Information Security Analyst (Risk and Assurance)

Governance, Risk and Compliance

• Maintain the security risk register, treatment plans and exceptions
• Run risk assessments on systems, projects, suppliers and emerging technology
• Keep policies, standards and control mappings current
• Produce GRC management information for governance forums

Audit and Control Assurance

• Plan the annual audit and assessment calendar
• Coordinate audits end to end and liaise with auditors
• Test internal controls and document findings
• Own the findings tracker and evidence repository

SWIFT CSP

• Own the annual attestation and KYC-SA submission
• Manage the independent assessor and control owners
• Monitor SWIFT scope and architecture, and track gap remediation

Cyber Essentials Plus

• Deliver the annual renewal, including technical testing and remediation
• Monitor scheme changes and ongoing compliance

Framework Alignment (ISO 27001, NIST CSF)

• Evidence alignment and run gap and maturity assessments
• Produce alignment statements for clients and auditors
• No formal ISO 27001 certification held or sought

PCI DSS

• Maintain scoping, segmentation and the annual assessment cycle
• Coordinate ASV scans and penetration testing
• Complete attestations with acquirers and assessors

Vulnerability Management and Security Testing

• Validate scan coverage, track remediation and report metrics
• Coordinate penetration testing through to retesting

Security Monitoring and Incident Response

• Monitor alerts and log-source health
• Triage incidents and keep records and timelines
• Support lost or compromised device response
• Maintain playbooks and procedures

Threat Intelligence

• Monitor advisories, lookalike domains and exposed credentials
• Assess relevance and escalate material findings

Security Platforms, Email Security and DLP

• Administer delegated platform functions
• Monitor tool health and support email security and DLP controls

Third-Party and Technology Assurance

• Perform supplier due diligence and contract security reviews
• Review technology changes for security impact
• Document residual risks and validate remediation

AI and Emerging Technology

• Assess AI, LLM and automation tools, including connectors, data access and sharing
• Identify unapproved AI use and recommend control updates

Governance Forums

• Prepare governance packs, minutes and action logs
• Support operational resilience, outsourcing and regulatory requests

Requirements

• Cyber Essentials Plus and SWIFT CSP maintained without lapse
• PCI DSS obligations delivered on schedule
• Current alignment to ISO 27001 and NIST CSF
• Audits delivered to plan, with findings closed on time
• Risk, exception and action registers accurate and current
• Scan coverage validated and vulnerabilities tracked
• Events triaged, recorded and escalated per procedure
• Supplier assessments completed with risks clearly documented
• Playbooks kept current

• ISO 27001 Lead Implementer or Lead Auditor
• CISA
• CRISC
• CISMP
• CompTIA Security+ or equivalent