GRC/ Third Party Risk Analyst
Remote - occassional ad hoc travel to Cheltenham
Dureaction - 6 months
Day rate - £350 - 425 a day
We are looking for a detail-driven GRC / Third-Party Risk Analyst to join our team on a full-time basis. In this role, you will be the core driver of our supplier security program, helping streamline, scale, and accelerate third-party security assessments without compromising security standards. You will partner closely with procurement, legal, IT, and internal business owners to evaluate third-party risks and challenge vendor security claims effectively.
Key Responsibilities
- Accelerate Third-Party Assessments: Drive end-to-end third-party and vendor security risk assessments from initial scoping to final risk rating in a timely manner. [
- Due Diligence & Questionnaires: Administer, review, and score security questionnaires, vendor self-assessments, and risk artifacts.
- Evidence & Contract Review: Inspect security documentation (e.g., SOC 2 reports, policies, technical whitepapers) and review security/data protection clauses in third-party contracts.
- ISO 27001 Validation: Validate ISO 27001 certifications, Statements of Applicability (SoA), and supporting audit reports to confirm true control coverage rather than taking claims at face value.
- Challenge & Identify Gaps: Critically interrogate supplier security posture, spot discrepancies or weak controls, and document residual risks or compensatory controls.
- Remediation & Tracking: Track open findings, follow up with internal and external stakeholders, and support risk treatment or waiver workflows.
Required Skills & Qualifications
- Experience: 2–4+ years of experience in Information Security, GRC (Governance, Risk, and Compliance), or Third-Party Risk Management (TPRM).
- Framework Knowledge: Solid working knowledge of ISO 27001 (mandatory validation experience) alongside familiarity with frameworks like NIST CSF or SOC 2.
- Critical Evaluation: Proven ability to read technical security evidence, cross-examine vendor responses, and push back against superficial or incomplete security assertions.
- Contract & Risk Acumen: Understanding of third-party risk scoring models, data protection principles, and security schedules in commercial contracts.
- Communication: Strong interpersonal and stakeholder-management skills to bridge the gap between technical security findings and non-technical business/procurement teams.
GRC risk Analyst in Gloucester employer: VIQU IT Recruitment
At VIQU, we pride ourselves on being an exceptional employer, offering a dynamic work culture that fosters innovation and collaboration. As a Senior Information Security Analyst in Southampton, you'll benefit from a hybrid working model, competitive remuneration, and opportunities for professional growth within a leading offshore law firm focused on secure technology adoption. Join us to make a meaningful impact in the realm of AI and information security while enjoying a supportive environment that values your contributions.
