GRC-Focused Information Security Analyst

Metroline Ltd; Greater London; On-site; GBP 45,000 - 65,000; Full time

Job summary

Metroline Ltd is seeking an Information Security Analyst to support governance, risk management and data protection across the organisation. The role combines technical knowledge with clear communication to improve security controls and maintain documentation.

The successful candidate will help identify security risks, monitor vulnerabilities, assist with audits (ISO 27001, Cyber Essentials Plus, PCI DSS) and collaborate with IT, Legal, HR and business teams to drive remediation and continuous

Qualifications

• At least two years’ practical experience in information security, cyber security, GRC or related role.
• Working knowledge of cyber threats, security controls, identity and access management, endpoint protection and network security.
• Experience supporting vulnerability management, including interpreting scan results, CVEs, CVSS ratings and OWASP security risks, and tracking remediation.
• Practical experience supporting security risk assessments, control reviews, compliance monitoring and audit evidence collection.
• Working knowledge of the UK GDPR and Data Protection Act 2018, including data protection principles, DPIAs, data breaches and data subject rights.
• Awareness of information security risk management, ISO 27001, NIST Cybersecurity Framework, Cyber Essentials and data protection principles.
• Strong analytical and communication skills, with attention to detail and the ability to maintain accurate records and elevate risks appropriately.
• Strong organisational and collaborative skills, with the ability to manage multiple priorities and follow actions through to completion.

Responsibilities

• Vulnerability Management: Support vulnerability scanning, review and validate findings, track remediation actions with system owners, and elevate overdue or high-risk vulnerabilities.
• Risk and Compliance: Support information security risk assessments, control reviews, complete and review DPAs, and maintain the security risk register. Help collect and organise evidence for audits and assurance activities.
• Policies and Standards: Assist with reviewing and maintaining information security policies, standards, procedures and guidance.
• Third-Party Security: Support supplier security assessments and due diligence by reviewing questionnaires and evidence, recording risks, and tracking agreed actions.
• Security Awareness: Help deliver security awareness activities, phishing simulations and practical guidance for employees.
• Data Protection Support: Assist with data protection assessments, SARs, and record keeping in line with UK GDPR, EU GDPR and internal procedures.
• Reporting and Stakeholder Support: Maintain accurate security records, metrics and dashboards; communicate technical findings clearly to IT, Legal, HR and business teams.
• Continuous Improvement: Keep knowledge of threats, vulnerabilities and security practices current, and suggest practical improvements to controls and processes.

Skills

Information security

GRC knowledge

Vulnerability management

Data protection

Analytical skills

Communication skills

Education

InfoSec GRC certification (in progress)

ISO/IEC 27001 Foundation (cert)

Job description

Metroline Ltd is seeking an Information Security Analyst to support governance, risk management and data protection across the organisation. The role combines technical knowledge with clear communication to improve security controls and maintain documentation.

The successful candidate will help identify security risks, monitor vulnerabilities, assist with audits (ISO 27001, Cyber Essentials Plus, PCI DSS) and collaborate with IT, Legal, HR and business teams to drive remediation and continuous