Information Security Risk Analyst

Everything we do exists to find alpha, investment value the market has overlooked. We believe technology is a genuine source of that edge and core to how we find and act on conviction. Because of this, we are modernising our core platform, investing in our data, and building AI solutions that help us achieve alpha for our clients.

Protecting that edge – our data, our platforms and the trust our clients place in us – is fundamental. As an Information Security Risk Analyst in our Security team, reporting to the Security Manager, you will play a critical part in how we do this: identifying, assessing and tracking information security risk across our technology estate, data and third parties, and turning it into clear, evidence-based decisions for the business.

We are home to world-class talent, and we’re looking for more of it to help define what our investment edge looks like next. You will thrive at Orbis if you enjoy solving challenging problems alongside motivated people.

Why Orbis?

• Culture: We are committed to our Core Values. We encourage intellectual curiosity and individualism as well as collaboration across different areas of the business. We seek to hear our people’s voices, whether quiet or loud. Sharing ideas and challenging the status quo are commonplace.
• Autonomy: While guidance and support are provided, team members own their work and projects.
• Growth opportunities: We support our people in continuous learning and development.
• Agile environment: We are committed to providing a work environment that balances the needs of our clients; the needs of our teams; and the personal needs, commitments, and interests of our people.
• Philanthropy: Our people can contribute to society in a unique and personal way, through various philanthropy opportunities and programmes.

What will your responsibilities be?

• Assess security risk. Carry out risk assessments of new systems, changes, projects and emerging technology – including AI tools and integrations – and turn findings into practical recommendations.
• Manage third-party security risk. Run security due diligence on suppliers and cloud services, and monitor their risk over the life of the relationship.
• Assess controls. Review the design and operation of security controls against recognised frameworks (e.g. ISO 27001, NIST CSF), identify gaps, and track remediation through to closure.
• Maintain the Information Security Risk Register. Identify, assess and record security risks across our systems, data and suppliers, with clear ownership, treatment plans and escalation paths.
• Produce and analyse key risk indicators (KRIs). Collect and report security KRIs monthly, working with security operations and engineering to turn threat, vulnerability and incident data into business risk and to call out trends and systemic weaknesses.
• Support security governance. Prepare materials for risk forums and senior management, manage policy exceptions and risk acceptances, and make sure decisions and actions are recorded and followed up.
• Benchmark our maturity. Participate in information security maturity assessments against recognised frameworks, and help turn the results into a prioritised improvement roadmap. Keep our framework current.
• Maintain security policies, standards and procedures. Monitor regulatory requirements (e.g. FCA, DORA, GDPR), and support internal and external audits.
• Support client due diligence. Respond to client and prospect security questionnaires and due diligence requests.