Information Security Governance and Compliance Analyst

We are therefore pleased to be recruiting for a new Information Security Governance, Risk & Assurance Analyst and are looking for someone with experience in the delivery of risk controls, governance processes, supplier assurances and compliance programmes. We also require a detailed knowledge of current and future legislation within the information security sector for UK rail. The Analyst will provide essential support and input into the InfoSec supplier assurance process, managing the initial review to highlight risk or areas for further investigation. They will also support the risk management framework by reviewing the InfoSec risk register and facilitating the delivery of risk treatment plans within the agreed timescales. This would also extend to activities required to manage the ISO27001 Corrective Actions Log and collation and verification of the Continuous Improvement element of the ISO27001 Standard. This role involves collaboration with all areas of the business to ensure any Information Security requirements in current and future projects is correctly identified and tasks assigned. The role provides cover to facilitate delivery of ECDP Programme by supporting the Information Security team across various projects, both current and upcoming. You’ll also be involved in:

• Supporting the LNER Information Security Assurance processes, gaining thorough knowledge of the current processes.
• Guiding critical and key suppliers through the process providing concise, accurate reporting to the Information Security Governance, Risk & Assurance Manager for sign off and to the Information Security Manager as required.
• Managing the treatment tasks/plans identified as requiring remediation through the Information Security Risk Register.
• Working with identified risk owners across the business ensuring the ISO27001 Corrective Actions Log is correct and accurately reflects remediations and agreed delivery.
• Supporting the Information Security Manager and Governance, Risk & Assurance Manager conducting security assessments through vulnerability testing and risk analysis as required.
• Coordinating and supporting surveillance audits in support of maintaining LNER’s ISO27001 compliant status.
• Coordinating Information Security Policy review in line with an agreed timetable from the Information Security Compliance Manager.
• Acting as a point of contact for Design Authority papers. Undertaking first review of Technical Impact Assessment papers submitted to Design Authority requiring Information Security review. Supporting business owners completing TIA’s and High Level Concept papers completing the relevant sections.
• Developing and carrying out information security plans, policies and procedures.
• Coordinating reporting across the tools used for managing assurance and compliance ensuring reporting is accurate, timely and supports decision making.
• Monitoring use of security products data encryption and other security products and procedures.
• Responding to the business day-to-day information security requests and investigating routine security related incidents such as: malware detections, DLP violations, phishing emails, password compromises, general security information support.

• Current experience in an information security role, ideally within risk, governance or assurance.
• Working knowledge of common security controls (e.g. firewalls, endpoint protection, logging and monitoring, access management) and the ability to understand and assess their effectiveness.
• An understanding of core security principles and control domains (access control, encryption, vulnerability and patch management, incident response, business continuity).
• Ability to demonstrate and articulate knowledge of compliance with the ISO27001, PCI DSS, GDPR, NIS Directive, and other security Standards.
• Experience using GRC platforms to manage risk registers, controls and assurance activities.
• Experience identifying, assessing, documenting and tracking information security risks, including agreeing treatment plans and following up on remediation.
• Experience reviewing supplier security questionnaires and evidence (e.g. SOC 2 reports, ISO certificates, penetration test summaries) and making risk-based judgements on their adequacy.
• Recognised industry security certification such as CISMP, CompTIA Security+ or equivalent is desirable.
• Experience in providing written and verbal presentations across all levels of a company.
• Demonstrate their knowledge and understanding of basic financial/technical information.
• You’ll be an effective team player, experienced at dealing at all levels with effective influencing and negotiating skills.
• Ability to form constructive and proactive working relationships at all levels with all stakeholders whether internal or external.
• Hands on experience of problem-solving and ability to stay calm under pressure.
• ITIL Foundation certification desirable.

You’ll enjoy

• Free travel on LNER, plus 75% off other companies’ tickets (for you and your dependents).
• Discounted international train tickets (after one year’s service).
• 50% discount on LNER tickets for friends and family.
• Generous pension scheme.
• Annual cycle to work schemes/electric vehicle scheme.
• Discount, savings and cashback scheme from top retailers.
• Health and wellbeing schemes and discounts.
• A host of training opportunities to help further your career.
• Rewards and awards to recognise when you shine.

• 4 hours ago

Great journeys start with great people Here at LNER, we’re shaping the future of rail on one of the UK’s most iconic routes. From our high-speed Azuma fleet, redefining long-distance travel, to our next generation of trains, Serenza, this is a moment of real transformation for LNER. We’re investing in cutting-edge technology, sustainability, and most importantly our people, to deliver outstanding experiences for our customers. There has never been a more exciting time to grow your career with LNER! So, what exactly does our Information Security Governance and Compliance Analyst do? LNER is adapting to ensure timely, accurate and focused support to protect against the growing cyber threat the company is facing. Over the next 12 months, the InfoSec team will be involved in several flag ship projects including those specifically coming through the East Cost Digital Programme and the introduction of the new CAF fleet. This is a truly exciting time for InfoSec at LNER., We’re on a mission to become the UK’s most loved, forward-thinking, and responsible train operating company in the UK. This means making a real difference by doing the right thing for our customers, our people, and the communities and destinations we serve. Together, we’re shaping the future of rail travel through our passion, our innovation, and our extraordinary people. Our people are at the heart of everything we do. We’re committed to creating an inclusive and engaged culture that supports everyone at every stage of their journey. This means that when you’re with LNER, you can truly be yourself-and it’s why so many of our colleagues choose to stay and grow with us.

• Diversity and inclusion - We are passionate about building a diverse and inclusive workforce that reflects the communities we serve. We actively create opportunities to inspire and attract diverse talent to join LNER. We are committed to supporting all candidates, so if you require any adjustments or assistance at any stage of the recruitment process, please let us know.
• Developing our people - We’re creating a learning culture that enables our people to be the best they can be. We support development and career journeys with the right tools and resources, aligned to our people priorities: readiness for Great British Rail, the future world of work and strong, people focused leadership that delivers for our people, customers, and business.
• Health and wellbeing - To create a culture where our people can perform at their best, the physical health and mental wellbeing of our people is of paramount importance to us.

Disclosure and Barring Service (DBS) check At LNER, safety is our top priority. If your application is successful and you’re new to the business, we’ll carry out a basic DBS check as part of our pre-employment process. This is only takes place once a conditional job offer has been made. The DBS check looks for any unspent convictions and conditional cautions under the Rehabilitation of Offenders Act (ROA) 1974. If there’s evidence of an unspent conviction or a conditional caution, the details of these will be reviewed internally by a cross functional panel on a case-by-case basis before a final offer of employment is confirmed. Please note that in some cases, this may result in an offer being withdrawn. Further information on how we collect and use this data is available on our privacy notice. Medical screening We’re a safety conscious business, so when joining LNER in any role you’ll need to pass a medical screening and a drugs and alcohol test before we can confirm an unconditional job offer. For safety-critical roles, a safety-critical medical will also be required. Our Talent Team will be on hand to guide you through the process and will send you a medical questionnaire by email. Once complete, this will go directly to our in-house Health and Wellbeing team who will contact you to arrange a convenient location, date and time for your medical appointment. We currently have clinics in Kings Cross, Doncaster, Newcastle and Edinburgh. The sooner we can do it, the better, so please try to be flexible with your availability. Once your medical is approved, we’ll finalise any last details and look forward to you joining the team!, We have fantastic opportunities for people from all different backgrounds, so now is the time to join the team at LNER.