GRC Analyst (Risk & Audit) | Contract | Outside IR35 | Hybrid, North West

What you'll be doing:

• Building and embedding a risk management function from the ground up
• Owning and maintaining risk registers, covering identification, assessment, treatment, monitoring and reporting
• Supporting NIS2 Directive compliance activity, including gap analysis and remediation tracking
• Planning and conducting internal audits, and preparing the organisation for external audits
• Identifying common control weaknesses and evidence gaps before they become audit findings
• Supporting NCSC Cyber Assessment Framework (CAF) activity and evidence gathering
• Engaging stakeholders at all levels to agree risk owners, track remediation actions and drive accountability
• Producing clear, concise risk and audit reporting for senior audiences

What we're looking for:

• Proven GRC experience with a clear emphasis on risk management
• Hands-on ownership of risk registers and a strong grasp of core risk methodology (likelihood/impact, risk appetite, inherent vs residual risk)
• Demonstrable experience with the NIS2 Directive (essential)
• Experience conducting audits end to end and supporting external audit preparation (ISO 27001 or similar)
• Exposure to NCSC CAF, ISO 27001, NIST or similar frameworks
• Clear, evidenced examples of stakeholder engagement, including influencing senior stakeholders and managing remediation across teams
• Confident communicator who can work independently from day one