> Markdown version of [/jobs/ext/2808091-grc-analyst](https://www.wearedevelopers.com/jobs/ext/2808091-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Analyst - **Company:** IMT Resourcing Solutions - **Location:** Cheltenham, UK - **Contract:** Temporary to permanent - **Skills:** Microsoft Windows, Microsoft Azure, Cyber Security, Microsoft Security Essentials, Information Security Management System, Microsoft Sentinel, CIS Benchmarks - **Published:** September 9, 2026 - **Apply:** https://www.collegerecruiter.com/job/2856365943-grc-analyst ## About the Role This is a hands-on role suited to someone with strong knowledge of security frameworks including ISO 27001 and NIST, who can work with technical and business teams to assess risk, maintain controls and support ongoing compliance. Microsoft security experience would be particularly useful, especially across the wider Microsoft 365 and Azure security ecosystem., * Strong commercial experience within GRC, Information Security or Cyber Security * Good working knowledge of ISO 27001 * Experience working with NIST, ideally NIST CSF * Practical experience of security risk management and control assessments * Experience supporting security audits and compliance activity * Strong understanding of security policies, governance and assurance * Experience working with technical and non-technical stakeholders * The ability to take ownership of GRC activity rather than purely providing administrative support Experience with Microsoft security tooling would be highly desirable, particularly: * Microsoft Purview * Microsoft Sentinel * Microsoft 365 and Azure security/compliance controls Relevant certifications such as ISO 27001 Lead Implementer/Auditor, CISM, CRISC, CISSP or equivalent would be beneficial but aren't essential. ## Description You'll work closely with security, technology and wider business stakeholders, with responsibilities including: * Supporting the organisation's ISO 27001 ISMS, including maintaining policies, controls and supporting evidence * Working with security frameworks including ISO 27001, NIST CSF and CIS Controls * Conducting and maintaining information security risk assessments * Managing security risks, controls, actions and remediation plans * Supporting internal and external security audits and assessments * Reviewing existing security controls and identifying areas for improvement * Maintaining security policies, standards, procedures and governance documentation * Supporting third-party and supplier security assessments * Tracking compliance against relevant security frameworks and organisational requirements * Working with technical teams to ensure security controls are implemented effectively * Producing security reporting, metrics and governance information for stakeholders ## Related Videos - [Developer Tools for Microsoft Azure](https://www.wearedevelopers.com/videos/450-developer-tools-for-microsoft-azure) - [A practical guide to writing secure Dockerfiles](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [One Pipeline, Three Regulator - SBOM Compliance for the Developer](https://www.wearedevelopers.com/videos/100169-one-pipeline-three-regulator-sbom-compliance-for-the-developer) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [IT Salaries in UK](https://www.wearedevelopers.com/magazine/288-it-salaries-in-uk) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers)