> Markdown version of [/jobs/ext/2794895-security-grc-ai-analyst](https://www.wearedevelopers.com/jobs/ext/2794895-security-grc-ai-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security GRC & AI Analyst - **Company:** PoloWorks - **Location:** Cheltenham, UK - **Salary:** £45,000.0 - £55,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Cyber Security, Phishing, Information Technology Security Auditing, Data Classification, Microsoft Power Automate, Deployment Automation - **Published:** September 8, 2026 - **Apply:** https://www.collegerecruiter.com/job/2845713889-security-grc--ai-analyst ## About the Role * Experience in Information Security, ideally within a GRC, compliance or risk-focused role * Practical knowledge of Microsoft Defender and Microsoft Purview * Experience of security risk assessments, governance frameworks and security controls * Understanding of ISO 27001 and security audit requirements * Familiarity with AI governance, AI risk assessment or responsible AI adoption * Knowledge of data protection and privacy requirements * Strong analytical and problem-solving skills * Excellent communication and stakeholder management skills * A genuine interest in emerging technologies and AI, * Experience within the Lloyd's, London Market or wider insurance sector * Knowledge of Lloyd's Minimum Standards, Principle 12 and Operational Resilience requirements * Experience supporting DORA compliance programmes * Knowledge of information classification and cryptography We're interested in candidates who hold, or are working towards, one or more of the following: * CISMP * ISC2 CC * ISO 27001 Lead Auditor or Lead Implementer * CISM * CISSP * CRISC * SANS certifications or equivalent ## Description As we continue to grow, we are looking for a Security GRC & AI Analyst to play a key role in strengthening our information security framework whilst supporting the safe and responsible adoption of AI technologies across the Group. This is a fantastic opportunity for a security professional who enjoys working across governance, risk, compliance, operational security and emerging technology, helping to shape how AI is governed within a modern insurance business., * Governance, Risk and Compliance (GRC) * ISO 27001 certification and continuous improvement * Operational Resilience (OpRes) and DORA compliance * Microsoft Defender and Purview administration * AI governance, risk management and responsible AI adoption Working closely with Risk & Compliance teams, Technology, business leaders and third-party suppliers, you will help ensure Marco Group maintains strong security controls, manages risk effectively and adopts AI technologies in a secure and compliant manner. Governance, Risk & Compliance * Support the maintenance and continuous improvement of information security policies, procedures and standards * Assist with ISO 27001 certification activities, including control reviews, evidence collection and audit preparation * Support DORA compliance activities, ICT risk management and remediation tracking * Contribute to Lloyd's Operational Resilience (OpRes) requirements, including scenario testing and self-assessments * Monitor compliance against recognised frameworks including ISO 27001, NIST CSF and Lloyd's requirements * Identify, assess and track security and AI-related risks through to resolution * Produce KRI/KPI reporting for governance forums and stakeholders * Support third-party and supplier security assessments AI Governance & Responsible AI * Support governance and oversight of AI tools used across Marco and PoloWorks, including Microsoft Copilot, Anthropic Claude and other AI-enabled platforms * Maintain AI acceptable use standards, approval processes and usage records * Conduct AI risk assessments for new use cases and integrations * Monitor AI deployments for compliance with data protection, confidentiality and regulatory requirements * Keep up to date with evolving AI governance frameworks and regulatory developments * Support the creation of AI training, guidance and awareness materials Security Operations * Administer and maintain Microsoft Defender security controls and alerting * Configure and support Microsoft Purview capabilities including DLP, sensitivity labels and insider risk controls * Investigate security alerts and support incident response activities * Participate in incident reviews, testing exercises and security improvement initiatives * Provide practical security advice and guidance across the business Security Awareness * Help deliver the Group's security awareness and phishing simulation programme * Create engaging training content on security and responsible AI use * Monitor and report on training participation and awareness metrics ## Related Videos - [How to Stop Your Agents From Going Rogue - Arnav Gupta](https://www.wearedevelopers.com/videos/2152-how-to-stop-your-agents-from-going-rogue-arnav-gupta) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Forecasting Cyber Attacks with Glassdoor Reviews - Lianne Potter](https://www.wearedevelopers.com/videos/2143-forecasting-cyber-attacks-with-glassdoor-reviews-lianne-potter) - [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [Best Companies to work for in London: Top 25 Companies in 2023](https://www.wearedevelopers.com/magazine/187-best-companies-to-work-for-in-london-top-25-companies-in-2023) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [13 AI Tools You Have to Try](https://www.wearedevelopers.com/magazine/219-13-ai-tools-you-have-to-try)