Security Risk Analyst

Security Risk Analyst

London - Onsite 2 days a week

3 month contract

Inside of IR35

£400 per day

We are seeking an experienced Security Risk Analyst to join a busy cyber security and information governance function. This role will play a key part in identifying, assessing and managing cyber and information security risks across systems, services, suppliers and business processes.

You will work closely with ICT teams, service managers and senior stakeholders to ensure cyber risks are understood, managed and effectively mitigated, whilst supporting the organisation's wider security and compliance objectives.

Key Responsibilities

• Conduct cyber and information risk assessments across systems, suppliers and business services.
• Maintain and manage the cyber risk register, ensuring risks are accurately assessed and tracked.
• Work with technical and business teams to define and implement risk mitigation plans.
• Review security controls, identify weaknesses and recommend improvements.
• Carry out supplier security assurance and risk assessments, ensuring appropriate controls are in place.
• Produce risk reports and dashboards for senior leadership and governance boards.
• Support compliance activities against recognised standards and frameworks.
• Provide guidance to stakeholders on cyber risk implications of projects, procurements and technology changes.
• Contribute to incident reviews and lessons learned activities.

Essential Experience

• Proven experience within Cyber Security, Information Risk Management or Information Governance.
• Mandatory experience using Risk Ledger.
• Strong understanding of cyber threats, vulnerabilities and security risk management practices.
• Experience with frameworks such as ISO 27001, NIST and NCSC CAF.
• Knowledge of cloud technologies, digital platforms and third-party supplier risk.
• Understanding of Zero Trust principles and modern security best practice.
• Knowledge of UK GDPR, Data Protection Act 2018 and PSN requirements.
• Experience maintaining risk registers and producing risk-based reporting