Risk, Fraud & Compliance

GRC Analyst

A GRC (Governance, Risk, and Compliance) Analyst supports an organisation's framework for managing risk, meeting regulatory obligations, and ensuring that internal controls are designed and operating effectively. Day-to-day work involves maintaining risk registers, conducting control assessments, supporting internal and external audits, tracking regulatory changes, and preparing management reporting on the organisation's risk and compliance posture. GRC Analysts typically work across the business, engaging with teams in operations, IT, finance, and legal to understand risk exposures and gather evidence of control effectiveness. The role bridges governance structures — policies, frameworks, and committee reporting — with the practical testing and monitoring of controls. In technology-heavy organisations, GRC Analysts often work closely with information security teams, making this one of the roles where cyber and compliance skills genuinely intersect. Entry-level positions focus on documentation, control evidence gathering, and maintaining GRC platforms such as Archer, ServiceNow GRC, or MetricStream. Progression leads toward risk management, audit, or specialist compliance roles, and the GRC framework underpins career paths in financial services, technology, healthcare, and the public sector.