> Markdown version of [/jobs/ext/3613972-information-security-risk-analyst](https://www.wearedevelopers.com/jobs/ext/3613972-information-security-risk-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security Risk Analyst

- **Company:** Orbis
- **Location:** London, UK
- **Experience:** Expert
- **Salary:** £52,143.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing, Cyber Security, Cloud Services, Systems Integration, National Institute of Standards and Technology Cybersecurity Framework, Information Technology
- **Published:** October 8, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5918685932

## About the Role

We care as much about how you think as what you've done. Alongside experience, we look for intellectual curiosity and a growth mindset: you learn continuously and apply what you learn to deliver better outcomes. You have deep, hands-on experience in information security and a genuine interest in risk - how threats, vulnerabilities and controls combine to affect the business. Experience with our specific tools is an asset rather than a necessity. Just as important is the flexibility to pick up whatever the problem needs - a technical deep-dive with engineers, or a clear conversation with the business. Communication, judgement and problem-solving matter as much as technical knowledge.

 * Breadth and influence. The opportunity to shape how security risk is understood across a firm where technology is central to the investment edge, working directly with engineers, investment teams and senior management.
 * Investment and industry knowledge. A practical understanding of investment management and financial services.
 * Governance exposure. Experience presenting risk directly to senior management and board-level forums, and shaping how an FCA-regulated asset manager responds to DORA and evolving regulation.
 * AI risk and AI-enabled analysis. Experience assessing the security risk of AI tools, agents and integrations, and using AI to automate risk analysis and reporting.

 * 5+ years of experience in information security, IT risk, audit or GRC, with a track record of running risk processes independently.
 * Bachelor's degree in information security, computer science or a related field, or equivalent professional experience.
 * Security risk assessment experience, including maintaining a risk register, assessing controls and tracking remediation.
 * Good technical understanding across core technology domains such as infrastructure, networks, cloud, identity and applications.
 * Working knowledge of security frameworks (ISO 27001, NIST CSF or similar) and experience applying regulatory requirements such as FCA, DORA and GDPR.
 * Relevant certifications (e.g. CISM, CRISC, CISSP, ISO 27001 Lead Implementer/Auditor) are strongly preferred.
 * Strong interpersonal and communication skills - you'll present findings to both technical and business audiences.

## Description

* Assess security risk. Carry out risk assessments of new systems, changes, projects and emerging technology - including AI tools and integrations - and turn findings into practical recommendations.
 * Manage third-party security risk. Run security due diligence on suppliers and cloud services, and monitor their risk over the life of the relationship.
 * Assess controls. Review the design and operation of security controls against recognised frameworks (e.g. ISO 27001, NIST CSF), identify gaps, and track remediation through to closure.
 * Maintain the Information Security Risk Register. Identify, assess and record security risks across our systems, data and suppliers, with clear ownership, treatment plans and escalation paths.
 * Produce and analyse key risk indicators (KRIs). Collect and report security KRIs monthly, working with security operations and engineering to turn threat, vulnerability and incident data into business risk and to call out trends and systemic weaknesses.
 * Support security governance. Prepare materials for risk forums and senior management, manage policy exceptions and risk acceptances, and make sure decisions and actions are recorded and followed up.
 * Benchmark our maturity. Participate in information security maturity assessments against recognised frameworks, and help turn the results into a prioritised improvement roadmap. Keep our framework current.
 * Maintain security policies, standards and procedures. Monitor regulatory requirements (e.g. FCA, DORA, GDPR), and support internal and external audits.
 * Support client due diligence. Respond to client and prospect security questionnaires and due diligence requests.