Business Analyst

Cyber Security Business Analyst

Contract: 6 months

Sector: Financial Services

The opportunity:

We are supporting a major financial services organisation seeking an experienced Cyber Security Business Analyst to help integrate cybersecurity requirements across business and technology transformation initiatives.

You will act as the bridge between business stakeholders, cybersecurity teams, technology functions and risk teams. The role combines cyber risk and controls knowledge with business analysis, governance, stakeholder management and transformation delivery.

Key responsibilities

• Gather, analyse and document cybersecurity requirements across business and technology initiatives.
• Act as a key point of contact between cybersecurity, business, risk, architecture and engineering teams.
• Provide cybersecurity input and oversight throughout the project lifecycle, from initial concept through to implementation.
• Ensure transformation initiatives comply with relevant cybersecurity controls, policies and architectural principles.
• Assess cyber risks, control gaps and remediation requirements across cloud, on-premises and hybrid environments.
• Support the design, implementation and continuous improvement of security controls and processes.
• Translate technical cyber risks into clear business requirements and actionable recommendations.
• Track cybersecurity risks, issues, actions, dependencies and remediation activity through to closure.
• Produce clear management information, including KPIs, KRIs and control-effectiveness reporting.
• Prepare reports and presentations for senior stakeholders, risk forums and governance committees.
• Support cyber transformation programmes, ensuring effective delivery, stakeholder adoption and benefits realisation.
• Work with security architecture, engineering and delivery teams to address technical or operational roadblocks.
• Support audit, regulatory and compliance activity, including evidence gathering and remediation tracking.
• Maintain awareness of emerging cyber threats, technologies and regulatory requirements.
• Where required, provide cybersecurity support to merger, acquisition and business integration activity.

Essential experience

• Previous experience as a Cyber Security Business Analyst, Cyber Business Analyst, Technology Risk Analyst or Cyber Transformation Analyst.
• Strong understanding of cybersecurity frameworks and standards such as NIST, ISO 27001, GDPR and FCA requirements.
• Experience in cyber risk management, security controls, governance, audit or regulatory compliance.
• Understanding of areas such as identity and access management, network security, endpoint protection, vulnerability management, threat detection and incident response.
• Experience working across cloud, on-premises and hybrid technology environments.
• Ability to gather requirements and convert technical security information into clear business documentation.
• Experience tracking risks, issues, controls and remediation plans.
• Strong stakeholder management skills, with the ability to work across business, technology, cybersecurity and risk teams.
• Excellent written and verbal communication skills, including producing concise reports for senior and non-technical audiences.
• Experience working within a large, complex and fast-paced organisation.

Desirable experience

• Previous experience within banking or a regulated financial services environment.
• Exposure to cyber transformation, control improvement or regulatory remediation programmes.
• Experience supporting secure software development or technology change initiatives.
• Understanding of cybersecurity architecture and engineering principles.
• Experience producing or interpreting cybersecurity KPIs, KRIs and KCIs.
• Exposure to mergers, acquisitions or business integration programmes.
• A relevant cybersecurity certification such as CISSP, CISM, CISA, CRISC, SABSA, ISO 27001, AWS Security or Microsoft Azure Security.

Candidate profile

You will be a confident and proactive Cyber Security Business Analyst who can operate between technical cyber teams and senior business stakeholders. You should be comfortable challenging risks, identifying delivery roadblocks and translating complex cybersecurity requirements into practical business actions.

You do not need to be a hands-on security engineer, but you must have sufficient technical cyber knowledge to work credibly with security architecture, engineering, operations and risk teams.