At Quorum Cyber, we're on a mission to help good people win.

Founded in Edinburgh in 2016, we're one of the fastest growing cyber security companies in the UK and North America, serving over 400 customers on four continents. We protect organisations against the rising threat of cyber-attacks, enabling them to thrive in an increasingly unpredictable and inhospitable digital landscape.

As a Microsoft-only security house, a Microsoft Solutions Partner for Security, a member of the Microsoft Intelligent Security Association (MISA), and winner of the Microsoft Security MSSP of the Year 2025 award, we offer a unified security ecosystem comprised of innovative services, all delivered through our customer platform, Clarity.

In September 2024, Quorum Cyber acquired Canada-based, Microsoft Solutions Partner for Security, Difenda. This was closely followed in December 2024 by the acquisition of US-based, Kivu Consulting, a global cyber security firm with world-leading incident response capabilities.

Role Purpose

As a Compliance and Information Security Analyst you play a vital role in safeguarding the organisation's information systems, supporting audits, investigations, risk assessments, and ongoing compliance improvements. You serve as both a strategic advisor and hands-on practitioner, translating complex threats into practical security solutions that protect sensitive data and uphold stakeholder trust.

What I Do Is

• Maintain and support the internal audit schedule and requirements for all QC required frameworks using the GRC platform and planning tool to ensure security controls are in place and operating effectively.
• Assist in the external audit process and support any development or implementation of remediation required.
• Participate in the review, update and validation of our Policies, Procedures and Documentation, ensuring accuracy with current policy and changes in frameworks and regulatory requirements.
• Be a trusted point of contact for reported issues, incidents or concerns and document them according to due process.
• Maintain the data incident reporting log, ensuring each incident is fully investigated and actioned as required.
• Maintain the TPRM process and Vendor Assurance records in the GRC platform with appropriate risk assessments to highlight any potential risk areas to the business using technical acumen and knowledge relevant to the vendor.
• Support the review of our internal vulnerability management lifecycle by monitoring the tools and ensuring KPIs are reported and met.
• Be a trusted advisor to Compliance's customers, answering questions that come through the Compliance mailbox and other sources about our current frameworks and certifications as well as best practice, participate in projects as and when required.
• Provide Security Awareness Training.
• Keep up to date with knowledge of new technologies and their governance as well as legislative changes relevant to data protection in our geographic locations.