Governance Risk & Compliance Analyst (UK Citizen)

Title: Governance Risk and Compliance Analyst

Location:Remote - UK

Compensation:£52,374 GBP

About PSI

Join Us at PSI - Where You Belong, Grow, and Thrive!

At PSI, we believe that people achieve their best when they feel they truly belong. That’s why fairness and opportunity are at the heart of everything we do - not just words, but values deeply embedded in our culture and the full employee experience.

We’re proud to foster an environment where everyone is supported to reach their full potential. From your first day through every step of your journey with us, you’ll feel the difference in how we work, grow, and succeed together.

What You Can Expect From Us - We know that great work starts with feeling valued. That’s why we’ve benchmarked all our roles against local market rates and why you’ll always see salary details in our job postings. We believe in transparency, and we want you to feel confident that your next move aligns with your expectations.

About the Role

The Information Security, Governance, Risk and Compliance Analyst works across information security, privacy, quality, environmental sustainability and business continuity, with a primary focus on risk assessment, security control effectiveness, corrective actions and actionable governance reporting.

Working with IT, Information Security, suppliers, process owners and assurance stakeholders, the analyst translates risk and control findings into practical recommendations, documented decisions, and tracked improvements.

The role also supports PSI’s integrated management systems and compliance programmes, including ISO 27001, ISO 9001, ISO 14001, ISO 22301, SOC 2, NIST and PCI-related requirements.

This is a full-time, permanent position, Monday to Friday with flexible hours around a standard 0900-1700. The role can be performed remotely, with occasional travel to offices and test centers globally to support with audits.

Role Responsibilities

Risk identification and assessment: Conduct and document risk assessments of systems, applications, business processes and suppliers; evaluate inherent and residual risk, maintain risk registers, and recommend proportionate risk treatment.

Technical control evaluation: Review the design and effectiveness of security controls, including identity and access management, vulnerability and patch management, cloud security, logging, data protection and business continuity; identify and communicate control gaps.

Corrective actions and remediation: Coordinate corrective actions, nonconformities and risk treatment plans through closure, tracking accountable owners, root causes, target dates, supporting evidence and timely escalation.

Third-party and vendor risk: Carry out information security and third-party risk assessments, including IESAs as applicable; critically review supplier responses and evidence and follow up on identified risks and remediation.

Governance and management reporting: Support BMS, ISMS/IMS and Risk Committee governance through meeting papers, risk and control metrics, management reporting, action logs, meeting coordination and follow-up.

Risk-based advice and escalation: Translate assessment results, technical findings and emerging issues into practical recommendations for process owners and management; communicate material risks early.

GRC process improvement: Identify opportunities to strengthen and standardize risk, control and governance processes, including more efficient workflows and use of GRC tools such as Vanta.

Policies and control documentation: Develop and maintain policies, standards, procedures and supporting control documentation covering information security, data protection, quality, environmental management and business continuity.

Cross-functional coordination: Work with IT, Information Security, Privacy, Quality, auditors and process owners to assess changes, challenge control evidence, resolve issues and improve operational risk management.

Audit and assurance support: Coordinate internal and external audits, validation activities and compliance reviews; maintain the evidence repository, support responses and track findings to resolution.

Standards and certifications: Support ongoing ISO 27001, ISO 9001, ISO 14001, ISO 22301, SOC 2, SOX ITGC, NIST CFS 2.0 and PCI-related assurance and compliance activities.

Awareness and continuous learning: Support business inquiries, GRC awareness and training, and remain informed about relevant security, risk and regulatory developments.

Knowledge, Skills and Experience Requirements

Hands-on GRC risk experience: At least 2 years of direct information security GRC experience, with practical involvement in risk assessments, documenting risk decisions and following treatment or remediation activities to closure.

Technical security understanding: Working knowledge of IT and security control processes, such as access management, vulnerability and patch management, cloud security, change management, security logging, data protection and backup/recovery, sufficient to assess control evidence and identify gaps.

Risk methodology and judgement: Ability to assess likelihood, impact, control effectiveness, inherent and residual risk, and recommend reasonable risk treatment; familiarity with ISO 27005, ISO 31000 or NIST CSF approaches is advantageous.

Corrective-action management: Experience tracking control deficiencies, corrective actions or nonconformities, working with action owners to establish root causes, agree to remediation and verify closure.

Third-party risk assessment: Experience reviewing vendor or supplier security risks, questionnaires and supporting evidence, and coordinating follow-up actions.

Governance and reporting: Experience preparing clear risk or control metrics, meeting papers, action logs and reports for management or governance committees.

Analytical and stakeholder skills: Strong analytical thinking, attention to detail, written and verbal communication, and the confidence to question assumptions and work effectively with technical and non-technical stakeholders.

Framework knowledge: Working knowledge of ISO 27001 and SOC 2 plus familiarity with one or more of ISO 9001, ISO 14001, ISO 22301, PCI, SOX ITGC and GDPR.

GRC platforms and delivery: Knowledge of GRC tools and good practice, preferably Vanta; demonstrated ability to manage multiple priorities, improve processes and maintain reliable risk or audit records.

Audit experience: Experience supporting internal or external audits and organizing audit evidence and responses; approximately 1 year of ISO 27001 and/or SOC 2 audit involvement is preferred.

Professional certifications (preferred): GRCP, CGRC or risk/security-focused qualifications such as CRISC, CISSP, CISA or CISM.

Benefits & Culture

• Alongside a competitive salary, we offer a comprehensive benefits package designed to support your well-being, your future, and your sense of purpose:
• Retirement Benefits: 401(k), pension, or country-specific retirement plans with employer contributions
• Generous Time Off: Enhanced paid time off/annual leave policies
• Health & Wellbeing Coverage: Medical insurance tailored to your region, plus:
• US: Dental, vision, life, and short-term disability insurance
• UK: Medical cashback plan including dental, vision, and income protection

Flexible Spending Accounts (US)

• Employee Assistance Program (EAP): Confidential support whenever you need it
• Work-Life Balance: We understand life happens outside of work, and we fully support flexibility
• Wellness Culture: Regular global wellness initiatives to help you stay healthy and inspired
• Future Planning: Tools and support to help you grow personally and professionally
• Giving Back: Enjoy a Volunteer Day each year and opportunities to support our communities and industry
• At PSI, we’re more than just a workplace - we’re a global team driven by shared values and real impact. If you're ready to be part of a company that’s committed to your growth and well-being, we’d love to hear from you.