Security Compliance Analyst

Remote: yes Posted: 2026-10-14

- Own a set of assigned security control processes end to end: plan them, carry them out, gather evidence, and track findings until they’re resolved with clear ownership.

- Perform manual and tool-based security controls, helping us close gaps where controls are missing or not run consistently.

- Carry out regular reviews, such as user access reviews, and make sure results and actions are recorded.

- Run day-to-day Third-Party Risk Management (TPRM) activities: assessing new and existing suppliers, reviewing their security posture, tracking risks and scheduling reassessments.

- Keep our security and privacy registers (supplier, risk, asset and data processing) accurate and current.

- Help analyse security and privacy requirements in bids and tenders from transport agencies, working with the wider team to prepare clear, accurate answers.

- Respond to security questionnaires and information requests from existing customers.

- Support audits and certifications (such as ISO 27001, ISO 27017/27018, AICPA SOC 2, PCI DSS, NIST CSF and Cyber Essentials) by preparing evidence and documentation.

- Spot opportunities to automate or improve control processes, including with AI tools, and help put them in place.

- Experience with Third-Party Risk Management or vendor security assessments.

- Knowledge of frameworks such as ISO 27001, SOC 2, PCI DSS, GDPR or NIST, and experience mapping controls across them.

- Experience supporting RFPs, tenders or customer security questionnaires.

- Hands-on experience with compliance automation or GRC platforms (for control monitoring, evidence collection and audit management).

- Interest in automation, such as scripting, low-code tools (e.g. n8n, Make) or using AI to improve workflows.

- Experience with Vanta, AWS, Jira or Confluence.