GRC Analyst – Governance, Risk & Compliance

About the role

This position sits at the core of governance, risk and compliance (GRC) operations within a fast‑scaling, payments‑focused environment. You will own day‑to‑day GRC execution, ensuring continuous compliance across multiple regulatory frameworks while collaborating closely with engineering, security, legal and leadership teams.

Key responsibilities

• Own and manage audit readiness activities, maintaining continuous evidence collection and coordinating with external auditors for SOC 2, PCI DSS and ISO 27001.
• Handle external security and compliance requests, including vendor assessments, security questionnaires and RFP responses.
• Support enterprise risk and compliance programs aligned with GDPR, DORA, NIS2 and the EU AI Act.
• Maintain the policy lifecycle: updates, exception handling, violation tracking and remediation follow‑ups.
• Contribute to certification efforts and expand into new compliance frameworks as business needs evolve.
• Partner with engineering and security teams to operationalise controls, strengthen vulnerability management and drive security awareness initiatives.
• Ensure ongoing compliance visibility through structured documentation and a continuous‑monitoring approach.

Required profile

• 3‑5 years of experience in GRC, compliance or information‑security governance.
• Hands‑on experience supporting external audits such as SOC 2, PCI DSS or ISO 27001.
• Familiarity with regulatory requirements including GDPR, DORA, NIS2 and emerging EU standards.
• Experience managing vendor risk assessments and third‑party due diligence.
• Strong organisational skills and the ability to manage multiple compliance workflows in parallel.

Required skills

• Proficiency with GRC and compliance platforms such as Vanta, Drata or OneTrust.
• Understanding of continuous control monitoring and evidence‑management practices.
• Excellent communication skills for cross‑functional collaboration.