GRC Analyst (f,x,m)

You will run the operational engine of Nelly's GRC: own the end-to-end cycles of third party risk, business continuity, control-testing and audit-evidence, so that registers and evidence are audit-ready every day of the year.

What you'll do

• Operate the compliance platform day-to-day: monitor failing controls, chase remediation owners, keep evidence green
• Run the third-party lifecycle: onboarding assessments, periodic reviews, evidence collection (SOC 2/ISO/C5 reports, DPAs), Supplier Directory and outsourcing register upkeep
• Coordinate the BCM cycle: collect BIA inputs from process owners, organize tests/exercises, maintain plans
• Maintain registers and trackers (risk register support, findings log)
• Support external audits (C5, ISO, bank partners): prepare evidence packs, manage request lists
• Administer the policy review cycle (controlled documents, review dates, approvals)

What you'll need

• 2–4 years in IT/process audit, BCM or GRC operations (Big4/audit firm, or in-house through a first ISO 27001/SOC 2/C5 certification)
• You know what evidence an auditor accepts
• Workpaper discipline with a big attention to detail
• You have run or supported vendor assessments
• Scale-up or fintech environment strongly preferred over big-bank silo experience

What they offer

• Deutschlandticket or Swapfiets membership
• Urban Sports Club membership
• Flexible working hours and hybrid setup
• Up to 4 weeks of workation
• Dog-friendly office with snacks and cold drinks