Staff GRC Analyst

Requirements

• Significant experience in Security GRC, understanding of auditing processes, with direct experience in both internal and external audit cycles.
• Demonstrated experience using AI and/or coding automation to get controls built, implemented, and operating in practice.
• A strong understanding of cloud architectures (AWS or equivalent) and how infrastructure decisions map to security controls and audit evidence.
• Experience automating reporting for GRC programs, including dashboards and executive-level summaries.
• Fintech, payments industry, or IT audit background, with familiarity with regulatory expectations and payment platform architectures.
• Certifications such as CISM, CISSP, CISA, or PCI-related credentials. A degree in Cybersecurity, Engineering, Computer Science, Mathematics, or equivalent experience is a plus.

Nice to Haves

What You'll Be Doing

• Automate our legacy systems relating to governance, risk, and compliance frameworks, including ISO 27001, PCI-DSS, DORA, UK Cyber Essentials, and relevant financial services regulations.
• Engineer GRC workflows with internal systems (e.g., ticketing, asset management, identity, cloud platforms) to support compliance by design.
• Design and build scalable GRC architectures and automation for evidence collection, control testing, and compliance reporting.
• Draft, review, and maintain Pleo's security policies, mapping them to relevant control standards and ensuring alignment across frameworks as the business evolves.
• Automate incoming security requests from customers and prospects, including questionnaires, one-off questions, review calls, and documentation ensuring responses are accurate, thorough, and reflect our actual security posture.
• Automate third-party vendor assessments, evaluating suppliers against Pleo's compliance and security standards and ensuring identified gaps are tracked and resolved.
• Automate tracking and report on compliance metrics and KPIs, giving leadership the data-driven visibility they need to understand where the programme stands and where it needs to go.
• Translate compliance requirements into technical specifications that engineering teams can implement, and make the same topics accessible to non-technical stakeholders.
• Coordinate complex, multi-team workstreams, keeping dependencies visible, priorities clear, and delivery on track even when things shift.
• Contribute to the broader Cybersecurity team, staying connected with ongoing initiatives and supporting shared goals across the function.

Perks and Benefits

• Your own Pleo card (no more out-of-pocket spending!)
• Lunch is on us for your work days - enjoy catered meals or receive a lunch allowance based on your local office
• Comprehensive private healthcare - depending on your location, coverage options include Vitality, Alan or Médis
• We offer 25-28 days of holiday (depending on your location) + public holidays
• For our Team, we offer both hybrid and fully remote working options
• Option to purchase 5 additional days of holiday through a salary sacrifice
• We use MyndUp to give our employees access to free mental health and well-being support with great success so far
• Paid parental leave - we want to make sure that we're supportive of families and help you feel that you don't have to compromise your family due to work