GRC Associate

We are seeking a Security GRC Associate to join our Information Security team at Trainline. As a GRC Associate, you will be responsible for managing third-party security risk and assurance, ensuring that our suppliers, technology partners, and service providers meet the security standards expected by our customers.

Key responsibilities include:

• Running third-party security risk assessments for new and existing suppliers
• Reviewing supplier assurance evidence and judging the adequacy of controls
• Identifying and documenting third-party security risks and recommending mitigation measures
• Supporting our wider governance and compliance programme, including ISO 27001 and our unified internal control framework
• Helping to build and improve our GRC tooling using automation and AI

Requirements:

• Experience in information security, GRC, third-party risk management, or a related cyber security discipline
• Hands-on experience running third-party security assessments or reviewing supplier assurance documentation
• Working knowledge of security standards and frameworks, particularly ISO 27001, ISO 27002, and NIST CSF
• Strong analytical and problem-solving skills, with the ability to manage multiple assessments and priorities
• Clear written and verbal communication skills

Nice to have:

• Experience with GRC or third-party risk platforms
• Familiarity with SOC 2, ISO 22301, PCI DSS, or Cyber Essentials
• Experience assessing cloud services, SaaS, or AI-enabled tools
• Relevant certifications such as ISO 27001 Foundation

We offer fantastic perks, including private healthcare, dental insurance, a generous work-from-abroad policy, and excellent family-friendly benefits. We're committed to career growth, with clear career paths, transparent pay bands, and personal learning budgets.