Technical GRC Analyst

Salary: £33,000 - 47,000 per year

Requirements

• Experience in IT risk, compliance, or GRC roles within a SaaS or technology environment.
• Understanding of GDPR and handling personal data, especially sensitive or child/student data.
• Experience performing risk assessments using structured frameworks and defined processes.
• Ability to interpret policies and apply them to operational and real‑world scenarios.
• Strong organisational, coordination, and documentation skills, including audit trails, evidence, and decision logs.
• Experience working with cross‑functional teams such as engineering, product, and operations.
• Experience supporting operational security assurance activities such as evidence collection, control validation, remediation tracking, or audit preparation.
• Familiarity with ISO 27001, Cyber Essentials, or similar frameworks is preferred.
• Experience supporting audits, evidence collection, or remediation tracking activities is preferred.
• Experience with vendor and third‑party risk management is preferred.
• Exposure to data protection processes such as SARs, DPIAs, and data sharing assessments is preferred.
• Exposure to data classification, data governance, or data loss prevention processes is preferred.
• Experience with GRC, compliance, or assurance platforms such as Vanta or Drata, and ticketing or workflow management tools is preferred.
• Exposure to Microsoft 365 security and compliance tooling such as Entra ID, Intune, Secure Score, and Defender is preferred.
• Basic understanding of cloud and SaaS architecture and common security controls is preferred.

Responsibilities

• Administer and operate IT risk, compliance, and security assurance processes aligned to internal policies and regulatory requirements, including GDPR.
• Act as a central point of contact for compliance‑related requests such as Subject Access Requests, data sharing requests, access requests, exceptions, and supplier onboarding.
• Perform risk assessments using defined criteria, focusing on data protection and information security risks.
• Review requests against defined policies and controls, escalating where appropriate in line with governance processes.
• Support third‑party and supplier risk assessments, including reviewing security and data protection documentation and tracking follow‑up actions.
• Support periodic reviews of high‑risk and business‑critical suppliers, applications, and technology platforms to ensure appropriate security, compliance, and data protection controls remain in place.
• Support the implementation and ongoing operation of compliance and assurance tooling, including evidence collection, test management, stakeholder coordination, remediation tracking, and control adoption activities.
• Ensure appropriate documentation, audit trails, and evidence are maintained for assessments, compliance activities, and operational processes.
• Support internal and external audits, including evidence gathering, action tracking, and coordination of remediation activities.
• Monitor compliance with policies and highlight potential risks, gaps, or control weaknesses for review.
• Support coordination and operational delivery of security improvement initiatives across IT and business teams.
• Support incident management processes through documentation, tracking, and coordination of follow‑up actions.
• Coordinate security awareness activities, including phishing simulation campaigns and training tracking.
• Assist with reviews of security tooling configurations and collection of supporting control evidence.
• Work closely with engineering, product, and business teams to ensure compliance and security processes are understood and followed.
• Contribute ideas and feedback to improve workflows and operational processes, particularly where they impact scalability, operational efficiency, or customer trust.

Technologies

• Cloud Support
• Microsoft 365 Security
• Office 365

Bromcom is an equal opportunities employer. We are seeking a Technical GRC Analyst to support the day‑to‑day operation of our governance, risk, compliance, and security assurance processes within a growing EdTech SaaS environment. This role gives us exposure across governance, operational security assurance, compliance, and risk management, working closely with the IT & Information Security Manager and our wider IT team. We offer the opportunity to help maintain audit readiness, support assurance activities, and coordinate remediation and evidence management across the organisation while contributing to a business that values scalability, operational efficiency, and customer trust.