GRC Analyst

Ambitious GRC Analyst wanted to drive real impact in Cybersecurity from Edinburgh.

Cyber threats aren’t slowing down, and neither is the regulation built to contain them. This is an established name in the cybersecurity sector, the kind of organisation that’s been through multiple audit cycles, several framework overhauls, and knows exactly what good governance looks like. They’re growing their Edinburgh team and need a GRC Analyst who can keep pace with a business operating at real scale.

Here’s what you’ll be doing:

Support risk assessments across the business, identifying gaps before they become problems

Maintain and improve compliance documentation against frameworks like ISO 27001, SOC 2, and NIST

Coordinate internal and external audits, chasing evidence and closing findings on schedule

Monitor control effectiveness and flag anything that’s drifted out of line

Work with security, legal, and IT teams to keep policies current and actually usable

Help prepare reports and dashboards that give leadership a clear view of risk posture

A year or two working in a GRC, audit, or information security role

Working knowledge of at least one major framework: ISO 27001, NIST, SOC 2, or similar

Comfortable writing clearly. A lot of this job is documentation that other people have to trust

An eye for detail. Small inconsistencies in a control matrix matter

Confidence asking questions of senior stakeholders when something doesn’t add up

A relevant certification (CompTIA Security+, ISO 27001 Lead Implementer, or similar) is useful but not essential

£35,500 to £45,000, depending on experience

Hybrid working, based out of Edinburgh

Private medical and dental insurance

Enhanced pension scheme

Performance-based bonuses on top of salary

Why pursue a career in Cybersecurity?

Governance, risk, and compliance work sits right at the centre of how cybersecurity actually functions day to day. It’s less flashy than penetration testing, but it’s the layer that keeps everything else defensible. Edinburgh has built a genuinely strong cluster of security and financial services firms, so a GRC Analyst based here has no shortage of room to grow. Demand for this skill set keeps climbing as regulation tightens, and that usually means steady progression for people who take it seriously.