> Markdown version of [/jobs/ext/2174860-grc-lead](https://www.wearedevelopers.com/jobs/ext/2174860-grc-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Lead - **Company:** Capgemini - **Location:** Inverness, UK - **Experience:** Expert - **Salary:** £49,939.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Software Vulnerability Management, Vulnerability Analysis - **Published:** August 22, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5851806010 ## About the Role * Experience working within a Cyber Security Governance, Risk & Compliance (GRC) environment. * Good understanding of security risk management frameworks and methodologies. * Experience supporting security governance, compliance, assurance, audit, or risk management activities. * Familiarity with security standards, certifications, and compliance frameworks, including: o ISO 27001 o Cyber Essentials Plus o GDPR o NIST Cyber Security Framework o ITIL * Experience maintaining security risk registers, control frameworks, policies, standards, and compliance documentation. * Understanding of vulnerability management processes, remediation tracking, and security assurance activities. * Ability to analyse technical findings and communicate associated business risks. * Experience working with internal stakeholders, auditors, clients, and technical teams. * Strong analytical, reporting, documentation, and organisational skills. * Good communication and stakeholder management skills with the ability to work collaboratively across teams. * Ability to prioritise workload, manage multiple tasks, and work effectively within a regulated environment. * Relevant cyber security qualifications or willingness to work towards industry-recognised certifications (e.g. ISO 27001, Security+, ISC2 CC). You can bring your whole self to work. At Capgemini building an inclusive future is part of everyday life and will be part of your working reality. We have built a representative and welcoming environment, for everyone. ## Description The Governance, Risk, Compliance (GRC) and Vulnerability Assessment Analyst supports the account's cyber security governance, risk management, compliance, assurance, and vulnerability management activities within a complex and highly regulated environment. This role contributes to ensuring that security controls, processes, and governance frameworks are effective, auditable, and aligned to industry standards including ISO 27001, Cyber Essentials Plus, GDPR, NIST, and contractual security obligations. The Analyst provides security oversight, assurance, and risk-based guidance across projects, operational services, and technology changes while supporting secure-by-design principles through governance and design review activities. Working closely with technical and business stakeholders, the successful candidate will help identify, assess, manage, and report security risks appropriately, while supporting continual improvement initiatives that enhance the overall security posture of the account. If you are successfully offered this position, you will go through a series of pre-employment checks, including identity, nationality (single or dual) or immigration status, employment history going back 3 continuous years, and unspent criminal record check (known as Disclosure and Barring Service) Your role * Support the maintenance and continuous improvement of the Cyber Security Governance Framework, ensuring alignment with organisational, client, and regulatory requirements. * Assist with security risk management activities, including risk identification, assessment, treatment, acceptance tracking, and ongoing monitoring. * Maintain the Security Risk Register, ensuring risks, actions, owners, and mitigations are accurately recorded, tracked, and reported. * Support the development, review, and maintenance of security policies, standards, and procedures aligned to ISO 27001, Cyber Essentials Plus, GDPR, and contractual obligations. * Assist with internal and external audit activities, including evidence collection, tracking remediation actions, and supporting responses to audit findings. * Conduct security assurance reviews and control assessments to identify compliance gaps, risks, and opportunities for improvement. * Support vulnerability management governance activities by monitoring vulnerability remediation progress, tracking risk treatment plans, and producing reports. * Produce security reporting and metrics covering risk, compliance, audit, incident, and vulnerability management activities for internal and client stakeholders. * Review security designs and technology changes against security policies, standards, and secure-by-design principles, escalating concerns where appropriate. * Support security awareness, training, and continual improvement initiatives that help strengthen security maturity and compliance across the account. ## Related Videos - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) - [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What is the real price of one successful line of code?](https://www.wearedevelopers.com/videos/1921-what-is-the-real-price-of-one-successful-line-of-code) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Software Developer Salary in Switzerland [2023]](https://www.wearedevelopers.com/magazine/215-software-developer-salary-in-switzerland-2023)