GRC Associate

As Security GRC Associate, you help strengthen third-party security risk management and assurance. You’ll partner with Procurement, Legal, Privacy and Engineering to embed security requirements in onboarding, procurement, and contracts. You’ll assess risks across suppliers, AI tools, and service providers, supporting ISO 27001 and the unified control framework. The role combines governance, risk, and automation to give the business a clearer view of risk. This is an opportunity to shape Trainline’s security program at scale.

• private healthcare & dental insurance
• work from abroad policy
• 2-for-1 share purchase plans
• EV Scheme
• extra festive time off
• family-friendly benefits

• Run third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers
• Review supplier assurance evidence (ISO 27001, SOC 2, security questionnaires, penetration test summaries) and judge control adequacy
• Identify and document third-party security risks and propose proportionate mitigations
• Assess security risks of AI tools and AI integrations with GRC and InfoSec teams
• Incorporate security requirements into supplier onboarding, procurement and contract renewals
• Maintain third-party risk records, track remediation actions, and escalate material risks
• Support risk-based ongoing supplier reassessment and monitoring of critical suppliers
• Help improve the Third-Party Risk Management framework (classification, assessment methods, reporting)
• Support ISO 27001 assurance work (control assessments, evidence gathering, audits) and maintain unified control framework
• Contribute to building and improving GRC tooling using automation/AI for questionnaire reviews, evidence analysis, control mapping, and risk reporting

• Experience in information security, GRC, third-party risk management or related cyber security discipline
• Hands-on experience running third-party security assessments and reviewing supplier documentation
• Knowledge of security standards and frameworks (ISO 27001, ISO 27002, NIST CSF)
• Experience collaborating with Procurement, Legal, Technology and business teams
• Strong analytical and problem-solving skills with ability to manage multiple assessments
• Clear written and verbal communication, capable of explaining security concepts to diverse audiences
• Proactive, curious mindset with interest in improving governance and risk delivery

• Strong analytical and problem-solving skills
• Clear written and verbal communication
• Proactive and curious mindset
• ISO 27001 / ISO 27002
• NIST CSF
• Third-party risk frameworks