Information Security Analyst - GRC
29 days ago
Birmingham
Information Security Analyst – GRCSalary: £45,000Contract: 12-month Fixed Term Contract (FTC)Location: Central Birmingham (Hybrid – 3 days per week on site) The Role We have an exciting opportunity for an Information Security Analyst – GRC to join a busy and collaborative technology function on a 12-month fixed term contract. This role will play a key part in supporting governance, risk and compliance (GRC) activities, with a strong focus on third-party risk management and data protection assurance across the organisation. Based in Central Birmingham, the role operates on a hybrid working model, requiring three days per week on site. Key Responsibilities Third-Party Risk Management • Conduct and coordinate information security and privacy risk assessments for new and existing suppliers., • Assess supplier controls relating to data protection, information security, data hosting and subcontractor usage., • Maintain accurate records of organisational data shared with third parties, including purpose of use, classification, sensitivity and processing location., • Ensure supplier data handling arrangements clearly define retention, archiving and deletion requirements in line with internal policies and regulatory obligations., • Support Procurement, Vendor Management, Legal and Information Security teams to embed supplier assurance throughout onboarding, renewal and contract processes., • Review how personal data is used across systems, processes and vendor solutions., • Ensure data classification, sensitivity and lifecycle controls are clearly documented., • Promote data minimisation by identifying unnecessary collection or retention of personal data and challenging excessive processing., • Document personal data risks, gaps and recommended actions in line with risk management processes., • Support the review, development and implementation of information security and data protection policies., • Contribute to information security risk registers and compliance monitoring activities., • Produce compliance reports, dashboards and metrics for management and senior stakeholders., • Assist with internal and external audits, including GDPR, PCI DSS and financial audits., • Track remediation of identified compliance and control issues to ensure timely closure., • Support incident response activities, particularly those involving third-party access or personal data., • Document business and supplier processes to support governance, risk and compliance requirements. You will bring a strong understanding of information security, privacy and risk management, with the confidence to engage and challenge stakeholders constructively. Essential experience and skills: • Good understanding of GDPR, the UK Data Protection Act, and information security control requirements., • Experience conducting supplier assurance, security due diligence or third-party risk assessments., • Ability to assess technical and organisational security controls., • Strong analytical skills with excellent attention to detail., • Clear written and verbal communication skills, able to work with legal, technical and operational teams., • Experience supporting incident or breach investigations., • Experience working in large, complex or multi-site environments., • Relevant certifications such as CIPP/E, CIPM, CompTIA Security+, or BCS Practitioner Certificate in Data Protection