Information Security Assurance Analyst

About the Role

Perform a threat modelling exercise of all projects and provide mitigating cyber security requirements to help ensure the secure delivery of compliant systems, applications, and business processes.

Key Responsibilities

• Review high/low-level architecture definition documents for compliance against security policies, standards, and regulatory requirements, defining cyber non-functional requirements
• Attend Technical Design Authority (TDA) meetings to provide security sign-offs
• Collaborate within the Security Assurance team, contributing to thought leadership across assurance functions and facilitating smoother engagements with project delivery teams
• Perform cyber security risk assessments, compliance checks, audits, and reviews to ensure appropriate security controls are in place, identifying deficiencies and gaps for management consideration
• Provide support in scoping and overseeing penetration tests (pen tests) and re-tests, reviewing recommendations and working with relevant teams to support remediation efforts
• Execute cyber security assurance activities, verifying that implemented solutions align with approved architecture documents, while facilitating penetration testing and offering security advice and guidance
• Ensure compliance across BAU and projects with legal and regulatory requirements
• Where required, propose solutions and coordinate the delivery of mitigating actions to align risk levels with risk appetite
• Conduct compliance checks to verify that cyber security controls operate as designed
• Ensure security assurance processes and procedures are followed, retaining evidence for regulatory and audit purposes
• Support continued service improvement activities
• Provide relevant updates to monthly CNI and governance forums
• Contribute to security reports for executives, shareholders, and the board
• Support regulatory reporting and reporting achievements
• Assist in regulatory inspections, internal/external audits, and remediation of findings
• Ensure identified issues and risks from security assurance are appropriately managed, maintaining visibility for senior leaders on high-risk areas
• Support the CISO and wider cyber management team
• Build and maintain relationships with key stakeholders, including:
  • PMO and delivery teams
  • IT Operations and Product groups
  • Architecture and third-party security providers