Cyber Risk Analyst — Second-Line Risk Oversight

M&GPrudential; Scotland; Hybrid; GBP 55,000 - 70,000; Full time

Benefits offered by this job

Pension up to 18%

Share Save and Share Incentive Plan

38 days annual leave

Time Off When You Need It

Inspiring Families policy

Private Healthcare

Job summary

M&G is seeking a Cyber Risk Analyst to support the second line of defence within the Non-Financial Risk function. You will assess first-line cyber controls, advise on risk metrics, and help drive remediation while reporting to the Cyber Risk Consultant.

You will engage with stakeholders across risk disciplines, apply knowledge of risk taxonomy, and stay ahead of evolving cyber threats and cloud security. Flexible working and a supportive culture are offered.

Qualifications

• 3+ years of experience in cyber security or an appropriate technology risk function.
• Well developed stakeholder engagement skills.
• Broad experience or understanding of cyber security domains such as risk/audit management, security architecture, DevSec Ops, threat intelligence, vulnerability management and incident response.
• Willingness to stay up to date with evolving technologies and approaches within Cyber Risk Management.
• General understanding of second-line activities: risk taxonomy, appetite, KRIs and controls.
• Curious, analytical and pragmatic problem-solver.
• Experience reviewing outputs of red teaming, penetration testing or vulnerability scanning and assessing significance.
• Awareness and interest in AI and related applications.
• Knowledge of enterprise security products and cloud.
• Comfortable with risk/issue tracking tools and clear stakeholder reporting.
• Able to produce gap analyses against policies/standards using best practices.
• Excellent report-writing and communication skills.
• Able to work in diverse, multi-cultural teams with international exposure.

Responsibilities

• Provide second-line oversight of first-line cyber controls, assessing their design, implementation and effectiveness.
• Review and advise on suitable cyber risk metrics to help maintain risk within appetite.
• Provide second-line review for formal risk processes, RCSA and assurance actions.
• Support first-line to track and drive remediation of findings from testing, reviews and incidents, ensuring clear remediation plans and closure.
• Review first-line cyber processes and technical incident responses to identify gaps and support remedial actions.
• Work with colleagues to provide second-line oversight of cyber risk mitigation projects and control improvement initiatives.
• Communicate risk findings and recommendations clearly to stakeholders to enable timely decision-making.

Skills

Cyber security

Stakeholder engagement

Risk management

Threat intelligence

Vulnerability management

Incident response

AI awareness

Cloud security

Communication skills

Team collaboration

Education

Cyber security certifications

Tools

Enterprise security products

Cloud platforms

Job description

M&G is seeking a Cyber Risk Analyst to support the second line of defence within the Non-Financial Risk function. You will assess first-line cyber controls, advise on risk metrics, and help drive remediation while reporting to the Cyber Risk Consultant.

You will engage with stakeholders across risk disciplines, apply knowledge of risk taxonomy, and stay ahead of evolving cyber threats and cloud security. Flexible working and a supportive culture are offered.