Senior Grc Analyst
Pubblicato il 22-09-2026 - Bsc Group in Italia
Role:
Senior GRC Analyst
Location:
Horwich, BL6 6JW
Contract:
Full-Time Hours / Fixed Term – 6 months
Salary:
£70,000 – £80,000
Company:
EG Group
About the Role:
Cumberland Farms is looking for an experienced Senior GRC Analyst to join our Information Security team. Reporting to the Head of Information Security, you will provide specialist support across a range of information security governance, risk, and compliance workstreams.
The role will have a particular focus on NIS2 audit readiness, security risk assessments, ISMS and policy governance, cyber risk management, control assurance, and security awareness. You will work closely with stakeholders across Technology, Legal, Data Protection, Finance, HR, Project Delivery, and wider business operations, taking ownership of defined workstreams and delivering clear, practical, and audit-ready outcomes.
This is a hands-on, delivery-focused opportunity for an experienced GRC professional who can work independently, manage competing priorities, and bring structure and momentum to complex information security activities.
Why Join Cumberland Farms?
Discretionary performance-based premio scheme
Grow your career – gain accredited qualifications, apprenticeships, and progression opportunities within a global organisation
Flexible working hours
Hybrid working – up to 2 days per week (dependent on role and business needs)
Salary Sacrifice Schemes – Cycle to Work and Car Scheme available
Enhanced Maternity & Paternity leave
Generous annual leave entitlement
Annual leave buy back scheme – purchase up to 5 additional days
Discounted gym membership – stay healthy and save on fitness costs
One paid volunteering day per year
Wellbeing facilities – space to relax and recharge
Free secure on-site parking
Dress Down Fridays
Free VDU eye test
What you'll be doing:
Support NIS2 audit readiness by coordinating evidence, conducting readiness reviews,
and tracking remediation activity.
Conduct proportionate security risk assessments across projects, systems, and technology changes, identifying risks and recommending practical controls.
Support the maintenance and continuous improvement of the ISO *****-aligned Information Security Management System (ISMS).
Review and maintain information security policies, standards, procedures, and control frameworks to ensure they remain current and aligned to business requirements.
Assess the design and operating effectiveness of security controls, identifying gaps and tracking improvement actions through to completion.
Maintain the cyber risk register, ensuring risks, treatments, actions, ownership, and review dates remain accurate and up to date.
Coordinate audit findings, remediation activity, assurance evidence, and third-party security assessments, while supporting security awareness and phishing simulation campaigns.
Produce GRC reporting and metrics for senior stakeholders and governance forums, while continuously improving GRC processes, templates, and guidance.
This list is not exhaustive and may be added to or amended from time to time.
What we're looking for:
Significant practical experience in Information Security Governance, Risk and Compliance at Senior Analyst, Consultant, or equivalent level.
Demonstrable experience supporting regulatory, certification, or external security audit readiness, including evidence coordination and remediation management.
Hands-on experience with ISO *****-aligned Information Security Management Systems and information security policy and control governance.
Experience conducting project and technology security risk assessments and assessing control design and operating effectiveness.
Strong analytical and evidence-management skills, with the ability to translate regulatory and framework requirements into practical actions.
Confident communication and stakeholder management skills, with the ability to engage technical and non-technical stakeholders and present to governance forums.
A pragmatic and business-focused approach, with the confidence to challenge weak controls, incomplete evidence, or unclear ownership.
Relevant qualifications such as CISM, CRISC, CISSP, ISO ***** Lead Implementer, or ISO ***** Lead Auditor would be advantageous, as would experience with NIS2, GRC platforms, or GDPR.
Who is Cumberland Farms?
Cumberland Farms has a proud heritage dating back to **** and today is part of a global retail organization serving customers and communities across multiple markets including the U.S., U.K., Germany and Benelux. With operations spanning convenience retail, foodservice, fuel, and other retail formats, our business is supported by a broad network of stores, sites, distribution operations, and support teams.
As our global organization transitions under the Cumberland Farms brand, our businesses, including those historically operating as EG Group, are coming together with shared values, capabilities, and a commitment to delivering exceptional experiences for our customers and colleagues.
Together, we are building on the strength and heritage of our businesses while creating a more connected global organization with a clear strategic direction and a continued focus on supporting our customers, colleagues, and communities across all the markets we serve.
Please note - the successful applicant will be subject to a DBS check which will be funded by EG Group.