GRC risk Analyst
VIQU IT Recruitment
GRC/ Third Party Risk Analyst Remote - occassional ad hoc travel to Cheltenham Dureaction - 6 months Day rate - £350 - 425 a day We are looking for a detail-driven
GRC / Third-Party Risk Analyst
to join our team on a full-time basis. In this role, you will be the core driver of our supplier security program, helping streamline, scale, and accelerate third-party security assessments without compromising security standards. You will partner closely with procurement, legal, IT, and internal business owners to evaluate third-party risks and challenge vendor security claims effectively. Key Responsibilities Accelerate Third-Party Assessments:
Drive end-to-end third-party and vendor security risk assessments from initial scoping to final risk rating in a timely manner. ( Due Diligence & Questionnaires:
Administer, review, and score security questionnaires, vendor self-assessments, and risk artifacts. Evidence & Contract Review:
Inspect security documentation (e.g., SOC 2 reports, policies, technical whitepapers) and review security/data protection clauses in third-party contracts. ISO 27001 Validation:
Validate ISO 27001 certifications, Statements of Applicability (SoA), and supporting audit reports to confirm true control coverage rather than taking claims at face value. Challenge & Identify Gaps:
Critically interrogate supplier security posture, spot discrepancies or weak controls, and document residual risks or compensatory controls. Remediation & Tracking:
Track open findings, follow up with internal and external stakeholders, and support risk treatment or waiver workflows. Required Skills & Qualifications Experience:
2–4+ years of experience in Information Security, GRC (Governance, Risk, and Compliance), or Third-Party Risk Management (TPRM). Framework Knowledge:
Solid working knowledge of
ISO 27001
(mandatory validation experience) alongside familiarity with frameworks like NIST CSF or SOC 2. Critical Evaluation:
Proven ability to read technical security evidence, cross-examine vendor responses, and push back against superficial or incomplete security assertions. Contract & Risk Acumen:
Understanding of third-party risk scoring models, data protection principles, and security schedules in commercial contracts. Communication:
Strong interpersonal and stakeholder-management skills to bridge the gap between technical security findings and non-technical business/procurement teams.
TPBN1_UKTJ
GRC / Third-Party Risk Analyst
to join our team on a full-time basis. In this role, you will be the core driver of our supplier security program, helping streamline, scale, and accelerate third-party security assessments without compromising security standards. You will partner closely with procurement, legal, IT, and internal business owners to evaluate third-party risks and challenge vendor security claims effectively. Key Responsibilities Accelerate Third-Party Assessments:
Drive end-to-end third-party and vendor security risk assessments from initial scoping to final risk rating in a timely manner. ( Due Diligence & Questionnaires:
Administer, review, and score security questionnaires, vendor self-assessments, and risk artifacts. Evidence & Contract Review:
Inspect security documentation (e.g., SOC 2 reports, policies, technical whitepapers) and review security/data protection clauses in third-party contracts. ISO 27001 Validation:
Validate ISO 27001 certifications, Statements of Applicability (SoA), and supporting audit reports to confirm true control coverage rather than taking claims at face value. Challenge & Identify Gaps:
Critically interrogate supplier security posture, spot discrepancies or weak controls, and document residual risks or compensatory controls. Remediation & Tracking:
Track open findings, follow up with internal and external stakeholders, and support risk treatment or waiver workflows. Required Skills & Qualifications Experience:
2–4+ years of experience in Information Security, GRC (Governance, Risk, and Compliance), or Third-Party Risk Management (TPRM). Framework Knowledge:
Solid working knowledge of
ISO 27001
(mandatory validation experience) alongside familiarity with frameworks like NIST CSF or SOC 2. Critical Evaluation:
Proven ability to read technical security evidence, cross-examine vendor responses, and push back against superficial or incomplete security assertions. Contract & Risk Acumen:
Understanding of third-party risk scoring models, data protection principles, and security schedules in commercial contracts. Communication:
Strong interpersonal and stakeholder-management skills to bridge the gap between technical security findings and non-technical business/procurement teams.
TPBN1_UKTJ
Reference: WJ-5784_111569 · Posted 13 Nov 2026, 08:43 PM