Cyber Security Business Analyst - AI & Security Transformation

Xpand Group; Greater London; Hybrid; GBP 111,000 - 148,000; Full time

Job summary

Xpand Group is seeking a Senior Cyber Security Business Analyst to join a major financial services transformation focused on cyber security and AI integration. You will shape AS-IS/TO-BE models, governance, and TOMs while translating complex security requirements into actionable delivery artifacts.

You will collaborate with CISO teams and stakeholders across Technology, Data & AI, and Risk to ensure effective design, delivery and embedding of new capabilities into BAU operations.

Qualifications

• 7+ years in a Senior BA, Cybersecurity BA or Security Transformation role.
• Experience delivering complex technology or cybersecurity transformation programmes.
• Expertise in BPMN process modelling, AS-IS/TO-BE analysis and process optimisation.
• Experience designing or implementing Target Operating Models (TOMs).
• Strong requirements engineering, stakeholder management and workshop facilitation.
• Translating security, risk or regulatory requirements into delivery artefacts.
• Knowledge of cybersecurity governance, controls and risk management.
• Maintaining traceability between requirements, controls and delivery.
• Familiarity with Agile, SDLC and enterprise technology delivery.
• Experience in financial services or regulated environments.

Responsibilities

• Lead requirements gathering and analysis across cybersecurity and AI transformation initiatives.
• Translate objectives, security risks and regulatory requirements into functional specs.
• Develop detailed business requirements, user stories, acceptance criteria, and delivery documentation.
• Identify gaps, dependencies and opportunities for improvement across security processes.
• Maintain end-to-end requirements traceability through the project lifecycle.
• Analyse existing cybersecurity processes and develop AS-IS/TO-BE operating models.
• Define workflows, governance structures, controls and handovers.
• Support TOM design for AI-enabled cybersecurity capabilities.
• Identify automation opportunities and improve operational efficiency.
• Contribute to vendor assessments, RFIs/RFPs and technology evaluations.
• Translate security requirements into practical operational processes with cybersecurity teams.
• Support offensive security, vulnerability management, app security and AI-assisted testing.
• Ensure regulatory considerations and risk-based prioritisation are applied.
• Facilitate workshops, challenge requirements and translate discussions into decisions.
• Collaborate with architects, security specialists, developers and delivery teams.
• Support Agile delivery through backlog refinement and acceptance testing.
• Produce executive presentations, process documentation and governance reporting.
• Assist operational readiness and transition to BAU services.

Skills

7+ years experience

BPMN process modelling

AS-IS/TO-BE analysis

Target Operating Models

Requirements engineering

Stakeholder management

Agile SDLC

Security governance

Vulnerability management

Tools

Azure DevOps

ServiceNow

Integrated Risk Management (IRM)

Job description

Senior Cyber Security Business Analyst - AI & Security Transformation

Location: London, UK

Contract: 12 months (subject to confirmation)

Rate: £600 - £800 per day (Inside of IR35) must use an Umbrella

Working Arrangement: Hybrid

Sector: Financial Services / Cybersecurity / AI Transformation

The Opportunity

We are looking for an experienced Senior Cyber Security Business Analyst to join a major international financial services organisation undergoing an ambitious transformation of its cyber security capabilities.

Working within the CISO function, you will play a pivotal role in shaping how emerging AI technologies are integrated into cyber security operations, particularly across offensive security, vulnerability management and AI-assisted security assessments.

This is an opportunity to work at the intersection of cybersecurity, artificial intelligence, business transformation and operating model design, helping translate strategic objectives into clearly defined processes, requirements, governance structures and operational capabilities.

You will collaborate with senior stakeholders across Cybersecurity, Technology, Data & AI, Enterprise Architecture, Risk and Operational Resilience to ensure that complex transformation initiatives are effectively designed, delivered and embedded into business-as-usual operations.

Key Responsibilities

Business Analysis & Requirements Engineering

• Lead requirements gathering and analysis across complex cybersecurity and AI transformation initiatives.


• Translate business objectives, security risks and regulatory requirements into clear functional and non-functional specifications.


• Develop detailed business requirements, user stories, acceptance criteria and delivery documentation.


• Identify gaps, dependencies and opportunities for improvement across existing security processes.


• Maintain end-to-end requirements traceability throughout the project lifecycle.

Process Mapping & Target Operating Model Design

• Analyse existing cybersecurity processes and develop improved future-state operating models.


• Produce detailed AS-IS and TO-BE process maps using BPMN.


• Define workflows, responsibilities, governance structures, controls and operational handovers.


• Support the design and implementation of target operating models for AI-enabled cybersecurity capabilities.


• Identify opportunities for process optimisation, automation and improved operational efficiency.


• Contribute to vendor assessments, RFI/RFP requirements and technology evaluations.

Cybersecurity Governance & Risk Management

• Work closely with cybersecurity teams to translate security requirements and control objectives into practical operational processes.


• Support initiatives relating to offensive security, vulnerability management, application security and AI-assisted security testing.


• Ensure appropriate consideration of regulatory requirements, operational resilience and security governance.


• Support risk-based prioritisation of security initiatives based on business impact, criticality and exposure.


• Establish clear links between security requirements, implemented controls, testing evidence and business outcomes.

Stakeholder Management & Delivery

• Facilitate workshops involving senior business, technology, cybersecurity and risk stakeholders.


• Challenge requirements, resolve ambiguity and translate complex discussions into actionable decisions.


• Collaborate with solution architects, security specialists, developers and delivery teams.


• Support Agile delivery through backlog refinement, requirements validation and acceptance testing.


• Produce clear executive presentations, decision papers, process documentation and governance reporting.


• Support operational readiness and the transition of new capabilities into business-as-usual services.

Essential Skills & Experience

• 7+ years' experience in a Senior Business Analyst, Cybersecurity Business Analyst or Security Transformation Analyst position.


• Strong experience delivering complex technology or cybersecurity transformation programmes.


• Proven expertise in BPMN process modelling, AS-IS/TO-BE analysis and process optimisation.


• Demonstrable experience designing or implementing Target Operating Models (TOMs).


• Excellent requirements engineering, stakeholder management and workshop facilitation skills.


• Experience translating security, risk or regulatory requirements into practical, testable delivery artefacts.


• Strong understanding of cybersecurity governance, security controls and risk management.


• Experience maintaining traceability between requirements, controls, delivery activities and outcomes.


• Familiarity with Agile methodologies, SDLC processes and enterprise technology delivery.


• Experience working within financial services, banking or another highly regulated environment.


• Excellent written and verbal communication skills, including the ability to engage senior stakeholders.

Desirable Experience

• Exposure to offensive security, penetration testing, application security or vulnerability management programmes.


• Experience supporting AI-enabled technology or cybersecurity transformation initiatives.


• Knowledge of security frameworks such as NIST, ISO 27001 or related regulatory control environments.


• Familiarity with Azure DevOps, ServiceNow, Integrated Risk Management (IRM) or similar platforms.


• Experience supporting security automation or technology operating model transformation.


• Additional European languages, particularly French.

*Rates depend on experience and client requirements