GRC Security Specialist

The role

You will own the recurring security assurance cycle and run the third-party security programme. You will build controls, gather evidence, and manage risk and vulnerability reporting.

What you will do

• Run security due diligence on new suppliers
• Maintain a supplier tiering model and periodic re-assessment cycle
• Maintain supplier and outsourcing registers
• Track concentration risk and exit plans for critical suppliers
• Own responses to security due diligence from partners and investors
• Build and maintain a reusable trust pack
• Maintain the annual calendar of security activities
• Coordinate external penetration tests
• Facilitate tabletop exercises
• Maintain the information security risk register

Required qualifications

• Three or more years in an information security assurance, GRC or security compliance role
• Experience in a regulated financial services environment or environment with real external audit pressure
• Hands-on experience of ISO 27001
• Experience running third-party or vendor security assessments
• Experience responding to inbound security due diligence
• Ability to read technical findings and form views on severity and exploitability
• Clear, concise written English

Nice to have

• Experience of a cloud-native environment, ideally AWS
• Experience of scaling a control framework as an organisation grows
• Familiarity with UK operational resilience expectations (SYSC 15A) and outsourcing requirements (SYSC 8)
• Certifications such as CISM, CISA, ISO 27001 Lead Implementer or Lead Auditor, CRISC or CCSP

Benefits

• Equity
• 25 days holiday a year, plus 8 bank holidays
• 2 paid volunteering days per year
• One month paid sabbatical after 4 years
• Employee loan
• Free gym membership through WellHub
• Team wellness budget

About the company

Abound is redefining consumer lending in the UK using advanced AI and Open Banking data. They are a fast-growing fintech backed by investors including Citi, GSR Ventures, and Deutsche Bank.