• Coordinate the operation of the enterprise risk management process, including risk identification, assessment, treatment, review and reporting.

• Support business and operational leaders in documenting risks, controls, treatments, owners and review updates in line with the risk management framework.

• Review risk records for quality, completeness and consistency before escalation to the Group Head of GRC or relevant governance forums.

• Prepare risk reports, trend analysis and exception reporting for senior stakeholders and governance committees.

• Identify emerging or recurring governance, operational, cyber, third-party and compliance risks and support appropriate escalation.

Audit, Assurance and Certification

• Coordinate internal audit planning and delivery across relevant management system standards, including audit schedules, evidence requests, stakeholder coordination and report drafting.

• Support external audits and certification activities by managing evidence requests, audit logistics, finding trackers and remediation updates.

• Review audit findings, corrective actions and opportunities for improvement to ensure clear ownership, suitable remediation plans and timely closure evidence.

• Support customer assurance, tender responses and due diligence questionnaires by preparing accurate responses using controlled GRC evidence sources.

• Help maintain audit readiness across the organisation by identifying evidence gaps and coordinating remediation with process owners.

Compliance and Regulatory Support

• Monitor relevant regulatory, contractual and standards-based requirements and support impact assessments for changes affecting the IMS or GRC framework.

• Support the maintenance of compliance registers, obligations trackers and evidence of compliance across applicable jurisdictions and standards.

• Assist with regulatory and contractual assurance activities, including information gathering, evidence preparation and reporting.

• Coordinate with business stakeholders to ensure compliance obligations are understood, assigned and evidenced.

• Provide practical guidance to stakeholders on governance, risk and compliance processes, escalating matters requiring formal advice or independent challenge to the Group Head of GRC.

Supplier Governance and Third-Party Risk

• Lead routine supplier governance reviews, including risk assessment, evidence review, assurance documentation and supplier review commentary.

• Coordinate supplier due diligence activity for new and existing suppliers, ensuring risk indicators, assurance records and follow-up actions are appropriately documented.

• Review supplier assurance materials, certifications, privacy documentation and security evidence, escalating higher risk matters for senior review.

• Maintain supplier governance trackers, review schedules and reporting metrics.

• Support the continual improvement of supplier governance processes, templates and reporting.

Team Support, Reporting and Continuous Improvement

• Provide day-to-day guidance, review and quality control for GRC Analyst activities.

• Develop practical templates, guidance notes, trackers and reporting outputs to improve consistency and efficiency across the GRC function.

• Prepare concise and accurate reports for management, governance forums and senior stakeholders.

• Support training and awareness activity across governance, risk, compliance and management system topics.

• Promote a culture of accountability, evidence-based compliance, continual improvement and constructive challenge across the organisation.

• Demonstrable experience in governance, risk, compliance, audit, information security, supplier governance or management systems.

• Strong knowledge of ISO/IEC 27001 and practical experience supporting an ISMS.

• Experience with one or more additional standards or frameworks such as ISO 9001, ISO 14001, ISO/IEC 20000-1, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, NEN 7510, SOC 2 or ISAE 3402.

• Experience coordinating internal audits, external audits, evidence requests, corrective actions or certification activities.

• Experience supporting enterprise risk management, supplier due diligence, customer assurance or compliance reporting.

• Relevant professional qualifications in GRC, audit, risk management, information security, service management, data protection or management systems are desirable.