Information Security Analyst (GRC)

Metroline Ltd; Greater London; On-site; GBP 45,000 - 65,000; Full time

Job summary

Metroline Ltd is seeking an Information Security Analyst to support governance, risk management and data protection across the organisation. The role combines technical knowledge with clear communication to improve security controls and maintain documentation.

The successful candidate will help identify security risks, monitor vulnerabilities, assist with audits (ISO 27001, Cyber Essentials Plus, PCI DSS) and collaborate with IT, Legal, HR and business teams to drive remediation and continuous

Qualifications

• At least two years’ practical experience in information security, cyber security, GRC or related role.
• Working knowledge of cyber threats, security controls, identity and access management, endpoint protection and network security.
• Experience supporting vulnerability management, including interpreting scan results, CVEs, CVSS ratings and OWASP security risks, and tracking remediation.
• Practical experience supporting security risk assessments, control reviews, compliance monitoring and audit evidence collection.
• Working knowledge of the UK GDPR and Data Protection Act 2018, including data protection principles, DPIAs, data breaches and data subject rights.
• Awareness of information security risk management, ISO 27001, NIST Cybersecurity Framework, Cyber Essentials and data protection principles.
• Strong analytical and communication skills, with attention to detail and the ability to maintain accurate records and elevate risks appropriately.
• Strong organisational and collaborative skills, with the ability to manage multiple priorities and follow actions through to completion.

Responsibilities

• Vulnerability Management: Support vulnerability scanning, review and validate findings, track remediation actions with system owners, and elevate overdue or high-risk vulnerabilities.
• Risk and Compliance: Support information security risk assessments, control reviews, complete and review DPAs, and maintain the security risk register. Help collect and organise evidence for audits and assurance activities.
• Policies and Standards: Assist with reviewing and maintaining information security policies, standards, procedures and guidance.
• Third-Party Security: Support supplier security assessments and due diligence by reviewing questionnaires and evidence, recording risks, and tracking agreed actions.
• Security Awareness: Help deliver security awareness activities, phishing simulations and practical guidance for employees.
• Data Protection Support: Assist with data protection assessments, SARs, and record keeping in line with UK GDPR, EU GDPR and internal procedures.
• Reporting and Stakeholder Support: Maintain accurate security records, metrics and dashboards; communicate technical findings clearly to IT, Legal, HR and business teams.
• Continuous Improvement: Keep knowledge of threats, vulnerabilities and security practices current, and suggest practical improvements to controls and processes.

Skills

Information security

GRC knowledge

Vulnerability management

Data protection

Analytical skills

Communication skills

Education

InfoSec GRC certification (in progress)

ISO/IEC 27001 Foundation (cert)

Job description

Job Summary

We are looking for an Information Security Analyst with practical experience to support the organisation's cyber security governance and risk activities. The role will help identify and assess security risks, monitor vulnerabilities, maintain security documentation, and work with stakeholders to improve security controls. The successful candidate will combine sound technical knowledge with clear communication and a willingness to develop across security governance, risk, compliance and data protection.

Main Responsibilities

• Vulnerability Management: Support vulnerability scanning, review and validate findings, track remediation actions with system owners, and elevate overdue or high-risk vulnerabilities.
• Risk and Compliance: Support information security risk assessments, control reviews, complete and review DPIAs/ DPAs, and maintain the security risk register. Help collect and organise evidence for internal and external audits, ISO 27001, Cyber Essentials Plus, PCI DSS and other assurance activities.
• Policies and Standards: Assist with reviewing and maintaining information security policies, standards, procedures and guidance. Help monitor compliance and identify areas requiring improvement.
• Third-Party Security: Support supplier security assessments and due diligence by reviewing questionnaires and evidence, recording risks, and tracking agreed actions.
• Security Awareness: Help deliver security awareness activities, phishing simulations and practical guidance for employees. Respond to routine security queries and promote secure working practices.
• Data Protection Support: Assist with data protection assessments, SARs, and record keeping in line with UK GDPR, EU GDPR and internal procedures, escalating matters to the appropriate owner.
• Reporting and Stakeholder Support: Maintain accurate security records, metrics and dashboards. Communicate technical findings clearly and work with IT, Legal, HR, Service Delivery and business teams to support remediation.
• Continuous Improvement: Keep knowledge of relevant threats, vulnerabilities and security practices current, and suggest practical improvements to security controls and processes.

Essential Criteria

• At least two years’ practical experience in information security, cyber security, GRC or a related role.
• Working knowledge of common cyber threats, security controls, identity and access management, endpoint protection and network security.
• Experience supporting vulnerability management, including interpreting scan results, CVEs, CVSS ratings and OWASP security risks, and tracking remediation.
• Practical experience supporting security risk assessments, control reviews, compliance monitoring and audit evidence collection.
• Working knowledge of the UK GDPR and Data Protection Act 2018, including data protection principles, DPIAs, data breaches and data subject rights.
• Awareness of information security risk management, ISO 27001, NIST Cybersecurity Framework, Cyber Essentials and data protection principles.
• Strong analytical and communication skills, with attention to detail and the ability to maintain accurate records and elevate risks appropriately.
• Strong organisational and collaborative skills, with the ability to manage multiple priorities and follow actions through to completion.

Competencies & Skills

• Knowledge of security principles including cloud access controls.
• Experience with phishing investigations, email security, vulnerability remediation or security awareness campaigns.
• Familiarity with supplier assurance, security questionnaires, risk registers, DPIAs, DPAs, data-sharing agreements, or audit evidence collection.
• A relevant Information security GRC certification, or evidence of actively working towards one, is desirable. Relevant qualifications may include ISC2 CGRC, OCEG GRCP, ISACA IT Risk Fundamentals, ISO/IEC 27001 Foundation, ISO/IEC 27001 Internal Auditor, CRISC or CISA. Equivalent risk, audit, privacy or compliance qualifications will also be considered.
• Experience in transport, critical services or another operationally complex environment is desirable.

Hours Of Work

38 hours per week, Monday to Friday, but must be flexible to work over and above these hours if deemed necessary.

The Equality Act

ComfortDelGro is an equal opportunity employer, and all qualified applicants will receive consideration for employment with due regard to legal obligations for protected characteristics, i.e. age, disability, marriage and civil partnership, gender reassignment, pregnancy and maternity, race, religion and belief, sex and sexual orientation.