Governance Analyst

Role Purpose

The Governance & Assurance Analyst supports WPP's governance, certification, assurance, and digital risk management activities.

The role helps maintain governance documentation, support certification and audit readiness activities, coordinate evidence collection, and contribute

to client assurance requests and governance reporting.

Working closely with Strategy & Risk, Technical Security Governance, Assurance, Privacy, Legal, Enterprise Technology, and business stakeholders,

the Governance & Assurance Analyst helps ensure governance processes remain effective, documentation remains current, and evidence required

for certifications, audits, and client assurance activities is readily available.

A key focus of the role is supporting the day-to-day operation of WPP's Information Security Management System (ISMS), maintaining certification

readiness, and coordinating governance and assurance activities across the organisation.

Key Responsibilities

Governance & Policy Support

Maintain governance frameworks, policies, standards, procedures, and related documentation.

Support periodic reviews and updates of governance artefacts.

Maintain mappings between policies, standards, controls, and certification requirements.

Assist with governance forums, working groups, and documentation reviews.

Support the preparation of governance materials, meeting outputs, and action tracking.

Provide research and analysis to support governance activities and decision-making.

Digital Risk Governance Support

Support governance reporting activities related to digital risk management.

Assist with the collection and analysis of governance-related metrics and indicators.

Maintain governance dashboards, scorecards, and reporting materials.

Track governance actions and follow-up activities.

Support reviews of governance processes and documentation.

ISO 27001 & Certification Support

Support the operation of the Information Security Management System (ISMS).

Coordinate activities required to support ISO 27001 certification and surveillance audits.

Maintain certification-related records, registers, and supporting documentation.

Coordinate evidence collection and stakeholder engagement activities required for audits.

Track audit findings, corrective actions, and improvement activities through to closure.

Support management review preparation and governance reporting.

Help maintain ongoing audit and certification readiness.

Client Assurance Support

Coordinate responses to client security, governance, risk, and compliance due diligence requests.

Collaborate with relevant stakeholders to gather information required for assurance activities.

Maintain reusable assurance content, responses, and supporting evidence.

Track assurance requests and response status.

Support the continuous improvement of assurance documentation and response quality.

Evidence Management & Audit Readiness

Maintain repositories used to support governance, certification, audit, and assurance activities.

Coordinate evidence collection across relevant business functions.

Ensure evidence is current, appropriately classified, and available for authorised use.

Maintain evidence ownership information, review dates, and supporting metadata.

Identify missing, outdated, or incomplete evidence and coordinate remediation activities.

Support internal, external, certification, client, and regulatory reviews through effective evidence coordination.

Reporting & Operational Improvement

Support the development of governance dashboards, scorecards, metrics, and reporting packs.

Analyse governance and assurance data to identify trends and reporting insights.

Support the standardisation of governance documentation, evidence collection, and reporting practices.

Identify opportunities for process improvements and raise recommendations to management.

Contribute to the continuous improvement of governance operational processes and reporting effectiveness.

Skills & Experience Required

Must-Haves

Fluent English, written and verbal.

Bachelor's degree in Information Security, Risk Management, Audit, Compliance, Business Administration, or a related discipline, or

equivalent relevant experience.

2-4 years of experience in governance, information security, compliance, audit, risk management, assurance, or a related discipline.

Experience supporting an ISO 27001-based management system, audit programme, or certification activity.

Understanding of governance frameworks, controls, audit principles, and certification requirements.

Experience supporting audits, assurance reviews, or certification activities.

Experience coordinating evidence collection and documentation activities.

Strong reporting, documentation, and organisational skills.

Ability to work effectively with technical and non-technical stakeholders.

Strong communication and stakeholder coordination skills.

Ability to manage multiple priorities in a global environment.

Nice-to-Have

ISO 27001 Foundation, Lead Implementer, Lead Auditor, or similar qualification.

CISA, CISM, CRISC, CISSP, or equivalent certification.

Exposure to frameworks such as SOC 2, GDPR, NIS2, or similar.

Experience supporting client assurance or security questionnaire activities.

Experience using GRC, audit, compliance, or certification management platforms.

Experience within a large multinational organisation.

Key Behaviours & Competencies

Governance Awareness

Understands the importance of governance, accountability, and effective documentation in supporting organisational objectives.

Analytical Thinking

Uses structured analysis and evidence-based reasoning to support governance activities and reporting.

Quality Focus

Maintains attention to detail and supports high-quality governance and assurance outcomes.

Stakeholder Collaboration

Works effectively with stakeholders across business and technical teams.

Communication

Communicates clearly and professionally with a range of audiences.

Organisation & Planning

Demonstrates a structured approach to documentation, coordination, reporting, and action tracking.

Continuous Learning

Seeks opportunities to improve processes, skills, and ways of working.

Professional Integrity

Acts with objectivity, accountability, professionalism, and discretion.

What This Role Explicitly Does Not Do

This role does not:

Own governance frameworks, policies, or standards.

Own cyber security strategy.

Own enterprise risk management processes or risk registers.

Own Digital Risk Governance frameworks.

Make risk acceptance or risk treatment decisions.

Own technical security controls, security architecture, engineering, or operational security functions.

Perform incident response, vulnerability management, monitoring, or security operations activities.

Act as Internal Audit or provide independent assurance.

Own regulatory compliance programmes.

Serve as the accountable owner for ISO 27001 or certification outcomes.

Own the ISMS.

Design governance operating models or policy architectures.

Approve policies, standards, exceptions, or governance decisions unless formally authorised.

Replace the accountability of risk owners, control owners, policy owners, or business stakeholders.

Who you are:

You're open: We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.

You're optimistic: We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.

You're extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.

What we'll give you:

Passionate, inspired people – We aim to create a culture in which people can do extraordinary work.

Scale and opportunity – We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.

Challenging and stimulating work – Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?