Governance, Risk & Compliance Analyst

Overview

In this role, you strengthen Foundry’s governance, risk, and compliance posture and help govern AI usage safely. You report to the Senior Director of Corporate Technology and AI, and you’ll support GRC frameworks, conduct risk assessments, and shape the security and governance strategy. You’ll work with cross‑functional teams and use AI tools to work smarter, spending part of each week in our London office. This is a chance to influence risk controls at a scale that supports creative production across the industry.

Pay / Benefits

• 25 days’ holiday plus bank holidays
• Pension scheme
• Private Medical Insurance
• Health Cash Plan
• Life Assurance
• Group Income Protection

Responsibilities

• Develop, implement, and enforce GRC frameworks, policies, and controls
• Conduct regular risk assessments and maintain the risk register
• Coordinate internal and external audits and track remediation
• Support control testing and report on risk KPIs to senior management
• Contribute to the cyber program by managing controls, threats, and vulnerabilities
• Develop and maintain Foundry’s AI governance framework (acceptable use, tools list, data guidance)
• Run intake and risk assessment for new AI tools and use cases (vendor due diligence, data handling, IP/output risks)
• Track AI regulation and translate into practical controls
• Use AI tools in your own work with proper human review and share learnings with the team
• Collaborate with Legal, Finance, IT, Engineering and Product to embed risk awareness across teams
• Support privacy, data governance, business continuity and incident response activities

Key requirements

• Experience in a GRC, IT audit, risk, or similar compliance-focused role (early-career considered)
• Knowledge of GRC frameworks and GDPR / ISO 27001 familiarity
• Pragmatic, risk-based mindset balancing risk and velocity
• Genuine interest in AI and understanding of AI risks and limitations
• Excellent analytical, problem-solving, and organizational skills with attention to detail
• Strong communication skills and ability to explain regulatory topics to non-specialists
• Inquisitive, proactive, able to work autonomously on defined projects
• Genuine interest in technology, cybersecurity, and the media/entertainment industry

• Strong communication
• Collaborative mindset
• Proactive and autonomous work style
• GDPR familiarity
• ISO 27001 awareness
• Mitre ATT&CK (nice-to-have)

…