The GRC Analyst supports the integrity and currency of MyPass's third-party provider, risk, policy, and CAPA registers, ensuring all entries are reviewed, updated, or progressed to closure on schedule with appropriate evidence. The role supports the Senior Corporate Services Manager's ISMS ownership and audit obligations, and provides broader coordination support across compliance platforms, training campaigns, system access, Google Workspace guidance, and process documentation.
Responsibilities
Policy Register Management
- Monitor the policy lifecycle to ensure review deadlines are met
- Coordinate the policy review and approval process across all business areas
- Publish approved policies in Confluence and Drata
- Maintain the controlled document register, published versions, and master files
- Maintain controlled templates within the master files and Google Gallery
Risk Register Support
- Coordinate the timely review of risks within Drata
- Support the Senior Corporate Services Manager with risk assessment scheduling, expediting evidence with stakeholders, and preparing documentation for risk closure
- Monitor and report on risk review completion status
Drata Control Readiness Oversight
- Monitor and report on Drata control readiness, identifying failing or at-risk technical, operational, and people controls
- Create and manage Jira tickets for control issues requiring remediation, coordinating with control owners through to resolution
- Coordinate personnel compliance within Drata, including monitoring onboarding and offboarding status against required timeframes
- Maintain the Drata evidence register, ensuring evidence is current, complete, and mapped to the correct controls
Third-Party Provider Register Management
- Maintain the third-party provider register covering software vendors, IT service providers, and other third-party providers
- Coordinate vendor due diligence and periodic performance reviews with relevant stakeholders
- Ensure vendor contract records, renewals, and review evidence are current and accurately maintained
CAPA Register Management
- Own the CAPA register within QT9, covering corrective actions arising from ISO audits, risk treatments, and incidents
- Expedite the collection of evidence from stakeholders to support timely CAPA closure
- Prepare and present evidence for review by the Senior Corporate Services Manager prior to closure, flagging any gaps or inconsistencies identified
- Maintain CAPA reporting and manage CAPA workflows end to end
- Support the internal audit programme, providing CAPA status and evidence to the Lead Auditor and internal auditors as required
KnowBe4 Training Campaign Support
- Coordinate the rollout of new KnowBe4 training campaigns
- Monitor the validity of training modules to ensure content remains current
- Prepare and distribute KnowBe4 completion and compliance reports
System Access Reviews
- Coordinate and undertake system access reviews on a rolling schedule across managed platforms
- Support timely remediation of identified access issues with relevant stakeholders
Google Workspace Support
- Provide guidance to users on Google Workspace functionality, including templates and shared drives
- Undertake analysis of user needs for shared drives to inform structure and access decisions
Project Support
- Provide project support as required across Corporate Services initiatives, including coordination, documentation, and status reporting
Process Documentation
- Document GRC standard operating procedures in Confluence, keeping content current as processes evolve
Compliance and Audit Support
- Support external audit processes, including ISO 27001 certification and surveillance audits
- Maintain documentation, configurations, and evidence in accordance with ISMS requirements
Requirements
Core GRC and Compliance Experience
- Demonstrated experience in GRC, risk, or compliance roles within an organisation managing information security or regulatory compliance obligations
- Proven ability to manage and coordinate multiple compliance registers simultaneously, including policy, risk, and corrective action registers
- Demonstrated experience working within a GRC platform such as Drata or equivalent, including control monitoring, evidence management, and compliance reporting
Audit and CAPA Support
- Demonstrated experience supporting internal or external audit programmes, including evidence preparation and coordination
- Experience managing or coordinating corrective action or CAPA workflows through to closure
Stakeholder Coordination
- Proven ability to coordinate across multiple business areas to meet compliance deadlines without direct authority over stakeholders
- Demonstrated experience expediting evidence or actions from stakeholders and escalating appropriately where timelines are at risk
Systems and Tooling
- Experience using Jira or equivalent ticketing tools for issue tracking and remediation coordination
- Working knowledge of Google Workspace, including shared drive structure and administration (highly desirable)
- Experience documenting standard operating procedures in a platform such as Confluence
Personal Attributes
- Demonstrated critical thinking and independent problem-solving in past roles, with evidence of identifying and resolving issues without being directed to do so
- High attention to detail, particularly in reviewing and preparing compliance evidence
Information Security Accountabilities
- Understand own contribution to the effectiveness of the ISMS
- Understand own responsibilities within the ISMS (e.g. Acceptable Use of Assets Policy, Information Security Policy)
- Understand the consequences of non-compliance with the requirements of the ISMS
- Understand information security guidelines related to own job role
Skills Required
- Demonstrated experience in GRC, risk, or compliance roles managing information security or regulatory compliance obligations.
- Proven ability to manage and coordinate multiple compliance registers (policy, risk, CAPA) simultaneously.
- Experience working within a GRC platform such as Drata or equivalent (control monitoring, evidence management, compliance reporting).
- Experience owning the CAPA register and using QT9 for corrective action workflows.
- Experience supporting internal or external audit programmes, including evidence preparation and coordination for ISO 27001.
- Experience creating and managing Jira tickets or equivalent for issue tracking and remediation coordination.
- Experience documenting standard operating procedures in Confluence or equivalent documentation platform.
- Working knowledge of Google Workspace, including shared drive structure and administration.
- Proven ability to coordinate across multiple business areas and expedite evidence from stakeholders without direct authority.
- High attention to detail and demonstrated critical thinking and independent problem-solving.
What We Do
MyPass™ is a multi-award-winning technology company that empowers workers to manage their training and competency information through a digital Skills Passport. MyPass™ is simplifying the compliance management process for organisations in highly regulated industries by removing compliance gaps. For our clients, this is about two things: reducing risk by accessing real-time compliance data, and reducing back-office costs by up to 70% through more streamlined processes. In short, we are creating a global worker credentialing platform designed to save time, and reduce risk in the workplace
