Security GRC & AI Analyst

Department: Information Technology

Employment Type: Permanent

Location: Cheltenham, England, Cheltenham, Hybrid

Key Responsibilities

• Governance, Risk and Compliance (GRC)
• ISO 27001 certification and continuous improvement
• Operational Resilience (OpRes) and DORA compliance
• Microsoft Defender and Purview administration
• AI governance, risk management and responsible AI adoption

Governance, Risk & Compliance

• Support the maintenance and continuous improvement of information security policies, procedures and standards
• Assist with ISO 27001 certification activities, including control reviews, evidence collection and audit preparation
• Support DORA compliance activities, ICT risk management and remediation tracking
• Contribute to Lloyd's Operational Resilience (OpRes) requirements, including scenario testing and self-assessments
• Monitor compliance against recognised frameworks including ISO 27001, NIST CSF and Lloyd's requirements
• Identify, assess and track security and AI-related risks through to resolution
• Produce KRI/KPI reporting for governance forums and stakeholders
• Support third-party and supplier security assessments

AI Governance & Responsible AI

• Support governance and oversight of AI tools used across Marco and PoloWorks, including Microsoft Copilot, Anthropic Claude and other AI-enabled platforms
• Maintain AI acceptable use standards, approval processes and usage records
• Conduct AI risk assessments for new use cases and integrations
• Monitor AI deployments for compliance with data protection, confidentiality and regulatory requirements
• Keep up to date with evolving AI governance frameworks and regulatory developments
• Support the creation of AI training, guidance and awareness materials

Security Operations

• Administer and maintain Microsoft Defender security controls and alerting
• Configure and support Microsoft Purview capabilities including DLP, sensitivity labels and insider risk controls
• Investigate security alerts and support incident response activities
• Participate in incident reviews, testing exercises and security improvement initiatives
• Provide practical security advice and guidance across the business

Security Awareness

• Help deliver the Group's security awareness and phishing simulation programme
• Create engaging training content on security and responsible AI use
• Monitor and report on training participation and awareness metrics

Skills, Knowledge and Expertise

Essential Experience

• Experience in Information Security, ideally within a GRC, compliance or risk-focused role
• Practical knowledge of Microsoft Defender and Microsoft Purview
• Experience of security risk assessments, governance frameworks and security controls
• Understanding of ISO 27001 and security audit requirements
• Familiarity with AI governance, AI risk assessment or responsible AI adoption
• Knowledge of data protection and privacy requirements
• Strong analytical and problem-solving skills
• Excellent communication and stakeholder management skills
• A genuine interest in emerging technologies and AI

Desirable Experience

• Experience within the Lloyd's, London Market or wider insurance sector
• Knowledge of Lloyd's Minimum Standards, Principle 12 and Operational Resilience requirements
• Experience supporting DORA compliance programmes
• Knowledge of information classification and cryptography

• CISMP
• ISC2 CC
• ISO 27001 Lead Auditor or Lead Implementer
• CISM
• CISSP
• CRISC
• SANS certifications or equivalent

• SC-200
• SC-300
• SC-400