Information Security Analyst

This is a fantastic opportunity for someone with a security background-or an infrastructure or IT professional looking to move further into cyber security-to gain exposure across governance, security architecture, vulnerability management, supplier assurance and security operations.

What you’ll be doing

You’ll work closely with the Information Security Manager and technical teams across the business to strengthen the organisation’s security posture, ensuring security is embedded into projects, systems and day-to-day operations.

Your responsibilities will include:

• Providing security guidance on new projects and system changes, ensuring security best practice is considered from the outset.
• Working alongside Infrastructure and Operations teams to help design and implement secure-by-design solutions.
• Supporting vulnerability management, penetration testing activities and remediation programmes.
• Managing and optimising security tools to maximise their effectiveness across the business.
• Conducting security risk assessments, audits and compliance activities.
• Supporting ISO 27001 accreditation and continual improvement initiatives.
• Assessing third-party suppliers from a security perspective and helping manage ongoing supplier assurance.
• Producing security metrics, reporting and risk updates for stakeholders.
• Working with technical and business teams to ensure changes are delivered securely without impacting customer outcomes.

We’re interested in people who enjoy solving problems, are naturally curious and want to continue developing their career in cyber security.

You’ll ideally have experience in some of the following:

• Information Security, Cyber Security or IT Security.
• Security risk assessments, vulnerability management or security operations.
• ISO 27001 or other security governance frameworks.
• Working with security technologies and helping improve security controls.
• Supporting infrastructure, cloud or enterprise technology environments.
• Collaborating with both technical and non-technical stakeholders.

Professional certifications such as ISC2, CompTIA Security+, ISACA, GIAC or similar are welcomed but aren’t essential-we’re more interested in your attitude, technical ability and willingness to learn.