> Markdown version of [/jobs/ext/3325368-grc-security-specialist](https://www.wearedevelopers.com/jobs/ext/3325368-grc-security-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # GRC Security Specialist - **Company:** Deutsche Bank AG - **Location:** UK - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Software System Penetration Testing, Cloud Computing Security, Cyber Security, Disaster Recovery, Systems Development Life Cycle, Phishing, Secure Coding, Information Security Management System, Containerization, Static Application Security Testing, Dynamic Application Security Testing - **Published:** September 25, 2026 - **Apply:** https://startup.jobs/grc-security-specialist-getabound-com-10198411 ## About the Role Three or more years in an information security assurance, GRC or security compliance role, at least some of it in a regulated financial services environment or another environment with real external audit pressure. - Hands-on experience of ISO 27001, whether operating an ISMS or taking one through certification. - Demonstrable experience running third-party or vendor security assessments, and of responding to inbound security due diligence. - Comfortable reading technical findings - an EDR vulnerability report, a penetration test finding, a cloud misconfiguration - and forming your own view on severity and real-world exploitability rather than passing the vendor's rating through unchanged. - Clear, concise written English. Much of this role is writing things that external parties will judge us on. - The confidence to chase a busy engineer, challenge a supplier's assertion, and tell us when an answer is not good enough. Desirable: - Experience of a cloud-native environment, ideally AWS. - Experience of scaling a control framework as an organisation grows. - Familiarity with UK operational resilience expectations (SYSC 15A) and outsourcing requirements (SYSC 8)., Certifications such as CISM, CISA, ISO 27001 Lead Implementer or Lead Auditor, CRISC or CCSP. We care more about what you have done than what you hold. ## Description We are formalising our security assurance function. We have technical controls and the engineering culture; what we need now is the governance layer that proves it - to our auditors, to our funders, and to our regulator. You will be the delivery engine behind that. You will own the recurring assurance cycle end to end, run our third-party security programme, and be the person who turns evidence into something a due diligence team or a certification auditor can be satisfied by. You will be responsible for building controls, gathering evidence, and challenging suppliers. What you will own: 1. Third-party security assurance - Run security due diligence on new suppliers, maintain initial questionnaire to risk sign-off, working with Procurement and Legal on security and data protection schedules. - Maintain a supplier tiering model based on criticality and run the periodic re-assessment cycle for tiered suppliers: certification expiry, subprocessor changes, breach notifications, SLA performance. - Maintain the supplier and outsourcing registers, including preparation for the FCA's material third party register under PS26/2 (rules in force 18 March 2027). - Track concentration risk and exit plans for critical suppliers. 2. Inbound due diligence and customer assurance - Own our response to security due diligence from funders, banking partners, institutional investors, commercial partners and prospects. - Build and maintain a reusable trust pack: answer library, security whitepaper, current certifications, pen test attestations, standard questionnaire pre-fills (SIG, CAIQ). - Turn a 40-hour bespoke questionnaire response into a 4-hour one. 3. The assurance calendar - Maintain the annual calendar of security activities and make sure each one happens, produces evidence, and closes its actions: penetration tests, access reviews, disaster recovery tests, tabletop exercises, policy reviews, supplier re-assessments, awareness training. - Coordinate external penetration tests: scoping, vendor selection, scheduling, findings triage, remediation tracking, retest. - Facilitate tabletop exercises, including scenario design and post-exercise action tracking. 4. Risk and control administration - Maintain the information security risk register: run the assessment cycle, record treatment plans with named owners and dates, chase closure. - Administer the policy exception and risk acceptance process, ensuring every exception is owned, time-bound and reviewed on expiry. - Perform first-line control testing: sample-test where key controls operate as designed and retain the evidence. - Produce security MI for the Head of Security to take to ExCo and the Risk Committee. 5. Vulnerability and findings management - Consolidate findings across sources - EDR, cloud security posture, SAST/DAST/SCA, secrets scanning, penetration tests - into a single view with agreed severity definitions and remediation SLAs. - Triage, route and chase remediation with engineering teams; escalate ageing findings. - Own the reporting on remediation performance. 6. Security awareness - Run the awareness programme: induction, annual refresher, phishing simulation, role-based training for engineers, completion tracking. - Coordinate pre-employment screening with People. What you will contribute to: - The ISO 27001 ISMS, which we are building towards certification. You will draft and maintain control documentation, populate the Statement of Applicability, gather evidence, coordinate the internal audit programme and be a primary point of contact for our external auditor. The Head of Security owns the framework, scope, and risk appetite. - Policies and standards: you will draft, review and shepherd policies through approval, and track the review cycle. - Incident response: you will maintain the IR plan and playbooks, facilitate post-incident reviews, track remediation actions, and support regulatory notification (ICO personal data breach reporting within 72 hours; FCA notification under Principle 11 / SUP 15.3). - Business continuity and DR: you will maintain the documentation and the testing evidence. - Secure development: you will help embed security requirements into the SDLC and support threat modelling sessions. - Data protection: you will support RoPA maintenance, DPIA completion and DSAR handling alongside Legal. What success looks like: First 90 days: you know our supplier estate and have tiered it; the assurance calendar for the next 12 months is published and owned; inbound due diligence requests come to you and go out without the Head of Security rewriting them. Six months: the trust pack exists and is being used; the risk register is live with owned treatment plans; ISO 27001 evidence collection is systematic rather than a scramble; the exception register exists. Twelve months: supplier re-assessment runs on a cadence without prompting; the material third party register is ready ahead of the March 2027 deadline; MI to the Risk Committee is trusted. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor) - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers) - [Where to Find Entry-Level Software Engineering Jobs](https://www.wearedevelopers.com/magazine/397-where-to-find-entry-level-software-engineering-jobs) - [Data Analyst Salary in the UK](https://www.wearedevelopers.com/magazine/278-data-analyst-salary-in-the-uk) - [System change: restart as developer?](https://www.wearedevelopers.com/magazine/39-system-change-restart-as-developer)