Security Risk and Compliance Analyst

The Security Risk and Compliance Analyst is the operational engine of AutoStore's Technology Risk and Compliance function, turning frameworks and policies into working processes, maintaining the evidence base for assurance activities, and keeping the compliance position current and visible. Reporting to the CISO, the role works across IT, Legal, Finance, HR, and Product to ensure regulatory and certification obligations are met, controls are documented and evidenced, and employees understand and act on their security responsibilities.  

The Security Risk and Compliance Analyst  works closely with the Senior Risk and Compliance Professional (SRCP) on a day-to-day basis, operating within the frameworks and programme structure the SRCP owns, and escalating material issues to the CISO. AI is a growing part of this role, both as a practical tool for working more effectively, and as a subject area that requires operational support across governance, risk assessment, and awareness. 

Control Assurance and Audit 

• Maintain control documentation, ownership records, and evidence in line with the framework owned by the SRCP, supporting the assurance and testing cycle, coordinating with control owners, and flagging gaps or discrepancies to the SRCP or CISO as appropriate. 

• Coordinate IT General Controls (ITGC) and Internal Control over Financial Reporting (ICFR) requirements, maintaining documentation of scope, testing schedules, and results, and acting as the primary operational interface for cybersecurity audit activities, tracking findings to closure. 

• Own the operational management of the risk exception and control deviation process, intake, documentation, approval tracking, expiry management, and escalation of material exceptions to the CISO. 

Third Party Assurance & Reporting 

• Execute the supplier assurance programme, issuing questionnaires, tracking responses, maintaining the supplier risk register, and escalating gaps to the CISO, ensuring outcomes feed into third-party risk reporting. 

• Maintain accurate records across all areas of responsibility, compliance register, control evidence, audit findings, exception log, and supplier outcomes, and contribute timely, structured data to the SRCP’s dashboards and reporting outputs. 

• Proactively flag changes in compliance or assurance status to the SRCP and CISO, and maintain documentation to a standard that supports internal visibility and external audit or regulatory scrutiny. 

AI Governance and Support 

• Support the SRCP in the operational delivery of AutoStore's AI governance programme, maintaining the AI tools register, coordinating risk assessments of AI tools submitted for approval, tracking assessment outcomes, and keeping records current as the AI landscape evolves. 

• Monitor the AI obligations inventory maintained by the SRCP, flagging where new tool adoptions, regulatory updates, or business changes may affect AutoStore's compliance position under the EU AI Act or related frameworks. 

• Apply AI-assisted tools across day-to-day GRC work, compliance tracking, evidence management, risk analysis, and reporting, and contribute practical experience of what works to the SRCP’s broader assessment of AI-assisted GRC capabilities. 

Security Education & Awareness 

• Lead the design and delivery of AutoStore's security and privacy awareness programme, delivering targeted campaigns (phishing simulations, data handling, access management, AI use, social engineering) in collaboration with HR and Communications, and managing the awareness training platform. 

• Develop and maintain metrics that measure genuine behavioural change, not just participation, tracking trends in phishing results, training completion, and incident patterns to continuously improve programme targeting and content. 

• Ensure AI use is a substantive topic within the awareness programme, not a single annual module but an evolving thread that reflects how AI tools are being used across the business, the risks they introduce, and the behaviours AutoStore expects.