GRC Analyst

at  boohoo group

ABOUT US

Having started in 2006 with just three team members, we’ve evolved into a multi-brand, ecommerce giant with offices worldwide and a passionate team of over 4,000. In the past year alone, we’ve achieved remarkable milestones including automating our Sheffield distribution centre and initiating our tech re-platforming.
In Tech, we’re proud to support every function. We’re a digital-first company that is totally cloud native. We embrace change and future-proof the business, delivering critical customer-facing and internal stakeholder-facing systems. Everything from colleague tech to frontend websites and apps, buying and merchandising tooling, and all that’s in between, we take care of it. Our ideas support and drive the Group’s agenda.

YOUR ROLE

Being a Governance, Risk & Compliance Analyst within Information Security is an exciting opportunity, your key responsibilities are to improve and maintain our information security framework, as well as ensure security awareness across the group. In practice this means delivering our phishing programme, updating our security awareness training, and guiding staff in the right direction.
Additionally, you will maintain and improve the information security management system (ISMS) as we align to ISO 27001. You will be responsible for upkeeping policies and creating new ones where necessary. You will enhance compliance and promote a culture of security awareness.

RESPONSIBILITIES

• Deliver and improve our Security Awareness programme, keeping information security training relevant and up to date.
• Deliver our phishing programme, monitoring simulations, provide education and support.
• Manage the development and maintenance of policy documentation, including information security policies, procedures, and standards.
• Contribute to risk assessments and recommend mitigation strategies.
• Ensure compliance with legal, regulatory, and contractual obligations related to information security.
• Carry out actions on the back of audits and contribute to the internal audit of our offices.
• Provide guidance and training to staff on compliance, risk management, and information security best practices.
• Stay informed of the latest Information security threats, regulatory changes, and best practices in risk management.
• Facilitate communication and reporting on GRC matters to senior management and relevant stakeholders.