> Markdown version of [/jobs/ext/4631653-senior-information-security-assurance-specialist](https://www.wearedevelopers.com/jobs/ext/4631653-senior-information-security-assurance-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Information Security Assurance Specialist - **Company:** Arqiva - **Location:** Winchester, UK - **Experience:** Expert - **Salary:** £95,000 - **Contract:** Permanent contract - **Skills:** Audit Trail, Cyber Security, Information Systems, Information Security Management, Information Technology Audit, Cloud Services, Information Technology Security Auditing, Information Technology, ISO/IEC 27002 - **Published:** November 8, 2026 - **Apply:** https://www.adzuna.co.uk/jobs/details/5957968025 ## About the Role * Significant experience in information security assurance, cyber assurance, IT audit, information security governance, risk and compliance, or a related cyber security discipline. * Proven experience delivering end-to-end assurance reviews, including planning, testing, reporting, remediation tracking and closure. * Experience assessing both control design and operating effectiveness through evidence-based testing. * Strong understanding of security governance frameworks, risk management methodologies and assurance practices. * Experience supporting or leading external audits, certification programmes, customer assurance reviews or regulatory assessments. * Knowledge of cyber security controls, risk assessment techniques and security best practices. * Ability to provide independent challenge while building effective working relationships with technical and business stakeholders. * Strong analytical and problem-solving skills with exceptional attention to detail. * Excellent written and verbal communication skills, including the ability to communicate complex technical issues to non-technical audiences. * Experience working collaboratively across technology, security, risk, legal and business functions. Desirable * Experience working within telecommunications, critical national infrastructure, technology, utilities or other highly regulated environments. * Experience assessing security controls within cloud, operational technology and third-party environments. * Familiarity with customer assurance programmes and supplier security assessments. * Experience supporting GDPR and broader regulatory compliance initiatives. * Experience developing assurance methodologies, control testing frameworks and reporting standards. * Professional certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor or ISO 27001 Lead Implementer., * Information Security Assurance * Cyber Security Governance * Governance, Risk & Compliance (GRC) * Security Audit & Assurance * Control Design & Effectiveness Testing * Security Risk Assessment * ISO 27001 & Security Frameworks * Regulatory Compliance * Cyber Incident Management * Root Cause Analysis * Supplier & Third-Party Assurance * Stakeholder Engagement & Advisory * Evidence-Based Testing & Assessment * Continuous Improvement * Security Awareness & Training * Leadership, Coaching & Mentoring Knowledge & Experience * Extensive experience in information security assurance, cyber assurance, IT audit, governance, risk management or compliance functions. * Strong knowledge of information security management frameworks, governance standards and regulatory requirements. * Practical experience assessing security controls through evidence gathering, interviews, walkthroughs, sampling and testing activities. * Strong understanding of ISO 27001 and ISO 27002, including control assessment and audit evidence requirements. * Familiarity with assurance approaches and frameworks such as NIST Cybersecurity Framework, NCSC Cyber Assessment Framework and recognised audit methodologies. * Experience producing assurance reports and presenting findings and recommendations to senior stakeholders. * Knowledge of cyber security threats, vulnerabilities and risk mitigation approaches. * Experience identifying systemic issues, validating remediation activities and driving security improvements. * Ability to influence decision-making and embed a culture of security assurance and continuous improvement across an organisation. Qualifications A degree (or equivalent experience) in Cyber Security, Information Security, Computer Science, Information Systems or a related discipline is advantageous. Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Auditor or ISO 27001 Lead Implementer would be beneficial. ## Description As a Senior Information Security Assurance Specialist at Arqiva, you'll play a critical role in protecting the services and infrastructure that keep the UK connected. Working across enterprise IT, cloud platforms, operational technology and third-party environments, you'll provide independent assurance that security controls are appropriately designed, effectively implemented and operating as intended. You'll lead assurance reviews, coordinate audits and certification activities, and provide evidence-based insight that strengthens cyber resilience across the business. This role combines information security expertise with a strong audit and assurance mindset. You'll assess control effectiveness, challenge existing practices, analyse evidence and identify opportunities for improvement, helping Arqiva demonstrate compliance to customers, regulators, certification bodies and senior stakeholders. Acting as a trusted advisor and subject matter expert, you'll work across Technology, Legal, Risk and Business teams to ensure security risks are understood, managed and continuously monitored in line with industry best practice and regulatory expectations., * Develop and deliver a risk-based programme of information security assurance reviews, control testing and independent security assessments. * Assess the design and operating effectiveness of technical, procedural and organisational security controls across Arqiva's technology landscape. * Lead security assurance reviews across enterprise IT, cloud services, operational technology, critical infrastructure and third-party environments. * Plan, coordinate and support internal and external audits, certification activities and customer assurance programmes. * Lead evidence collection, interviews, control walkthroughs, sampling and testing activities, maintaining a robust and defensible audit trail. * Produce clear and insightful assurance reports that articulate findings, root causes, business impacts and practical recommendations. * Track audit and assurance findings through to completion, validating that remediation activities are implemented effectively and sustainably. * Conduct security risk assessments and provide guidance on mitigation activities and risk treatment plans. * Support incident management activities, remediation efforts and root cause analysis exercises where required. * Review third-party assurance reports, supplier responses and certification evidence to assess security risks across the supply chain. * Identify recurring control weaknesses, systemic risks and opportunities to improve security controls, assurance processes and audit readiness. * Support the implementation and maintenance of information security and cyber security policies and standards. * Deliver security awareness activities and provide expert guidance to stakeholders across the business. * Act as a subject matter expert for governance, risk, compliance and assurance-related activities. * Develop and maintain strong relationships with suppliers, auditors, industry peers and key stakeholders. * Contribute to budget management, continuous improvement initiatives and the ongoing development of the wider Security GRC function.