> Markdown version of [/jobs/ext/3901675-grc-analyst](https://www.wearedevelopers.com/jobs/ext/3901675-grc-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# GRC Analyst

- **Company:** THE OPPORTUNITY HUB UK LTD
- **Location:** Edinburgh, UK
- **Salary:** £35,500.0 - £45,000.0
- **Contract:** Permanent contract
- **Skills:** CompTIA Security+, Cyber Security, Vector Graphics
- **Published:** October 24, 2026
- **Apply:** https://www.jobs.service.gov.uk/jobs/6adb0b2ffc1374228e98092e/apply

## About the Role

A year or two working in a GRC, audit, or information security role

Working knowledge of at least one major framework: ISO 27001, NIST, SOC 2, or similar

Comfortable writing clearly. A lot of this job is documentation that other people have to trust

An eye for detail. Small inconsistencies in a control matrix matter

Confidence asking questions of senior stakeholders when something doesn't add up

A relevant certification (CompTIA Security+, ISO 27001 Lead Implementer, or similar) is useful but not essential

## Description

Ambitious GRC Analyst wanted to drive real impact in Cybersecurity from Edinburgh.

Cyber threats aren't slowing down, and neither is the regulation built to contain them. This is an established name in the cybersecurity sector, the kind of organisation that's been through multiple audit cycles, several framework overhauls, and knows exactly what good governance looks like. They're growing their Edinburgh team and need a GRC Analyst who can keep pace with a business operating at real scale.

Here's what you'll be doing:

Support risk assessments across the business, identifying gaps before they become problems

Maintain and improve compliance documentation against frameworks like ISO 27001, SOC 2, and NIST

Coordinate internal and external audits, chasing evidence and closing findings on schedule

Monitor control effectiveness and flag anything that's drifted out of line

Work with security, legal, and IT teams to keep policies current and actually usable

Help prepare reports and dashboards that give leadership a clear view of risk posture