Governance, Risk & Compliance Analyst

Foundry has a 30-year heritage in developing creative software for the Media and Entertainment industry, and a portfolio of award-winning products. It advances the art and technology of visual experience with creative leaders around the globe, including major feature film studios and post-production houses such as ILM, DNEG, Walt Disney Animation Studios, Wētā FX, Pixar, Marvel, Netflix, Framestore and Skydance Animation.

In partnership with these companies, Foundry solves complex visualization challenges to turn incredible ideas into reality. Its products are used to create breathtaking visual effects and animation on a wide range of feature films, episodic content, and commercials.

Foundry software was integral in the making of every VFX Academy Award-winning film since 2007. The company has been recognised and honoured at the highest level in the industry, including four Academy Sci-Tech Awards for Mari, Katana, Nuke and Furnace, two HPA Engineering Excellence awards for Flix and Nuke respectively, and an Engineering Emmy for Nuke.

This is an opportunity for a bright, driven and ambitious individual to play a major role in strengthening Foundry’s governance, risk, and compliance posture, including how we adopt and govern AI safely. Reporting to the Senior Director of Corporate Technology and AI, you will support our GRC frameworks and policies, conduct risk assessments, and contribute to our security and governance strategy. You’ll also help put practical guardrails around AI use, and use AI tools yourself to work smarter. You’ll spend a minimum of two days each week in our London office, in Soho.

Essential

• Experience in a GRC, IT audit, risk, or similar compliance-focused role (early-career experience considered)
• Working knowledge of GRC frameworks and methodologies, and familiarity with GDPR and ISO 27001
• A pragmatic, risk-based mindset, with the judgement to balance risk and velocity
• Genuine interest in AI, having used AI tools (e.g., LLM assistants) in your own work and an understanding of their risks and limitations
• Excellent analytical, problem-solving, and organisational skills with high attention to detail
• Strong communication skills, including the ability to explain technical and regulatory topics to non-specialists and build relationships across the business
• Inquisitive and proactive, able to work autonomously on defined projects
• A genuine interest in technology, cybersecurity, and the industry we serve

Nice-to-have

• Experience using Cyber and AI governance frameworks (Mitre Att&ck, NIST AI RMF, EU AI Act)
• Experience with GRC platforms or vendor risk and customer questionnaire processes
• Relevant certifications or progress towards them (e.g., CISA, CRISC, ISO 27001 Lead Auditor/Implementer, IAPP AIGP)

Governance, Risk & Compliance

• Support the development, implementation, and enforcement of GRC frameworks, policies, and controls
• Conduct regular risk assessments and maintain the company’s risk register
• Help ensure compliance with relevant legal, regulatory, and industry standards
• Assist in coordinating internal and external audits, including evidence gathering and remediation tracking
• Support control testing and report on key risk and performance indicators to senior management
• Contribute to the Foundry cyber program, helping manage controls, threats and vulnerabilities

AI Governance

• Support the development and maintenance of Foundry’s AI governance framework, including the acceptable use policy, approved-tools list, and data guidance
• Run the intake and risk-assessment process for new AI tools and use cases (vendor due diligence, data handling, IP and output risks), and maintain the AI use-case inventory
• Help assess AI-specific risks such as data leakage, over-reliance, shadow AI, and IP exposure, with awareness of our studio customers’ confidentiality expectations
• Track emerging AI regulation and standards (e.g., EU AI Act, ISO/IEC 42001, NIST AI RMF) and help translate them into practical controls
• Use AI tools in your own work (e.g., drafting policies, mapping controls), with appropriate human review, and share what works with the team

Third-party Assurance & Collaboration

• Support vendor risk assessments and help complete customer security questionnaires, maintaining a library of approved responses and evidence
• Collaborate with Legal, Finance, IT, Engineering and Product to embed risk awareness, offering practical advice that helps teams move forward safely
• Contribute to privacy, data governance, business continuity and incident response activity