Cyber Risk Analyst — Second-Line Risk & Oversight

M&GPrudential; United Kingdom; On-site; GBP 55,000 - 90,000; Full time

Benefits offered by this job

Pension up to 18%

Share Save scheme

Share Incentive Plan

38 days leave

Private healthcare

Critical illness cover

Life assurance

Job summary

M&GPrudential is hiring a Cyber Risk Analyst in Edinburgh to provide independent second-line oversight of first-line cyber security. You will evaluate controls, advise on metrics, and track remediation plans while engaging with multiple stakeholders across the Technology Risk Team.

The role requires 3+ years in cyber security, broad domain knowledge, and a proactive, analytical mindset. A focus on AI applications and cloud security is encouraged.

Qualifications

• 3+ years of experience in cyber security or appropriate technology risk function.
• Well developed stakeholder engagement skills.
• Broad experience or understanding of cyber security domains: risk/audit management, security architecture, DevSecOps, threat intelligence, vulnerability management and incident response.
• Willingness to stay up to date with the latest technologies and approaches in Cyber Risk Management.
• General understanding of second-line activities: risk taxonomy, appetite, KRIs and controls.
• Curious, analytical and pragmatic problem-solver.
• Experience reviewing red teaming outputs, penetration testing or vulnerability scanning.
• Awareness and interest in AI and its applications.
• Knowledge of enterprise security products and cloud.
• Comfortable with risk/issue tracking tools and clear stakeholder reporting.
• Able to produce gap analyses against policies/standards using best practices.
• Excellent report-writing and communication skills.
• Able to work in diverse, multi-cultural teams with international exposure.

Responsibilities

• Provide second-line oversight of first-line cyber controls, assessing design, implementation and effectiveness.
• Review and advise on cyber risk metrics to maintain risk within appetite.
• Provide second line review for risk processes, RCSAs and assurance actions.
• Support first-line to track remediation of findings and ensure closure.
• Review first-line cyber processes and incident responses to identify gaps and corrective actions.
• Coordinate with colleagues to oversee risk mitigation projects and control improvements.
• Communicate risk findings and recommendations clearly to stakeholders for timely decisions.

Skills

Cyber security

Stakeholder engagement

Risk management

Security architecture

DevSecOps

Threat intelligence

Vulnerability management

Incident response

AI awareness

Cloud security

Education

Cyber security certifications

Tools

Security products

Cloud platforms

Job description

M&GPrudential is hiring a Cyber Risk Analyst in Edinburgh to provide independent second-line oversight of first-line cyber security. You will evaluate controls, advise on metrics, and track remediation plans while engaging with multiple stakeholders across the Technology Risk Team.

The role requires 3+ years in cyber security, broad domain knowledge, and a proactive, analytical mindset. A focus on AI applications and cloud security is encouraged.