Remote (min. 4h overlap with UK hours, no sponsorship)
Type
Full Time
Deadline
30 Oct 2026
7 days left
Job Description
Build TryHackMe's first GRC learning path and lay the groundwork for everything that comes after it, combining practitioner-level GRC expertise with a creative, teaching-oriented mind.
Research, design, and develop GRC training rooms, modules, and learning paths - including hands-on artifacts.
Act as a subject-matter expert across ISO 27001/ISMS, EU regulation (NIS2, DORA, CRA), risk management.
Build and maintain lab environments using open-source GRC tooling (e.g. Eramba) and THM-built interactive widgets.
Take charge of planning and designing portions of the GRC content roadmap, and pressure-test scoping decisions.
Track regulatory change (implementing acts, national transpositions, framework revisions) and keep shipped content current.
Guide and review the work of contractors and other content engineers contributing to GRC builds.
Collaborate with Content Engineering leadership to continuously improve the content development process.
Requirements
At least 5+ years of hands-on GRC / information security experience in roles such as GRC Analyst / GRC Manager.
Practical, implementation-level experience with ISO/IEC 27001 (2022 control set): scoping, risk assessment and treatment.
Working knowledge of the EU cyber regulatory landscape: NIS2 and its Article 20/21/23 obligations, DORA, Cyber Resilience Act.
Strong grounding in risk management practice: qualitative assessment methods, risk registers, controls and control types.
Experience with audit and evidence workflows: what auditors ask for, how evidence is collected and presented.
