InfoSec GRC Analyst

Manage and respond to client information security due diligence questionnaires (DDQs), vendor security questionnaires (VSQs), and RFP security schedules in an accurate, timely, and consistent manner, maintaining a central response library to improve efficiency and quality over time.

Maintain and continuously improve Gresham’s GRC evidence repository, ensuring that supporting documentation — including policies, certifications, audit reports, and control evidence — is current, accessible, and appropriately version-controlled to support both reactive client requests and proactive assurance activities.

Coordinate responses to client and prospect ESG assessments, working cross-functionally with People & Culture, Facilities, Legal, and Finance to collate accurate data across environmental, social, and governance dimensions, and ensuring outputs are consistent with Gresham’s broader sustainability commitments and disclosures.

Support the Information Security Manager in maintaining the organisation’s information security policy framework and certification portfolio, tracking compliance across Gresham’s applicable standards. Gresham operates a suite of products — including Control Cloud, Connect Cloud, Prime EDM, and Pulse Data — each of which carries distinct certification and assurance obligations; the role requires an understanding of how SOC 1 Type II, SOC 2 Type II, ISO/IEC 27001, and SWIFT Customer Security Programme (CSP) requirements apply differently across these product lines.

The post-holder will contribute to the preparation of internal and external audit activities, risk registers, and periodic security reporting accordingly. You will also contribute to the preparation of internal and external audit activities, risk registers, and periodic security reporting accordingly.

Demonstrable experience responding to information security due diligence questionnaires, vendor security assessments, or equivalent client-facing assurance requests, with a working knowledge of the frameworks and standards commonly referenced in such assessments, including ISO/IEC 27001, SOC 1 Type II, SOC 2 Type II, NIST CSF, and the SWIFT Customer Security Programme (CSP).

A minimum of two years’ experience in a GRC, information security compliance, or technology risk function, with a sound understanding of information security principles including access control, data classification, encryption, incident management, and business continuity.

Strong written and verbal communication skills with the ability to translate technical security controls into clear, commercially appropriate language for non-technical client stakeholders, legal teams, and procurement functions.

A degree in Information Security, Computer Science, Law, Business Administration, or a related discipline, or equivalent professional experience in a regulated technology or financial services environment.

Professional certification or active pursuit thereof in a relevant discipline, such as CompTIA Security+, ISO 27001 Foundation or Lead Implementer, CC (ISC²), or CISA (ISACA).

Familiarity with ESG reporting frameworks applicable to technology businesses, including GRI Standards, the UN Sustainable Development Goals, or India’s Business Responsibility and Sustainability Report (BRSR) requirements.

Experience using GRC tooling or response management platforms such as OneTrust, Archer, ServiceNow GRC, or equivalent questionnaire automation solutions such as Loopio, Responsive etc.