AI Risk & Security Analyst

Elmax Search; Greater London; Hybrid; GBP 65,000 - 90,000; Full time

Job summary

Elmax Search is seeking an Information Security Risk Analyst in London. Join a global investment manager with a modern tech agenda and take ownership of how security risk is identified, assessed and communicated across the business.

You will run risk assessments on new systems and supplier risk, align controls with ISO 27001 and NIST CSF, and contribute to governance, regulatory compliance (FCA, DORA, GDPR) and risk reporting.

Qualifications

• 5+ years in information security, IT risk, audit or GRC.
• Hands-on experience maintaining a risk register, assessing controls and tracking remediation.
• Solid technical understanding across infrastructure, networks, cloud, identity and applications.
• Working knowledge of ISO 27001, NIST CSF or similar, and applying FCA, DORA and GDPR requirements.
• Clear communicator who can present findings to engineers and senior business stakeholders.

Responsibilities

• Run security risk assessments on new systems, changes, projects and emerging technology, including AI tools and integrations.
• Own third-party security risk: supplier and cloud due diligence, plus ongoing monitoring.
• Assess security controls against ISO 27001 and NIST CSF, and track remediation through to closure.
• Maintain the Information Security Risk Register, with clear ownership, treatment plans and escalation.
• Produce monthly security KRIs, turning threat, vulnerability and incident data into business risk.
• Support security governance: risk forums, senior management reporting, policy exceptions and risk acceptances.
• Monitor regulatory requirements (FCA, DORA, GDPR), support audits and respond to client security due diligence.

Skills

risk assessment

security governance

ISO 27001

NIST CSF

regulatory compliance

Job description

Elmax Search is seeking an Information Security Risk Analyst in London. Join a global investment manager with a modern tech agenda and take ownership of how security risk is identified, assessed and communicated across the business.

You will run risk assessments on new systems and supplier risk, align controls with ISO 27001 and NIST CSF, and contribute to governance, regulatory compliance (FCA, DORA, GDPR) and risk reporting.