EG Group
Senior GRC Analyst
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Role: Senior GRC Analyst
Location: Horwich, BL6 6JW
Contract: Full-Time Hours / Fixed Term – 6 months
Salary: £70,000 – £80,000
Company: EG Group
About the Role:
Cumberland Farms is looking for an experienced Senior GRC Analyst to join our Information Security team. Reporting to the Head of Information Security, you will provide specialist support across a range of information security governance, risk, and compliance workstreams.
The role will have a particular focus on NIS2 audit readiness, security risk assessments, ISMS and policy governance, cyber risk management, control assurance, and security awareness. You will work closely with stakeholders across Technology, Legal, Data Protection, Finance, HR, Project Delivery, and wider business operations, taking ownership of defined workstreams and delivering clear, practical, and audit-ready outcomes.
This is a hands-on, delivery-focused opportunity for an experienced GRC professional who can work independently, manage competing priorities, and bring structure and momentum to complex information security activities.
Why Join Cumberland Farms?
- Discretionary performance-based bonus scheme
- Grow your career – gain accredited qualifications, apprenticeships, and progression opportunities within a global organisation
- Flexible working hours
- Hybrid working – up to 2 days per week (dependent on role and business needs)
- Salary Sacrifice Schemes – Cycle to Work and Car Scheme available
- Enhanced Maternity & Paternity leave
- Generous annual leave entitlement
- Annual leave buy back scheme – purchase up to 5 additional days
- Discounted gym membership – stay healthy and save on fitness costs
- One paid volunteering day per year
- Wellbeing facilities – space to relax and recharge
- Free secure on-site parking
- Dress Down Fridays
- Free VDU eye test
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
What you’ll be doing:
- Support NIS2 audit readiness by coordinating evidence, conducting readiness reviews, and tracking remediation activity.
- Conduct proportionate security risk assessments across projects, systems, and technology changes, identifying risks and recommending practical controls.
- Support the maintenance and continuous improvement of the ISO 27001-aligned Information Security Management System (ISMS).
- Review and maintain information security policies, standards, procedures, and control frameworks to ensure they remain current and aligned to business requirements.
- Assess the design and operating effectiveness of security controls, identifying gaps and tracking improvement actions through to completion.
- Maintain the cyber risk register, ensuring risks, treatments, actions, ownership, and review dates remain accurate and up to date.
- Coordinate audit findings, remediation activity, assurance evidence, and third-party security assessments, while supporting security awareness and phishing simulation campaigns.
- Produce GRC reporting and metrics for senior stakeholders and governance forums, while continuously improving GRC processes, templates, and guidance.
This list is not exhaustive and may be added to or amended from time to time.
What we’re looking for:
- Significant practical experience in Information Security Governance, Risk and Compliance at Senior Analyst, Consultant, or equivalent level.
- Demonstrable experience supporting regulatory, certification, or external security audit readiness, including evidence coordination and remediation management.
- Hands-on experience with ISO 27001-aligned Information Security Management Systems and information security policy and control governance.
- Experience conducting project and technology security risk assessments and assessing control design and operating effectiveness.
- Strong analytical and evidence-management skills, with the ability to translate regulatory and framework requirements into practical actions.
- Confident communication and stakeholder management skills, with the ability to engage technical and non-technical stakeholders and present to governance forums.
- A pragmatic and business-focused approach, with the confidence to challenge weak controls, incomplete evidence, or unclear ownership.
- Relevant qualifications such as CISM, CRISC, CISSP, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor would be advantageous, as would experience with NIS2, GRC platforms, or GDPR.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Who is Cumberland Farms?
Cumberland Farms has a proud heritage dating back to 1939 and today is part of a global retail organization serving customers and communities across multiple markets including the U.S., U.K., Germany and Benelux. With operations spanning convenience retail, foodservice, fuel, and other retail formats, our business is supported by a broad network of stores, sites, distribution operations, and support teams.
As our global organization transitions under the Cumberland Farms brand, our businesses, including those historically operating as EG Group, are coming together with shared values, capabilities, and a commitment to delivering exceptional experiences for our customers and colleagues.
Together, we are building on the strength and heritage of our businesses while creating a more connected global organization with a clear strategic direction and a continued focus on supporting our customers, colleagues, and communities across all the markets we serve.
Please note - the successful applicant will be subject to a DBS check which will be funded by EG Group.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location