[Hiring] Information Security Analyst @Cognism

Role Description

Cognism is hiring for a GRC Analyst to help run and strengthen our governance, risk, and compliance programme.

• Support operation of ISO 27001 and SOC 2 frameworks
• Own evidence collection and control tracking
• Take risk-based approach to all work
• Work closely with Engineering, IT Operations, and Compliance
• Build relationships that drive remediation closure
• Grow your GRC career in a data-intensive product environment.

Within 12 months, you will have:

• Become trusted owner of evidence and control monitoring across ISO 27001 and SOC 2
• Built strong relationships enabling tracked remediation to closure
• Applied risk-based lens to prioritise impactful gaps over low-value items
• Improved at least one recurring security process for speed or efficiency
• Developed working knowledge of AI security and control intersections

What You'll Own:

• Support day-to-day GRC programme operations including control monitoring and audit readiness
• Maintain and improve documentation: policies, procedures, risk registers, control mappings
• Support internal and external audits, questionnaires, vendor risk assessments
• Take risk-based approach to prioritising work and effort allocation
• Partner with Engineering, IT Operations, Compliance to track remediation closure
• Build trusted relationships where teams bring problems early
• Identify and implement process improvements for efficiency and automation
• Stay current on emerging risks including AI-related exposures
• Flag AI risk intersections with existing controls and programmes

Qualifications

• 1-2 years experience in security, GRC, IT audit, or related risk function
• Working knowledge of ISO 27001 and/or SOC 2 fundamentals
• Detail-oriented: notice inconsistencies and gaps others miss
• Process-driven: build and follow repeatable, well-documented processes
• Strong written and verbal communication skills
• Explain risk and compliance concepts to technical and non-technical audiences
• Comfortable working across Engineering, IT Operations, and Compliance teams
• Build trust and hold risk-based mindset in practice
• Weigh likelihood and impact rather than treat all requirements equally
• Comfortable with ambiguity and willing to ask questions
• Curious about AI: risks, potential, and compliance applications
• AI security and risk working knowledge is strong plus, not mandatory
• Builder mentality: energised by bringing structure to processes
• Pragmatic about sequencing and focused on outcomes over box-ticking

Benefits

• Inclusive community of brilliant, diverse people
• Opportunity to make an impact
• Values that guide how we work and grow together