Information Assurance Analyst

RTX Corporation; Manchester; On-site; GBP 45,000 - 65,000; Full time

Benefits offered by this job

Competitive salary

25 days holiday + public holidays

Pension scheme

Bonus scheme

Life assurance

Job summary

Raytheon UK is seeking an Information Security Compliance Analyst to support governance, risk and compliance across technology services, systems and processes. You will assist audits, drive remediation actions and help maintain accreditation standards.

You will work with Cyber Security to assess controls, collect evidence and communicate findings to technical and non-technical stakeholders, ensuring timely mitigation of risks.

Qualifications

• Experience in information security, cyber security, GRC or technology audit.
• Familiarity with ISO27001 and the NIST CSF frameworks.
• Ability to obtain and maintain UK Security Clearance.

Responsibilities

• Advise and drive technical security governance through audits and controls.
• Identify noncompliance and assist remediation planning.
• Support maintenance and improvement of ISO27001 and CSF compliance.
• Coordinate evidence gathering for internal/external audits and respond to requests.
• Produce security reports and metrics for technical and non-technical audiences.

Skills

Security governance

Risk assessment

Audit & assurance

Remediation planning

Stakeholder management

Written communication

Analytical skills

UK security clearance

Education

Bachelor's degree in IT/Security

Information security qualification

Job description

Sitting with the Cyber Security Team, the IT Security Compliance Analyst play a critical role in ensuring that Raytheon UK remain compliant with a range of internal and external security accreditations, standards and control sets. Alongside these responsibilities, the Information Assurance Analysts will help to:

• Advise and drives technical security best practises through routine and ad-hoc audit and governance activities.
• Identify areas of noncompliance and risk, ultimately supporting the development of appropriate remediation plans and activities.
• Drive security improvements and uplift across the department through managing post audit remediation plans and actions.
• The Information Security Analyst will support the organisation in maintaining and continually improving its information security and assurance posture. Working as part of the wider Cyber Security team, the role will provide security assurance, risk and compliance support across technology services, systems, applications and business processes.
• Plan, coordinate and conduct security assessments and assurance reviews across the organisation's infrastructure, applications, services and supporting processes, assessing compliance with internal security requirements, policies and recognised security frameworks.
• Support the organisation's alignment with recognised security standards and frameworks, including ISO27001, the NIST Cybersecurity Framework (CSF), understanding how security controls can be applied and evidenced within a complex enterprise environment.
• Identify security risks, control weaknesses, observations and non-conformities through assessments, audits and day-to-day assurance activities, ensuring these are appropriately documented, assessed, prioritised and tracked through to resolution.
• Assess the design and effectiveness of security controls, gathering and reviewing appropriate evidence and identifying opportunities to improve the organisation's control environment.
• Develop clear, pragmatic remediation recommendations in collaboration with the wider Cyber Security team, service owners, system owners and other stakeholders.
• Provide subject matter expertise and security assurance guidance to service and system owners, helping stakeholders understand security risks and requirements effectively to technical and non-technical stakeholders.
• Monitor and challenge remediation activity, working with action owners to ensure security findings and risks are addressed appropriately and within agreed timescales, escalating overdue or significant risks where necessary.
• Support internal and external security audits and assessments, including coordinating stakeholders, gathering evidence, responding to audit requests and managing resulting findings and actions.
• Support the planning, coordination and delivery of activities required to maintain Cyber Essentials and Cyber Essentials Plus certification, working with technical and business stakeholders to identify and address potential compliance gaps.
• Ensure that security risks, areas of non-conformity and emerging compliance challenges are identified at the earliest opportunity, working with Cyber Security and relevant business stakeholders to develop proportionate mitigations.
• Ensure significant audit and assessment findings are communicated effectively to relevant stakeholders and, where appropriate, recorded within departmental or organisational risk registers for ongoing ownership and monitoring.
• Produce concise security reports, metrics and management information, communicating technical and compliance issues in a manner appropriate for both technical and non-technical audiences.
• Promote awareness of security assurance and compliance requirements, including planned audits, assessment activity, key commitments, identified control gaps and remediation priorities.
• Contribute to the continual improvement of the organisation's information security management and assurance processes, including policies, standards, control frameworks, assessment methodologies and reporting.
• Maintain awareness of developments in cyber security threats, regulation, industry standards and security good practice, considering their potential impact on the organisation.
• Practical experience within information security, cyber security, information assurance, IT risk, governance, risk and compliance (GRC), or technology audit.
• Working knowledge of ISO27001, including an understanding of Information Security Management Systems (ISMS), risk-based approaches to security and the assessment of security controls.
• Familiarity with the NIST Cybersecurity Framework (CSF, with an understanding of how security frameworks can be used to assess and improve an organisation's security posture.
• Experience supporting or conducting security audits, compliance assessments, control assessments or assurance reviews.
• Experience identifying and documenting security risks, control deficiencies and non-conformities, and supporting their remediation.
• Ability to analyse security requirements and control evidence and form clear, evidence-based conclusions and recommendations.
• An understanding of common enterprise security controls and technologies, including areas such as identity and access management, vulnerability management, endpoint security, network security, secure configuration, logging and monitoring, data protection and incident management.
• Strong written and verbal communication skills, with the ability to communicate security risks and requirements effectively to technical and non-technical stakeholders.
• Strong analytical, research and problem-solving skills, with excellent attention to detail.
• Ability to build effective working relationships and appropriately challenge stakeholders and control owners when security or compliance requirements are not being met.
• Self-motivated and able to manage and prioritise multiple activities, stakeholders and deadlines with appropriate levels of supervision.
• Ability to obtain and maintain the required UK Security Clearance.

Desirable Requirements

• Relevant professional qualifications or certifications, or working towards them, such as ISO 27001 Internal Auditor/Lead Auditor, CISSP, CISM, CRISC or equivalent.

At Raytheon UK, we take immense pride in being a leader in defence and aerospace technology. As an employer, we are dedicated to fuelling innovation, nurturing talent, and fostering a culture of excellence.

Joining our team means being part of an organisation that shapes the future of national security whilst investing in your growth and personal development. We provide a collaborative environment, abundant opportunities for professional development, and a profound sense of purpose in what we do. Together, we are not just advancing technology; we're building a community committed to safeguarding a safer and more connected world., Raytheon UK is a landed company and part of the wider RTX organisation. Headquartered in Arlington, Virginia, USA, but with over 180,000 employees globally across every continent, RTX provides advanced systems and services for commercial, military and government customers worldwide and comprises three industry-leading businesses - Collins Aerospace Systems, Pratt & Whitney, and Raytheon., Supporting over 35,000 jobs across 13 UK sites, RTX is helping to drive prosperity. Each year our work contributes over £2.7bn to the UK economy and offers a wealth of opportunities to 4,000 suppliers across England, Scotland, Wales and Northern Ireland. We're investing in all corners of the country, supporting 29,040 jobs in England, 3,040 in Northern Ireland, 1,900 in Scotland and 1,600 in Wales.

Benefits

• Competitive salaries.
• 25 days holiday + statutory public holidays, plus opportunity to buy and sell up to 5 days (37hr)
• Contributory Pension Scheme (up to 10.5% company contribution)
• Company bonus scheme (discretionary).
• 6 times salary 'Life Assurance' with pension.
• Flexible Benefits scheme with extensive salary sacrifice schemes, including Health Cashplan, Dental, and Cycle to Work amongst others.
• Enhanced sick pay.
• Enhanced family friendly policies including enhanced maternity, paternity & shared parental leave.