Cyber Risk Analyst — Second-Line Risk & Controls Lead

M&G plc; Stirling; Hybrid; GBP 55,000 - 75,000; Full time

Benefits offered by this job

Pension up to 18%

Share Save scheme

Share Incentive Plan

38 days’ annual leave

Time Off When You Need It policy

Life Insurance & Private Healthcare

Job summary

M&G plc is seeking a Cyber Risk Analyst to support independent second-line oversight of cyber security across the organisation. You will challenge first-line posture, monitor remediation, and provide specialist risk advice to the Non-Financial Risk team and wider business.

The role requires 3+ years in cyber security or technology risk, strong stakeholder engagement, and knowledge of risk/taxonomy concepts. Flexible working is offered alongside a comprehensive benefits package.

Qualifications

• 3+ years of experience in cyber security or tech risk function (essential)
• Well developed stakeholder engagement skills (essential)
• Broad experience in cyber domains: risk/audit management, security architecture, DevSecOps, threat intel, vulnerability management, incident response (essential)
• Curious, analytical and pragmatic problem-solver
• Experience reviewing red team outputs, pen tests or vuln scans
• Awareness and interest in AI and applications

Responsibilities

• Provide second-line oversight of first-line cyber controls, assessing design, implementation and effectiveness.
• Review and advise on cyber risk metrics to maintain risk within appetite.
• Provide second-line review for risk processes, RCSAs and assurance actions.
• Support remediation tracking and closure of findings from testing and incidents.
• Identify gaps from incident responses and drive practical remedial actions.
• Collaborate on risk mitigation projects and control improvements.

Skills

Cyber security experience

Stakeholder engagement

Cyber risk domains

Analytical problem-solving

Communication skills

AI awareness

Education

Certifications in cyber security/cloud/risk

Job description

M&G plc is seeking a Cyber Risk Analyst to support independent second-line oversight of cyber security across the organisation. You will challenge first-line posture, monitor remediation, and provide specialist risk advice to the Non-Financial Risk team and wider business.

The role requires 3+ years in cyber security or technology risk, strong stakeholder engagement, and knowledge of risk/taxonomy concepts. Flexible working is offered alongside a comprehensive benefits package.