Governance, Risk & Compliance Analyst

Foundry has a 30-year heritage in developing creative software for the Media and Entertainment industry, and a portfolio of award-winning products. It advances the art and technology of visual experience with creative leaders around the globe, including major feature film studios and post-production houses such as ILM, DNEG, Walt Disney Animation Studios, Wētā FX, Pixar, Marvel, Netflix, Framestore and Skydance Animation.

In partnership with these companies, Foundry solves complex visualization challenges to turn incredible ideas into reality. Its products are used to create breathtaking visual effects and animation on a wide range of feature films, episodic content, and commercials.

Foundry software was integral in the making of every VFX Academy Award-winning film since 2007. The company has been recognised and honoured at the highest level in the industry, including four Academy Sci-Tech Awards for Mari, Katana, Nuke and Furnace, two HPA Engineering Excellence awards for Flix and Nuke respectively, and an Engineering Emmy for Nuke.

This is an opportunity for a bright, driven and ambitious individual to play a major role in strengthening Foundry’s governance, risk, and compliance posture, including how we adopt and govern AI safely. Reporting to the Senior Director of Corporate Technology and AI, you will support our GRC frameworks and policies, conduct risk assessments, and contribute to our security and governance strategy.

You’ll also help put practical guardrails around AI use, and use AI tools yourself to work smarter. You’ll spend a minimum of two days each week in our London office, in Soho. EssentialExperience in a GRC, IT audit, risk, or similar compliance-focused role (early-career experience considered)Working knowledge of GRC frameworks and methodologies, and familiarity with GDPR and ISO 27001A pragmatic, risk-based mindset, with the judgement to balance risk and velocityGenuine interest in AI, having used AI tools (e.g., LLM assistants) in your own work and an understanding of their risks and limitationsExcellent analytical, problem-solving, and organisational skills with high attention to detailStrong communication skills, including the ability to explain technical and regulatory topics to non-specialists and build relationships across the businessInquisitive and proactive, able to work autonomously on defined projectsA genuine interest in technology, cybersecurity, and the industry we serveNice-to-haveExperience using Cyber and AI governance frameworks (Mitre Att&ck, NIST AI RMF, EU AI Act)Experience with GRC platforms or vendor risk and customer questionnaire processesRelevant certifications or progress towards them (e.g., CISA, CRISC, ISO 27001 Lead Auditor/Implementer, IAPP AIGP)Governance, Risk & ComplianceSupport the development, implementation, and enforcement of GRC frameworks, policies, and controlsConduct regular risk assessments and maintain the company’s risk registerHelp ensure compliance with relevant legal, regulatory, and industry standards Assist in coordinating internal and external audits, including evidence gathering and remediation trackingSupport control testing and report on key risk and performance indicators to senior managementContribute to the Foundry cyber program, helping manage controls, threats and vulnerabilitiesAI GovernanceSupport the development and maintenance of Foundry’s AI governance framework, including the acceptable use policy, approved-tools list, and data guidanceRun the intake and risk-assessment process for new AI tools and use cases (vendor due diligence, data handling, IP and output risks), and maintain the AI use-case inventoryHelp assess AI-specific risks such as data leakage, over-reliance, shadow AI, and IP exposure, with awareness of our studio customers’ confidentiality expectationsTrack emerging AI regulation and standards (e.g., EU AI Act, ISO/IEC 42001, NIST AI RMF) and help translate them into practical controlsUse AI tools in your own work (e.g., drafting policies, mapping controls), with appropriate human review, and share what works with the teamThird-party Assurance & CollaborationSupport vendor risk assessments and help complete customer security questionnaires, maintaining a library of approved responses and evidenceCollaborate with Legal, Finance, IT, Engineering and Product to embed risk awareness, offering practical advice that helps teams move forward safelyContribute to privacy, data governance, business continuity and incident response activity25 days’ holiday plus bank holidays Pension scheme Private Medical Insurance Health Cash Plan Life Assurance Group Income Protection Season Ticket Travel Loan and Cycle to Work Regular social events and competitions Annual Personal Development Time Annual Passion Days

Report this job