Information Security Analyst (Risk and Assurance)

Job Description

Job title: Information Security Analyst (Risk and Assurance)

Location: London (Hybrid)

Salary: £60k + Benefits and Bonus

Function

Fantastic career opportunity join highly respected UK bank and specialist lender. The role requires technical expertise to support protecting the Bank, its customers and its data from cyber and information security risks through effective governance, risk management, assurance and operational security support.

Key Responsibilities

Governance, Risk and Compliance

• Maintain the security risk register, treatment plans and exceptions
• Run risk assessments on systems, projects, suppliers and emerging technology
• Keep policies, standards and control mappings current
• Produce GRC management information for governance forums

Audit and Control Assurance

• Plan the annual audit and assessment calendar
• Coordinate audits end to end and liaise with auditors
• Test internal controls and document findings
• Own the findings tracker and evidence repository

SWIFT CSP

• Own the annual attestation and KYC-SA submission
• Manage the independent assessor and control owners
• Monitor SWIFT scope and architecture, and track gap remediation

Cyber Essentials Plus

• Deliver the annual renewal, including technical testing and remediation
• Monitor scheme changes and ongoing compliance

Framework Alignment (ISO 27001, NIST CSF)

• Evidence alignment and run gap and maturity assessments
• Produce alignment statements for clients and auditors
• No formal ISO 27001 certification held or sought

PCI DSS

• Maintain scoping, segmentation and the annual assessment cycle
• Coordinate ASV scans and penetration testing
• Complete attestations with acquirers and assessors

Vulnerability Management and Security Testing

• Validate scan coverage, track remediation and report metrics
• Coordinate penetration testing through to retesting

Security Monitoring and Incident Response

• Monitor alerts and log-source health
• Triage incidents and keep records and timelines
• Support lost or compromised device response
• Maintain playbooks and procedures

Threat Intelligence

• Monitor advisories, lookalike domains and exposed credentials
• Assess relevance and escalate material findings

Security Platforms, Email Security and DLP

• Administer delegated platform functions
• Monitor tool health and support email security and DLP controls

Third-Party and Technology Assurance

• Perform supplier due diligence and contract security reviews
• Review technology changes for security impact
• Document residual risks and validate remediation

AI and Emerging Technology

• Assess AI, LLM and automation tools, including connectors, data access and sharing
• Identify unapproved AI use and recommend control updates

Governance Forums

• Prepare governance packs, minutes and action logs
• Support operational resilience, outsourcing and regulatory requests

Requirements

• Cyber Essentials Plus and SWIFT CSP maintained without lapse
• PCI DSS obligations delivered on schedule
• Current alignment to ISO 27001 and NIST CSF
• Audits delivered to plan, with findings closed on time
• Risk, exception and action registers accurate and current
• Scan coverage validated and vulnerabilities tracked
• Events triaged, recorded and escalated per procedure
• Supplier assessments completed with risks clearly documented
• Playbooks kept current

Professional certifications (desirable, not essential):

• ISO 27001 Lead Implementer or Lead Auditor
• CISA
• CRISC
• CISMP
• CompTIA Security+ or equivalent