Governance, Risk & Compliance (GRC) Analyst

Working Arrangement

• Dunelm describes itself as a hybrid business with flexibility alongside time together as a team.
• This role is expected to include at least one day per week in the Leicester office.

Role Overview

Governance and Compliance

• Develop, maintain and improve the Information Security Management System.
• Support compliance with PCI DSS, NIST CSF 2.0, UK data protection law and relevant EU privacy legislation.
• Support compliance with Provision 29, Cyber Essentials, Cyber Essentials Plus and other requirements.
• Collect compliance evidence and monitor emerging legislation and regulatory changes.
• Support security governance implementation across business functions.

Risk and Supplier Assurance

• Administer the cyber security risk register toolset and facilitate cyber risk assessments.
• Support risk owners through the cyber security risk lifecycle and improve risk reporting.
• Oversee supplier cyber security assurance and assess suppliers, partners and third parties.
• Identify supply chain risks and recommend mitigation.
• Track supplier due diligence and monitor compliance through the contract lifecycle.

Security Governance and Culture

• Maintain information security policies, standards, procedures and supporting guidance.
• Support governance forums and security steering committees and produce reports for senior stakeholders.
• Assist with security exceptions and risk acceptance processes.
• Help develop awareness programmes, phishing simulations, campaigns and security training.
• Measure awareness effectiveness through reporting and behavioural metrics.

Metrics and Improvement

• Develop governance and compliance KPIs and KRIs covering compliance, audits, risk, third-party assurance and awareness.
• Benchmark organisational maturity against recognised frameworks.
• Drive continual improvement across governance and compliance processes.
• Provide pragmatic security advice and embed security governance into projects from inception.

What We'll Look For

• The successful candidate should be a self-starter who can work at pace across multiple business levels.
• Strong understanding of cyber security frameworks, governance principles and risk management is required.
• Excellent stakeholder management and communication skills are required.
• The role requires collaboration with stakeholders across all levels of seniority.