The Security Risk and Compliance Analyst is the operational engine of AutoStore'sTechnology Risk and Compliancefunction,turning frameworks and policies into working processes,maintainingthe evidence base for assurance activities, and keeping the compliance position current and visible. Reporting to theCISO, the role works across IT, Legal, Finance, HR, and Product to ensure regulatory and certification obligations are met, controls are documented andevidenced, and employees understand and act on their security responsibilities.

The Security Risk and Compliance Analyst works closely with the SeniorRisk and ComplianceProfessional(SRCP)on a day-to-day basis,operatingwithin the frameworks and programme structure theSRCPowns, and escalating material issues to the CISO. AI is a growing part of this role,both as a practical tool for working more effectively, and as a subject area that requires operational support across governance, risk assessment, and awareness.

Control Assurance and Audit

• Maintain control documentation, ownership records, and evidence in line with the framework owned by theSRCP, supporting the assurance and testing cycle, coordinating with control owners, and flagging gaps or discrepanciesto theSRCPor CISO asappropriate

• Coordinate IT General Controls (ITGC) andInternal Control over Financial Reporting(ICFR)requirements,maintainingdocumentation of scope, testing schedules, and results, and acting as the primary operational interface for cybersecurity audit activities, tracking findings to closure.

• Own the operational management of the risk exception and control deviation process, intake, documentation, approval tracking, expiry management, and escalation of material exceptions totheCISO

Third Party Assurance& Reporting

• Execute the supplier assurance programme, issuing questionnaires, tracking responses,maintainingthe supplier risk register, and escalating gaps to theCISO, ensuring outcomes feed into third-party risk reporting.

• Maintainaccuraterecords across all areas of responsibility, compliance register, control evidence, audit findings, exception log, and supplier outcomes, and contributetimely, structured data to theSRCP’sdashboards and reporting outputs.

• Proactively flag changes in compliance or assurance status to theSRCPandCISO, andmaintain documentation to a standard that supports internal visibility and external audit or regulatory scrutiny

AI Governance and Support

• Support theSRCPin the operational delivery of AutoStore's AI governance programme,maintainingthe AI tools register, coordinating risk assessments of AI toolssubmittedfor approval, tracking assessment outcomes, and keeping records current as the AI landscape evolves.

• Monitor the AI obligations inventorymaintainedby theSRCP, flaggingwherenew tool adoptions, regulatory updates, or business changes may affect AutoStore's compliance position under the EU AI Act or related frameworks.

• Apply AI-assisted tools across day-to-day GRC work, compliance tracking, evidence management, risk analysis, and reporting, and contribute practical experience of what works to theSRCP’sbroader assessment of AI-assisted GRC capabilities.

Security Education & Awareness

• Lead the design and delivery of AutoStore's security and privacy awareness programme,delivering targeted campaigns (phishing simulations, data handling, access management, AI use, social engineering) in collaboration with HR and Communications, and managing the awareness training platform.

• Develop andmaintainmetrics that measure genuine behavioural change, not just participation,tracking trends in phishing results, training completion, and incident patterns to continuously improve programme targeting and content.

• Ensure AI use is a substantive topic within the awareness programme, not a single annual module but an evolving thread that reflects how AI tools are being used across the business, the risks they introduce, and the behaviours AutoStore expects.