Cyber Risk Analyst — Second-Line Risk & Controls

M&G; City of Edinburgh; Hybrid; GBP 60,000 - 85,000; Full time

Benefits offered by this job

Pension up to 18%

38 days annual leave

Parental leave policy

Private healthcare

Job summary

M&G is seeking a Cyber Risk Analyst to support the Second Line of Defence within the Technology Risk Team. The role focuses on independent oversight of first-line cyber security and delivering clear risk insights for informed decision‑making.

You will evaluate controls, monitor remediation, and provide specialist cyber risk advice across the business, collaborating with stakeholders and navigating complex risk challenges in a multinational environment.

Qualifications

• 3+ years of experience in cyber security or appropriate technology risk function (essential)
• Well developed stakeholder engagement skills (essential)
• Broad experience or understanding of cyber security domains (risk/audit management, security architecture, DevSec Ops, threat intelligence, vulnerability management and incident response) (essential)
• Knowledge of enterprise security products and cloud; AI awareness is beneficial
• Excellent report-writing and communication skills; able to work in diverse, multi-cultural teams with international exposure

Responsibilities

• Provide second-line oversight of first-line cyber controls, assessing design, implementation and effectiveness
• Review and advise on cyber risk metrics to maintain risk within appetite
• Provide second-line review for risk processes, RCSAs and assurance actions
• Support first-line in tracking remediation of findings from testing, reviews and incidents
• Review first-line cyber processes and incident responses to identify gaps and support remedial actions
• Collaborate to oversee cyber risk mitigation projects and control improvements
• Communicate risk findings and recommendations clearly to stakeholders for timely decisions

Skills

Stakeholder engagement

Cyber security domains

Risk management

Incident response

Threat intel

Cloud knowledge

Communication skills

Gap analyses

AI awareness

Penetration testing

Education

Cyber security certifications

Cloud certifications

Risk certifications

Job description

M&G is seeking a Cyber Risk Analyst to support the Second Line of Defence within the Technology Risk Team. The role focuses on independent oversight of first-line cyber security and delivering clear risk insights for informed decision‑making.

You will evaluate controls, monitor remediation, and provide specialist cyber risk advice across the business, collaborating with stakeholders and navigating complex risk challenges in a multinational environment.