Security and Global Technology teams.
• Sound understanding of risk management, particularly regarding cyber threats and regulatory requirements – with a specific knowledge on the cyber TPRM and supply chain risk.
• Demonstrated ability to analyse risks or gaps and manage their remediation through to resolution.
• Proven track record in managing exception requests and effectively articulating risk to the user community.
• Familiarity with the NIST Cybersecurity Framework, ISO27001 and operational resilience.
• Willingness to learn and develop governance, risk, and compliance (GRC) skillsets.
• A continuous improvement mind-set challenges the status quo and seeks personal development.
• Excellent verbal and written communication skills.
• An information security qualification (such as CISSP, CISM, or similar) is beneficial but not essential.
• Experience with AI tools and ServiceNow is an advantage.

We recognise potential, whoever you are. Our purpose is to provide excellent investment performance to clients through active management. Diversity of thought facilitated by an inclusive culture will allow us to make better decisions and better achieve our purpose. This is why inclusion and diversity are a strategic priority for us and why we are an equal opportunities employer: you are welcome here regardless of your age, disability, gender identity, religious beliefs, sexual orientation, socio-economic background, or any other protected characteristics.