Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 hours ago

GRC Associate

Trainline32 open roles

Pay
£55,000 – £65,000 a year
Where
London
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowGRC AssociateTrainline · London

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Trainline's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. Trainline postings stay open a median of 29 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 8 hours ago

Trainline median: 29 days open

The posting

About us

At Trainline, our purpose is to empower greener travel choices, connecting people and places. https://www.thetrainline.com/terms/sustainability-faqs Trainline enables millions of travellers to find and book the best value tickets across carriers, fares, and journey options through our highly rated mobile app, website, and B2B partner channels.

Great journeys start with Trainline 🚄

We’re Europe’s leading independent rail platform, helping millions of travellers find and book the best-value rail and coach journeys across our app, website and partner channels.

Our job is to make the green travel choice the best choice. By building a better train travel experience, we help more people choose rail - creating a positive impact for customers, our business and the planet.

We’re a team of more than 1,000 Trainliners from over 50 nationalities, working across London, Paris, Barcelona, Milan, Edinburgh and Madrid. Now is a brilliant time to join us and help shape the future of travel.

Introducing the GRC team 👋

Trainline is investing in the next stage of our security programme, and we’re looking for a Security GRC Associate to help strengthen how we manage third-party security risk and assurance.

You’ll join our Information Security team, reporting to the GRC Manager. Your main job will be making sure the suppliers, technology partners and service providers we rely on meet the security standard our customers expect. You’ll work with Procurement, Legal, Privacy, Engineering, Product and teams across the business to manage supplier risk end to end, from onboarding and first assessment through to ongoing assurance and reassessment.

You’ll also support our wider governance and compliance programme, including ISO 27001 and our unified internal control framework. And you’ll help us rethink how GRC gets done, using automation and AI to cut manual effort and give the business a clearer view of risk.

As a Security GRC Associate at Trainline, you will... 🚄

- Run third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers, technology partners and business-critical vendors

- Review supplier assurance evidence, such as ISO 27001 certificates, SOC 2 reports, security questionnaires and penetration test summaries, and judge whether the controls in place are adequate

- Identify and document third-party security risks and recommend proportionate ways to reduce them

- Help assess the security risks of AI tools, applications and third-party AI integrations, working with the wider GRC and InfoSec teams to review controls and track remediation

- Partner with Procurement, Legal, Privacy and Engineering to build security requirements into supplier onboarding, procurement and contract renewals

- Keep third-party risk records up to date, track remediation actions, and escalate material risks to the right stakeholders and governance forums

- Help shape a risk-based approach to ongoing supplier assurance, including periodic reassessments and monitoring of critical suppliers

- Help improve our Third-Party Risk Management framework, including supplier risk classification, assessment methods, questionnaires and reporting

- Support ISO 27001 assurance work, such as control assessments, evidence gathering, audit preparation and remediation tracking, and help maintain our unified internal control framework

- Help build and improve our GRC tooling, using automation and AI to speed up questionnaire reviews, evidence analysis, control mapping and risk reporting

We’d love to hear from you if you have... 🔍

- Experience in information security, GRC, third-party risk management or a related cyber security discipline

- Hands-on experience running third-party security assessments, reviewing supplier assurance documentation or supporting vendor risk processes

- Working knowledge of security standards and frameworks, particularly ISO 27001, ISO 27002 and NIST CSF

- Experience working with stakeholders across functions, such as Procurement, Legal, Technology and business teams

- Strong analytical and problem-solving skills, a sharp eye for detail, and the ability to manage several assessments and competing priorities at once

- Clear written and verbal communication, with the confidence to explain security requirements to technical and non-technical audiences

- A proactive, curious mindset and a real interest in improving how security governance and risk management are delivered

Bonus points if you have... ⭐️

- Experience with GRC or third-party risk platforms such as ServiceNow GRC, Archer, LogicGate, Vanta or Compyl

- Experience supporting ISO 27001 audits, ISMS maintenance or control assurance

- Familiarity with SOC 2, ISO 22301, PCI DSS or Cyber Essentials

- Experience assessing cloud services, SaaS or AI-enabled tools, or familiarity with AI governance frameworks such as ISO/IEC 42001 and the NIST AI RMF

- Experience automating GRC processes using workflow tools, scripting, low-code platforms or APIs

- Confident, everyday use of AI tools and LLMs to speed up research and evidence analysis

- A relevant certification such as ISO 27001 Foundation or equivalent

More information:

Enjoy fantastic perks like private healthcare & dental insurance, a generous work from abroad policy, 2-for-1 share purchase plans, an EV Scheme to further reduce carbon emissions, extra festive time off, and excellent family-friendly benefits.

We prioritise career growth with clear career paths, transparent pay bands, personal learning budgets, and regular learning days. Jump on board and supercharge your career from day one!

We're operating a hybrid model and ask that Trainliners work from the office a minimum of 60% of their time over a 12-week period. We also have a 28-day Work from Abroad policy.

Our values represent the things that matter most to us and what we live and breathe everyday, in everything we do:

- 💭 Think Big - We're building the future of rail

- ✔️ Own It - We focus on every customer, partner and journey

- 🤝 Travel Together - We're one team

- ♻️ Do Good - We make a positive impact

We know that having a diverse team makes us better and helps us succeed. And we mean all forms of diversity - gender, ethnicity, sexuality, disability, nationality and diversity of thought. That's why we're committed to creating inclusive places to work, where everyone belongs and differences are valued and celebrated.

Interested in finding out more about what it's like to work at Trainline? Why not check us out on LinkedIn https://www.linkedin.com/company/trainline/, Instagram https://www.instagram.com/lifeattrainline/ and Glassdoor https://www.glassdoor.co.uk/Overview/Working-at-Trainline-EI_IE249203.11,20.htm!

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Trainline's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Trainline's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Trainline's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.