What you'll be doing

Run third-party security risk assessments for new and existing suppliers, including SaaS, cloud providers, technology partners, and business-critical vendors
Review supplier assurance evidence such as ISO 27001 certificates, SOC 2 reports, security questionnaires, and penetration test summaries to judge control adequacy
Identify and document third-party security risks and recommend ways to reduce them
Assess security risks of AI tools, applications, and third-party AI integrations in collaboration with GRC and InfoSec teams
Partner with Procurement, Legal, Privacy, and Engineering teams to integrate security requirements into supplier onboarding, procurement, and contract renewals
Maintain up-to-date third-party risk records, track remediation actions, and escalate material risks appropriately
Shape a risk-based approach to ongoing supplier assurance, including periodic reassessments and monitoring of critical suppliers
Improve the Third-Party Risk Management framework, including risk classification, assessment methods, questionnaires, and reporting
Support ISO 27001 assurance activities, including control assessments, evidence gathering, audit preparation, and remediation tracking
Help build and enhance GRC tooling using automation and AI to accelerate questionnaire reviews, evidence analysis, control mapping, and risk reporting

Requirements

Experience in information security, GRC, third-party risk management, or related cybersecurity discipline
Hands-on experience running third-party security assessments and reviewing supplier assurance documentation
Working knowledge of security standards and frameworks, especially ISO 27001, ISO 27002, and NIST CSF
Experience collaborating with stakeholders across Procurement, Legal, Technology, and business teams
Strong analytical and problem-solving skills with attention to detail and ability to manage multiple competing priorities
Clear written and verbal communication skills with confidence explaining security requirements to technical and non-technical audiences
Proactive, curious mindset with a genuine interest in improving security governance and risk management delivery

Experience with GRC or third-party risk platforms like ServiceNow GRC, Archer, LogicGate, Vanta, or Compyl
Experience supporting ISO 27001 audits, ISMS maintenance, or control assurance
Familiarity with SOC 2, ISO 22301, PCI DSS, or Cyber Essentials
Experience assessing cloud services, SaaS, or AI-enabled tools and familiarity with AI governance frameworks such as ISO/IEC 42001 and NIST AI RMF
Experience automating GRC processes using workflow tools, scripting, low-code platforms, or APIs
Regular use of AI tools and large language models to enhance research and evidence analysis
Relevant certifications such as ISO 27001 Foundation or equivalent

Private healthcare and dental insurance
Generous work from abroad policy (28-day Work from Abroad)
2-for-1 share purchase plans
Electric vehicle (EV) Scheme to reduce carbon emissions
Extra festive time off
Excellent family-friendly benefits
Clear career paths, transparent pay bands, personal learning budgets, and regular learning days
Hybrid working model with minimum 60% office presence over a 12-week period