{"id":4176193,"url":"https://alion.io/job/trainline-grc-associate","title":"GRC Associate","company":{"id":4051,"name":"Trainline","domain":"thetrainline.com","url":"https://alion.io/company/trainline","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":55000,"max":65000,"currency":"GBP","period":"year","gross":null,"usd_annual":86345},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false},{"name":"NIST AI RMF","optional":true},{"name":"PCI DSS","optional":true},{"name":"ServiceNow","optional":true}],"status":"live","first_seen_at":"2026-11-12T15:20:36Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T16:07:24Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About us\nAt Trainline, our purpose is to empower greener travel choices, connecting people and places. Trainline enables millions of travellers to find and book the best value tickets across carriers, fares, and journey options through our highly rated mobile app, website, and B2B partner channels.\nGreat journeys start with Trainline\nWe’re Europe’s leading independent rail platform, helping millions of travellers find and book the best-value rail and coach journeys across our app, website and partner channels.\nOur job is to make the green travel choice the best choice. By building a better train travel experience, we help more people choose rail - creating a positive impact for customers, our business and the planet.\nWe’re a team of more than 1,000 Trainliners from over 50 nationalities, working across London, Paris, Barcelona, Milan, Edinburgh and Madrid. Now is a brilliant time to join us and help shape the future of travel.\nIntroducing the GRC team\nTrainline is investing in the next stage of our security programme, and we’re looking for a Security GRC Associate to help strengthen how we manage third-party security risk and assurance.\nYou’ll join our Information Security team, reporting to the GRC Manager. Your main job will be making sure the suppliers, technology partners and service providers we rely on meet the security standard our customers expect. You’ll work with Procurement, Legal, Privacy, Engineering, Product and teams across the business to manage supplier risk end to end, from onboarding and first assessment through to ongoing assurance and reassessment.\nYou’ll also support our wider governance and compliance programme, including ISO 27001 and our unified internal control framework. And you’ll help us rethink how GRC gets done, using automation and AI to cut manual effort and give the business a clearer view of risk.\nAs a Security GRC Associate at Trainline, you will...\nRun third-party security risk assessments for new and existing suppliers, including SaaS and cloud providers, technology partners and business-critical vendors\n\nReview supplier assurance evidence, such as ISO 27001 certificates, SOC 2 reports, security questionnaires and penetration test summaries, and judge whether the controls in place are adequate\n\nIdentify and document third-party security risks and recommend proportionate ways to reduce them\n\nHelp assess the security risks of AI tools, applications and third-party AI integrations, working with the wider GRC and InfoSec teams to review controls and track remediation\n\nPartner with Procurement, Legal, Privacy and Engineering to build security requirements into supplier onboarding, procurement and contract renewals\n\nKeep third-party risk records up to date, track remediation actions, and escalate material risks to the right stakeholders and governance forums\n\nHelp shape a risk-based approach to ongoing supplier assurance, including periodic reassessments and monitoring of critical suppliers\n\nHelp improve our Third-Party Risk Management framework, including supplier risk classification, assessment methods, questionnaires and reporting\n\nSupport ISO 27001 assurance work, such as control assessments, evidence gathering, audit preparation and remediation tracking, and help maintain our unified internal control framework\n\nHelp build and improve our GRC tooling, using automation and AI to speed up questionnaire reviews, evidence analysis, control mapping and risk reporting\n\nWe’d love to hear from you if you have...\nExperience in information security, GRC, third-party risk management or a related cyber security discipline\n\nHands-on experience running third-party security assessments, reviewing supplier assurance documentation or supporting vendor risk processes\n\nWorking knowledge of security standards and frameworks, particularly ISO 27001, ISO 27002 and NIST CSF\n\nExperience working with stakeholders across functions, such as Procurement, Legal, Technology and business teams\n\nStrong analytical and problem-solving skills, a sharp eye for detail, and the ability to manage several assessments and competing priorities at once\n\nClear written and verbal communication, with the confidence to explain security requirements to technical and non-technical audiences\n\nA proactive, curious mindset and a real interest in improving how security governance and risk management are delivered\n\nBonus points if you have... ⭐\nExperience with GRC or third-party risk platforms such as ServiceNow GRC, Archer, LogicGate, Vanta or Compyl\n\nExperience supporting ISO 27001 audits, ISMS maintenance or control assurance\n\nFamiliarity with SOC 2, ISO 22301, PCI DSS or Cyber Essentials\n\nExperience assessing cloud services, SaaS or AI-enabled tools, or familiarity with AI governance frameworks such as ISO/IEC 42001 and the NIST AI RMF\n\nExperience automating GRC processes using workflow tools, scripting, low-code platforms or APIs\n\nConfident, everyday use of AI tools and LLMs to speed up research and evidence analysis\n\nA relevant certification such as ISO 27001 Foundation or equivalent\n\nMore information:\nEnjoy fantastic perks like private healthcare & dental insurance, a generous work from abroad policy, 2-for-1 share purchase plans, an EV Scheme to further reduce carbon emissions, extra festive time off, and excellent family-friendly benefits.\nWe prioritise career growth with clear career paths, transparent pay bands, personal learning budgets, and regular learning days. Jump on board and supercharge your career from day one!\nWe're operating a hybrid model and ask that Trainliners work from the office a minimum of 60% of their time over a 12-week period. We also have a 28-day Work from Abroad policy.\nOur values represent the things that matter most to us and what we live and breathe everyday, in everything we do:\nThink Big - We're building the future of rail\n\nOwn It - We focus on every customer, partner and journey\n\nTravel Together - We're one team\n\nDo Good - We make a positive impact\n\nWe know that having a diverse team makes us better and helps us succeed. And we mean all forms of diversity - gender, ethnicity, sexuality, disability, nationality and diversity of thought. That's why we're committed to creating inclusive places to work, where everyone belongs and differences are valued and celebrated.\nInterested in finding out more about what it's like to work at Trainline? Why not check us out on LinkedIn, Instagram and Glassdoor!","description_format":"text","description_chars":6439,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Dental insurance"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Ticketing","Travel Technology"],"lifecycle":[{"event":"open","at":"2026-11-12T16:07:24Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"Licensed UK visa sponsor (Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker","cap_exempt":false,"checked_at":"2026-11-12T09:37:45+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":41,"reasons":["conf:4","win:early"],"computed_at":"2026-11-12T20:55:06Z"},"pay":{"stated_usd_annual":86345,"is_top_pay":false},"html_url":"https://alion.io/job/trainline-grc-associate","json_url":"https://alion.io/job/trainline-grc-associate.json","meta":{"generated_at":"2026-11-12T20:55:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":44206,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4051},"rest":"https://alion.io/mcp/rest/get_company?id=4051"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftrainline-grc-associate"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftrainline-grc-associate"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftrainline-grc-associate"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/trainline-grc-associate\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftrainline-grc-associate"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4176193}},{"tool":"search_jobs","arguments":{"company":"thetrainline.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4176193},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}