Information Security Analyst

REX Cyber Security; Bristol; Hybrid; GBP 50,000 - 70,000; Full time

Job summary

REX Cyber Security in Bristol is seeking an Information Security Analyst to join its governance and assurance team. The role focuses on ISO 27001, ISMS governance and audit, with international scoping and controls improvement across the business.

You will lead risk assessments, contribute to compliance activities, and support certification efforts, audits and supplier security reviews in a fast‑paced professional services environment.

Qualifications

• Experience in Information Security, GRC, Security Assurance or ISMS‑focused roles.
• Strong knowledge of ISO 27001:2022 and ISO management system audits.
• Familiar with Cyber Essentials Plus, ISO 22301 and NIST frameworks.
• Experience with security risk assessments, control assurance and remediation.
• Understanding third‑party and supplier security risk.

Responsibilities

• Governance, audit and compliance across information security; ensure controls are effective and aligned with standards.
• Maintain and improve the ISMS, policies, processes and guidelines.
• Support ISO 27001 certification efforts across international entities.
• Plan, conduct and report internal security audits and remediation activities.
• Prepare security risk assessments and document treatment plans.
• Support supplier security due diligence and supplier audits.
• Communicate security risks clearly to stakeholders at all levels.

Skills

Governance & risk management

ISMS governance

Audits & compliance

Security risk assessments

Stakeholder communication

Policy writing

Cyber security fundamentals

Education

CISSP

CISMP

ISO 27001 Lead Auditor

ISO 27001 Lead Implementer

Tools

Azure

Microsoft 365

Cloud security

Job description

We’re working with a leading professional services company in Bristol that is looking to appoint an Information Security Analyst to join its established security function.

This is a great opportunity for an experienced InfoSec professional who enjoys the governance, risk and assurance side of security, with a particular focus on ISO 27001, ISMS governance, audit, compliance and control assurance.

You’ll play an important role in maintaining and developing the organisation’s security framework, working across the business to manage risk, strengthen controls and support the continued development of its ISO 27001 certification internationally.

The Role

You’ll take a hands‑on role across information security governance, audit and compliance, helping ensure security controls remain effective, proportionate and aligned with recognised standards.

Key responsibilities will include:

• Maintaining and continually improving the organisation’s Information Security Management System (ISMS), including policies, processes, procedures and guidelines
• Supporting continued compliance with ISO 27001:2022 and other applicable security standards
• Planning, conducting and reporting on internal security audits, identifying areas for improvement and supporting remediation
• Helping expand the scope of ISO 27001 certification across international entities, including controls, risk assessments and audit readiness
• Conducting security risk assessments across systems, departments and business processes, and documenting appropriate treatment plans
• Supporting external audits, certification activities and management reviews
• Supporting security incidents where they relate to control effectiveness, policy compliance and corrective actions
• Responding to client security questionnaires, assurance requests and contractual security requirements1? (Note: there is no such bullet) Let's correct that.
• Responding to client security questionnaires, assurance requests and contractual security requirements
• Conducting supplier security due diligence, ongoing monitoring and supplier audits
• Preparing reports on information security risks, controls, incidents and remediation for senior stakeholders
• Supporting security awareness programmes and training to strengthen security culture across the business
• Keeping up to date with evolving cyber threats, regulatory requirements and security technologies

What We’re Looking For

We’re looking for someone with previous experience in an Information Security, GRC, Security Assurance or ISMS-focused role, ideally within a complex or regulated organisation.

You’ll ideally bring:

• Strong practical knowledge of ISO 27001, ideally including ISO 27001:2022
• Experience conducting or supporting ISO management system audits
• Knowledge of security standards and frameworks such as Cyber Essentials Plus, ISO 22301 and NIST
• Experience with security risk assessments, control assurance and remediation
• Understanding of third-party and supplier security risk
• Good broader knowledge of cyber security and technology
• Familiarity with Azure, Microsoft 365 and cloud security
• Strong documentation, analytical and problem-solving skills
• Confidence working with and influencing stakeholders across technical and non-technical teams
• The ability to communicate security risks and requirements clearly to stakeholders at all levels

Relevant certifications such as CISSP, CISMP, ISO 27001 Lead Implementer or Lead Auditor would be highly beneficial.

Why This Role?

This is an opportunity to join a leading professional services business where information security is a key priority and have genuine involvement in the continued development of its security and assurance capability.

You’ll gain exposure across a broad international environment, with the opportunity to influence ISO 27001 governance, audit, risk, third-party assurance and security culture across the organisation.

Location: Bristol, hybrid working

Focus: ISO 27001 | ISMS | GRC | Audit | Risk | Security Assurance