> Markdown version of [/jobs/ext/3602271-information-security-governance-and-compliance-analyst](https://www.wearedevelopers.com/jobs/ext/3602271-information-security-governance-and-compliance-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Governance and Compliance Analyst - **Company:** Lner. - **Location:** York, UK - **Contract:** Permanent contract - **Skills:** Software System Penetration Testing, CompTIA Security+, Cyber Security, Identity and Access Management, PCI Data Security Standards, Anti-Phishing, Data Logging, Patch Management, RSA Archer Platform - **Published:** October 7, 2026 - **Apply:** https://www.careerjet.co.uk/job/gb4d9cff95c809c0c4c6d162d6390fef73/eaa ## About the Role * Current experience in an information security role, ideally within risk, governance or assurance. * Working knowledge of common security controls (e.g. firewalls, endpoint protection, logging and monitoring, access management) and the ability to understand and assess their effectiveness. * An understanding of core security principles and control domains (access control, encryption, vulnerability and patch management, incident response, business continuity). * Ability to demonstrate and articulate knowledge of compliance with the ISO27001, PCI DSS, GDPR, NIS Directive, and other security Standards. * Experience using GRC platforms to manage risk registers, controls and assurance activities. * Experience identifying, assessing, documenting and tracking information security risks, including agreeing treatment plans and following up on remediation. * Experience reviewing supplier security questionnaires and evidence (e.g. SOC 2 reports, ISO certificates, penetration test summaries) and making risk-based judgements on their adequacy. * Recognised industry security certification such as CISMP, CompTIA Security+ or equivalent is desirable. * Experience in providing written and verbal presentations across all levels of a company. * Demonstrate their knowledge and understanding of basic financial/technical information. * You'll be an effective team player, experienced at dealing at all levels with effective influencing and negotiating skills. * Ability to form constructive and proactive working relationships at all levels with all stakeholders whether internal or external. * Hands on experience of problem-solving and ability to stay calm under pressure. * ITIL Foundation certification desirable. ## Description We are therefore pleased to be recruiting for a new Information Security Governance, Risk & Assurance Analyst and are looking for someone with experience in the delivery of risk controls, governance processes, supplier assurances and compliance programmes. We also require a detailed knowledge of current and future legislation within the information security sector for UK rail. The Analyst will provide essential support and input into the InfoSec supplier assurance process, managing the initial review to highlight risk or areas for further investigation. They will also support the risk management framework by reviewing the InfoSec risk register and facilitating the delivery of risk treatment plans within the agreed timescales. This would also extend to activities required to manage the ISO27001 Corrective Actions Log and collation and verification of the Continuous Improvement element of the ISO27001 Standard. This role involves collaboration with all areas of the business to ensure any Information Security requirements in current and future projects is correctly identified and tasks assigned. The role provides cover to facilitate delivery of ECDP Programme by supporting the Information Security team across various projects, both current and upcoming. You'll also be involved in: * Supporting the LNER Information Security Assurance processes, gaining thorough knowledge of the current processes. * Guiding critical and key suppliers through the process providing concise, accurate reporting to the Information Security Governance, Risk & Assurance Manager for sign off and to the Information Security Manager as required. * Managing the treatment tasks/plans identified as requiring remediation through the Information Security Risk Register. * Working with identified risk owners across the business ensuring the ISO27001 Corrective Actions Log is correct and accurately reflects remediations and agreed delivery. * Supporting the Information Security Manager and Governance, Risk & Assurance Manager conducting security assessments through vulnerability testing and risk analysis as required. * Coordinating and supporting surveillance audits in support of maintaining LNER's ISO27001 compliant status. * Coordinating Information Security Policy review in line with an agreed timetable from the Information Security Compliance Manager. * Acting as a point of contact for Design Authority papers. Undertaking first review of Technical Impact Assessment papers submitted to Design Authority requiring Information Security review. Supporting business owners completing TIA's and High Level Concept papers completing the relevant sections. * Developing and carrying out information security plans, policies and procedures. * Coordinating reporting across the tools used for managing assurance and compliance ensuring reporting is accurate, timely and supports decision making. * Monitoring use of security products data encryption and other security products and procedures. * Responding to the business day-to-day information security requests and investigating routine security related incidents such as: malware detections, DLP violations, phishing emails, password compromises, general security information support.