Senior Compliance Analyst (GRC) in Milton Keynes

Vacancy Name Senior Compliance Analyst (GRC)
Vacancy No VN1070
Job Title Senior Compliance Analyst (GRC)
Work Location City Milton Keynes
About Solifi Solifi deliver a solid financial technology foundation for equipment, working capital, wholesale, and automotive finance firms. At Solifi, we believe that commerce is only as strong as the system it runs on. Our mission is to reshape finance technology by bringing together proven solutions into a singular powerful technology platform designed to help protect and scale financial organizations. We guard our customers by being precise and reliable, we guide their success by combining powerful technology with proven expertise, and we help them grow by unleashing their potential.
About The Team
Governance, Risk & Compliance gives Solifi a defensible, evidence-based compliance posture that satisfies clients, auditors, and regulators without over-building process for its own sake. The team owns SOC2, client audit response, and third-party risk management, using our [AC1.1]core GRC platform and leaning heavily on AI-assisted workflows to scale with rising volume rather than headcount.
About the Position Solifi is looking for a Senior Compliance Analyst to be a senior contributor within the GRC team, balancing governance process ownership with client-facing compliance work. You will own a defined set of policies and risk register areas, help keep the control framework mapping and governance cadence current, and take the lead on the most complex client audits, due-diligence questionnaires (DDQs), and security questionnaires. Lead and support compliance audits and assessments, ensuring findings are thoroughly evaluated and appropriate remediation and resolution strategies are developed and implemented. You may represent Solifi directly to client security and procurement teams and to external auditors, and mentor junior Compliance Analysts on evidence judgment and governance discipline.
Role and ResponsibilitiesGovernance

• Assist in the policy lifecycle for a defined set of policies: drafting, review cadence, approval routing, and attestation tracking.
• Support the enterprise risk register as a decision-making tool, not just a record: track risk treatment decisions to closure, chase remediation owners, and flag risks that have drifted from their agreed treatment to the Senior Manager.
• Keep control framework mapping current for owned areas as systems, products, and obligations change.
• Support the policy exception process: intake, review against defined criteria, and tracking of approved exceptions through to expiry or renewal.
• Help run recurring governance cadences (policy review cycles, risk register reviews) so decisions happen on a schedule rather than reactively.

Compliance & client-facing

• Act as a client-facing point of contact for the most complex security questionnaires, DDQs, and audit requests, engaging directly with client security or procurement teams and external auditors where a written response alone isn't enough.
• Lead the response to escalated client questionnaires and audit requests, setting the standard answers the wider team reuses, and act as escalation point for anything junior Compliance Analysts cannot close.
• Own a defined set of control areas within the SOC2 Type II cycle, working alongside the rest of the GRC team under the direction of the Senior Manager, GRC.
• Assist with vendor risk tiering decisions and due-diligence depth for the most complex or highest-risk vendor relationships, escalating any vendor whose posture has deteriorated.
• Maintain and improve the Drata evidence library within owned control areas: control mapping, evidence taxonomy, and refresh cycles.
• Apply AI-assisted tools to draft first-pass questionnaire, DDQ, and audit responses, reserving own time for genuinely novel or complex questions, and reviewing AI output critically before it reaches a client or auditor.
• Support client-facing calls and audit walkthroughs on behalf of the team when a client wants direct conversation rather than a written response.
• Mentor junior Compliance Analysts on evidence judgment, control interpretation, and client-facing communication.
• Act as backup for a peer within the team, keeping own workflow documented well enough to be picked up without a live handover.
• Conduct security assessments and audits to identify potential compliance issues and make recommendations for resolution and/or improvements.

What success looks like:

• Policies stay within their review cadence, with no attestation or approval routing overdue.
• Risk register entries in owned areas carry a current treatment decision and owner, with none silently stale.
• Client questionnaire, DDQ, and audit request turnaround against SLA, including the most complex escalated cases.
• Positive client and auditor feedback on responsiveness and quality in direct interactions (calls, walkthroughs, audit conversations).
• Percentage of owned controls under continuous automated monitoring in Drata, trending upward.
• No owned control area goes without current evidence at any point in the audit cycle.

About You
Must have

• 5+ years in IT audit, compliance, or GRC, including direct experience with governance processes such as policy lifecycle management, risk register maintenance, or control framework mapping.
• Direct experience responding to client audits, DDQs, or security questionnaires.
• Comfortable being client-facing: able to hold a call or audit walkthrough directly with a client security or procurement team, or with an external auditor.
• Hands-on Drata experience (or Vanta, Secureframe) as system of record, not only as a reporting layer.
• Excellent written communication, including policy, auditor-facing, and client-facing writing under time pressure.
• Working knowledge of SOC2 Trust Services Criteria and at least one adjacent framework (ISO 27001, NIST CSF). Nice to have
• Bachelor's degree or equivalent practical experience.
• Relevant certification (CISA, CISSP, ISO 27001 Lead Auditor or Lead Implementer, or equivalent).
• Experience with UK/EU regulatory exposure (DORA, GDPR) relevant to a UK-based compliance function.
• Experience owning or contributing to a full SOC2 Type II cycle end to end. Level guidance: This is an IC3 role: you are a senior individual contributor within a GRC team, supporting a defined set of policies and risk register areas as well as representing Solifi directly to clients and auditors on the most complex or sensitive requests. You exercise independent judgment on ambiguous control and risk interpretation, and mentor junior Compliance Analysts on both governance discipline and client-facing communication, without formal management authority or sole ownership of the compliance program as a whole.

Preferred Experience Level 5 YearsPreferred Education Level Bachelor's Degree
Employment Basis Full Time
Benefits Private medical insurance, Auto enrolment pension scheme, Cycle to work scheme, Group Life Insurance, Group Income Protection Insurance, Free on-site parking (Milton Keynes office only), 23 days Holiday - lengthens with service, Option to buy more holiday, Generous Employee Referral Scheme - Earn up to £2,500!, Discounted eye tests & glasses, Help towards professional association subscriptions, Various companywide social events, Support with professional qualifications
Applications Close Date 24 Mar 2027 #J-18808-Ljbffr