GRC Analyst

About Us

Duco is on a mission to reduce the time spent on data-related work by 90%. Our enterprise data automation platform empowers teams to work more efficiently and meaningfully by giving them the ability to automate data controls with the latest technology, such as no-code, the cloud, and AI.

We help firms to start trusting their data, by giving them one intuitive platform to automate the front-to-back processing of all kinds of data (from structured Excels and RTFs to unstructured PDFs and emails). This eliminates the boring manual work across the data lifecycle and enables firms to act faster, work smarter, save money, reduce risk and comply with regulatory requirements.

We’re headquartered in London and have offices in New York, Wroclaw, Singapore, and Antwerp. We’re proud to call some of the largest global financial institutions our clients, including over 15 of the world’s largest international banks, as well as brokers, exchanges, asset managers, hedge funds, administrators, service providers and corporates.

The opportunity

We are seeking a Senior GRC Analyst to support our Security GRC Manager in the preparation and execution of our external audit programme (ISO 27001, SOC 1 and SOC 2). During the initial phase of the role, you will also take ownership of our Enterprise Risk Management Framework. This is a broad remit, encompassing how we demonstrate our commitment to security, how we fulfil our obligations to clients and regulators, and how we identify, assess and monitor security and business risk.

Audit and assurance sit at the core of this position. You will collaborate daily with the Information Security team, external auditors and control owners across the business to ensure the operating effectiveness of our controls can be clearly evidenced. Initially, you will also own the risk register and the processes governing risk appetite, exception management and risk prioritisation, including reporting to our Risk Committee. Over time, responsibility for risk management will transition to another member of the team, enabling you to focus primarily on audit and assurance.

The role is well suited to a structured, detail-oriented professional who is equally comfortable operating at an operational and a strategic level. You will work closely with stakeholders across Security, Legal, Engineering and the Executive Leadership Team.

Reporting to the Security GRC Manager, you will play an integral role in shaping the future direction of Information Security at Duco.

• A minimum of 5 years’ experience in Information Security or a comparable role
• Demonstrable hands-on experience supporting external audits (ISO 27001, SOC 1 and/or SOC 2 Type II), including evidence collection, control testing and direct engagement with auditors
• Proven experience in technology risk management and information security, with a focus on risk identification, assessment and mitigation
• Strong understanding of technology systems and cyber/technology risk management activities, including control effectiveness assessments, reporting and mitigation tracking, with the ability to translate technical findings into clear business impact
• Experience managing or supporting Information Security assessments of third parties
• Experience supporting an established Information Security Management System (ISMS) and maintaining security accreditations such as ISO 27001, SOC 1 and SOC 2
• Professional fluency in English, with the confidence to engage directly with UK-based stakeholders and external auditors
• A track record of operating effectively in a fast-paced, highly collaborative environment
• Excellent communication, documentation and stakeholder management skills

Desirable

• Experience within Financial Services or a similarly regulated industry
• ISO 27001 Lead Auditor or Lead Implementer, CISA or CRISC certification
• IT audit experience gained at a Big Four or comparable firm
• Familiarity with the Digital Operational Resilience Act (DORA)
• Working knowledge of Claude, Rovo, Jira and Confluence