GRC Associate

Trainline

. Run third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers, technology partners and business-critical vendors .

Posted 11/12/2026full-timeLondon • United KingdomJuniorMid-Level💰 £55,000 - £65,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in third-party risk management, including conducting security assessments and reviewing supplier assurance documentation. Proficient in ISO 27001, GRC tools, and effective communication with both technical and non-technical stakeholders.

Highest-signal resume keywords

Third-Party Risk ManagementISO 27001 KnowledgeGRC Tool ExperienceAnalytical Problem-SolvingVendor Risk Processes

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Third-Party Security AssessmentsRisk ClassificationControl AssessmentsEvidence GatheringAudit PreparationRisk ReportingAutomation of GRC ProcessesCloud Services AssessmentAI Tool AssessmentSaaS Security

Soft Skills

Clear CommunicationAnalytical SkillsProactive MindsetCuriosityProblem-Solving

Tools & Technologies

ServiceNow GRCArcherLogicGateVantaCompyl

Certifications & Qualifications

ISO 27001 Foundation

Industry Keywords

Information SecurityGRCCyber SecuritySOC 2ISO 22301PCI DSSNIST CSFISMS MaintenanceAI Risk Management FrameworkISO/IEC 42001

Tech Stack

Tools & technologies

CloudCyber SecurityServiceNow

About the role

Key responsibilities & impact

Run third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers, technology partners and business-critical vendors
Review supplier assurance evidence including ISO 27001 certificates, SOC 2 reports, security questionnaires and penetration test summaries
Identify and document third-party security risks and recommend proportionate mitigations
Assess security risks of AI tools, applications and third-party AI integrations
Partner with Procurement, Legal, Privacy and Engineering to embed security requirements into supplier onboarding, procurement and contract renewals
Maintain third-party risk records, track remediation actions and escalate material risks
Support ongoing supplier assurance, periodic reassessments and critical-supplier monitoring
Improve the Third-Party Risk Management framework, including risk classification, assessment methods, questionnaires and reporting
Support ISO 27001 assurance work, control assessments, evidence gathering, audit preparation and remediation tracking
Help maintain the unified internal control framework
Build and improve GRC tooling using automation and AI for questionnaire reviews, evidence analysis, control mapping and risk reporting
Report to the GRC Manager and collaborate across Information Security and business functions

Requirements

What you’ll need

Experience in information security, GRC, third-party risk management or a related cyber security discipline
Hands-on experience running third-party security assessments, reviewing supplier assurance documentation or supporting vendor risk processes
Working knowledge of ISO 27001, ISO 27002 and NIST CSF
Experience working with Procurement, Legal, Technology and business stakeholders
Strong analytical and problem-solving skills
Ability to manage several assessments and competing priorities
Clear written and verbal communication
Ability to explain security requirements to technical and non-technical audiences
Proactive, curious mindset and interest in improving security governance and risk management
Experience with GRC or third-party risk platforms such as ServiceNow GRC, Archer, LogicGate, Vanta or Compyl (bonus)
Experience supporting ISO 27001 audits, ISMS maintenance or control assurance (bonus)
Familiarity with SOC 2, ISO 22301, PCI DSS or Cyber Essentials (bonus)
Experience assessing cloud services, SaaS or AI-enabled tools, or familiarity with ISO/IEC 42001 and NIST AI RMF (bonus)
Experience automating GRC processes using workflow tools, scripting, low-code platforms or APIs (bonus)
Confident, everyday use of AI tools and LLMs (bonus)
Relevant certification such as ISO 27001 Foundation or equivalent (bonus)

Benefits

Comp & perks

Private healthcare and dental insurance
Generous work from abroad policy
2-for-1 share purchase plans
EV Scheme
Extra festive time off
Family-friendly benefits
Clear career paths
Transparent pay bands
Personal learning budgets
Regular learning days
28-day Work from Abroad policy