Information Security Governance Analyst

Make your mark as a Information Security Governance Analyst in the Cybersecurity sector, based in Glasgow.

Governance rarely gets the credit it deserves in cybersecurity. Everyone wants the incident response war stories, but the frameworks, policies and risk registers are what stop the war starting in the first place. This startup builds security tooling and advisory services for clients who can’t afford to get it wrong, and it’s grown fast enough that structure now matters as much as speed.

Here’s what you’ll be doing:

Maintain and improve the information security management system, keeping policies aligned to ISO 27001 and other relevant frameworks

Run risk assessments across internal systems and client environments, then track remediation through to completion

Support audit cycles by gathering evidence, liaising with assessors and closing out findings

Monitor compliance against regulatory and contractual obligations, flagging gaps before they become problems

Write and update security policies, standards and procedures in plain language people actually read

Work with engineering teams to embed governance checks into existing workflows without slowing anyone down

A couple of years’ experience in information security, risk or compliance, ideally with exposure to ISO 27001, Cyber Essentials or SOC 2

Comfortable reading and writing policy documents. You don’t need to be a lawyer, but precision matters

Working knowledge of risk assessment methodologies and how to translate findings into action

Strong stakeholder communication. You’ll be explaining governance requirements to people who’d rather be coding

A relevant certification (CISMP, CISA, or working towards CISSP) is a plus, not a requirement

Organised enough to track dozens of moving parts without losing the thread

Salary of £30,500 to £46,500, depending on experience

Equity in a business that’s still early enough for it to mean something

Hybrid working from the Glasgow base, with flexible hours built around how you actually work

A genuine learning and development budget, because this field changes every year

Flat structure. You’ll have direct access to decision-makers, not three layers of management between you and them

Why pursue a career in Cybersecurity?

Governance and compliance roles in cybersecurity are growing faster than almost any other corner of tech, partly because regulation keeps tightening and partly because breaches keep making headlines. Glasgow has built a genuine cluster of security talent over the past decade, and an Information Security Governance Analyst role here puts you close to that network rather than isolated in a satellite office. Good people in this field don’t stay junior for long. The demand is too high and the skills gap too real.