GRC Analyst

We’re the world's first unified payment infrastructure, empowering businesses worldwide to unleash their payment potential. By choosing our platform, merchants can take control over their payment stack, create unique commerce experiences, accelerate their roadmap and increase payment success. We strive to make something complex, incredibly simple and intuitive. The world's top investors, including Accel, Balderton, Iconiq, and Tencent, have invested in Primer's vision to rebuild payments and commerce from the ground up.

Join us in shaping the future of payments and commerce.

We're looking for a GRC Analyst to take ownership of our Governance, Risk & Compliance program. As our regulatory footprint and customer trust requirements have grown, we're investing in a dedicated GRC function to ensure we maintain a strong, continuous compliance posture.

This is a mid-level, individual contributor role reporting into the engineering/security organisation. You'll partner closely with engineers as subject-matter experts while owning the day-to-day execution and operational rhythm of GRC across the business.

Maintain a year-round evidence calendar, run continuous control monitoring, and coordinate with external auditors.

Own inbound security questionnaires, vendor assessments, and RFP responses. Maintain a response library so we can turn these around quickly and consistently, keeping deals and procurement moving.

Coordinate risk assessments, partner on security awareness and training programs, and govern vulnerability management processes. With obligations spanning PCI DSS, DORA, NIS2, and the EU AI Act, you'll help us stay ahead of evolving requirements.

Maintain policies, manage exceptions, monitor for violations, and drive remediation follow-through. You'll be the single point of accountability for keeping our policy framework current and enforceable.

Drive future certification efforts, including ISO 27001, and support the operationalisation of new regulatory frameworks as they come into scope.

• 3–5 years in a GRC, compliance, or information security governance role

• Hands-on experience coordinating external audits (SOC 2, PCI DSS, ISO 27001, or similar)

• Familiarity with EU regulatory frameworks such as GDPR, DORA, NIS2, and the EU AI Act

• Experience managing vendor risk assessments and third-party due diligence

• Track record of maintaining evidence and controls on a continuous (not just annual) basis

• Strong organisational skills

• Clear, concise communicator who can work across engineering, legal, and leadership teams

• Comfortable working with compliance tooling and GRC platforms (e.g., Vanta, Drata, OneTrust, or similar)

• Detail-oriented with a bias for proactive, systematic work over reactive cleanup

• Able to operate independently while knowing when to pull in subject-matter experts

• Familiarity with IAM processes and access review cycles

• Relevant certifications (CISA, CRISC, ISO 27001 Lead Implementer, or similar)

• Experience in a payments, fintech, or regulated technology environment, particularly with PCI DSS compliance

We’ve been recognised as a top global employer, #1 in FinTech for ‘flexibility’!

We’re building a culture where people can come and do their best work and enjoy it. We want our people to be proud of the impact that they have at Primer, and of the work that they are doing. You will be working with a team of people who are mission-driven, smart, and reflective, and who are invested in building exceptional products and delivering success for our merchants (and we also know how to have fun along the way).

We work remotely. We believe that building a successful, profitable company goes beyond proximity. We invest in our relationships with each other through great remote working practices and thoughtfully designed face-to-face time together. Our heads-together time comes in the form of workstations, our annual company retreat, and co-working space access worldwide.

Finally, let’s go ahead and say it. The work that we do is challenging. Startups are a challenge, building category defining products is a challenge. You should be prepared for a challenge at Primer. But, there’s a big difference between a challenge and a struggle. The key difference is that the right challenge comes with the right support structures, an acceptance that not everything always goes to plan, a collaborative environment, and a great team around you. It’s never a challenge that you will face alone.

🌍 We are fully remote and globally distributed; and have been since day one

💰 Competitive share options

🌴 Uncapped holiday, with 25 days minimum to be taken

🗣️ Co-working space access

📅 Workations & Company Retreat

💻 The best equipment for your role

🏠 £500 towards your home office setup

🔎 Generous learning budget

🏥 Private Medical Insurance

📈 A broad set of additional perks and benefits (depending on location)

At Primer, we’re dedicated to building a diverse, inclusive, and authentic workplace. If you’re excited about this role but your past experience doesn’t align perfectly with every qualification in the job description, we encourage you to apply. You may be the right candidate for this or other roles. Primer is committed to the equal treatment of all current and prospective employees, regardless of background or beliefs.

Primer adopts a zero-tolerance approach to discrimination. We are committed to providing equal opportunities to all current and prospective employees regardless of age, disability, sex, sexual orientation, pregnancy and maternity, race or ethnicity, religion or belief, gender identity, or marriage and civil partnership.