Information Security Analyst - Product Assurance

Sainsbury’s Group; Exhall; Hybrid; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Colleague discount across multi-brands

Bonus scheme

Pension plan

Health benefits and wellbeing

Job summary

Sainsbury's Group is seeking an Information Security Analyst within the Data Governance and Information Security Team. You will help secure engineering and development across the lifecycle, reviewing security posture and guiding improvements aligned with threats and business goals.

The role requires 4+ years in information or cyber security, deep knowledge of security technologies, and strong stakeholder management to maintain robust security across the environment.

Qualifications

• 4+ years in information or cyber security
• Knowledge of security in monolithic and microservice architectures
• Experience with containerisation and related tools

Responsibilities

• Work in an agile manner within Engineering Families and governance.
• Ensure security is built in by design and data is protected.
• Define Security Non-Functional Requirements for projects and ensure standards are applied.
• Liaise with Security Testing Team for ethical hacking, code reviews, application scanning, and infrastructure scanning.
• Provide end-to-end assurance of IT products across the Group.
• Articulate risk in technical and non-technical terms to IT and business stakeholders.
• Build strong senior stakeholder relationships to drive risk-based decisions.
• Verify solutions with evidence of controls and testing.
• Stay updated on the changing threat landscape and improve security posture.
• Experience with serverless cloud technologies such as AWS storage and Lambda functions.

Skills

Stakeholder mgmt

Cloud security

Threat landscape

OWASP Top 10

Security technologies

Docker/Kubernetes

Logging & monitoring

Risk management

Serverless AWS

Compliance standards

Education

CompTIA Security+

CISSP/CCSP

AWS Certified Security

Azure Security Engineer

CISA/CISM

MSc Information/Cyber Security

Tools

GitHub

Jira

Jenkins

Kubernetes

Docker

Job description

As an Information Security Analyst in the Data Governance and Information Security Team, you will be working within the Product Assurance team who are responsible for ensuring our Engineering and Development communities are building and maintaining secure products through their entire lifecycle. You will be continually reviewing our security posture and setting the direction on how best to make improvements in line with the evolving threat landscape and core business objectives., As an Information Security Analyst, you will have good all round infosec experience coupled with finely honed Stakeholder Management skills to ensure that robust security is maintained across our environment.

The ideal candidate will have 4+ years' experience working within Information or Cyber Security and be passionate about continuous professional development. You will be asked to provide recent, industry-respect certificates if successful at interview to demonstrate your ongoing education.

Whilst this role isn't 'hands-on' candidates are expected to have an in-depth knowledge of security technologies and how these are integrated in monolithic and microservice architectures. What you need to do As an Information Security Analyst, you will have good all round infosec experience coupled with finely honed Stakeholder Management skills to ensure that robust security is maintained across our environment.

• Work in a flexible, agile manner within Engineering Families, whilst maintaining appropriate levels of challenge and governance
• Ensure security is built in by design, products are delivered securely with client and employee data appropriately protected
• Define Security Non-Functional Requirements for each project and ensure that they are fulfilled prior to going into service, ensuring the relevant technology standards are applied to specific projects
• Liaise with the Information Security Testing Team to ensure that Ethical Hacking, Code Reviews, Application Scanning, and Infrastructure Scanning is conducted.
• Provide end to end assurance of IT products across the Group, throughout its lifecycle, providing approvals where appropriate
• Articulate risk in technical and non-technical terminology so that it can be interpreted by IT and Business individuals alike
• Help identify, assess, and manage strategic, operational and emerging risks affecting the Cloud and Data, and articulate, quantify and monitor risks according to risk appetite.
• Build and maintain strong senior stakeholder relationships within technology and the business to understand security risk and drive robust risk-based decision making.
• Effectively articulate technical issues to business units and engineering teams.
• Define Security Non-Functional Requirements for each project and ensure that they are fulfilled prior to going into service, ensuring the relevant technology standards are applied to specific projects.
• Liaise with third-party strategic partners and providers who support Sainsbury's. The ideal candidate will have 4+ years' experience working within Information or Cyber Security and be passionate about continuous professional development. You will be asked to provide recent, industry-respect certificates if successful at interview to demonstrate your ongoing education.
• A strong technical understanding of security to ensure systems are designed and built securely and to help continually improve our security posture
• Appreciation of containerisation technologies such as Docker, Kubernetes etc.
• Fundamental knowledge of logging, monitoring, load balancing/proxies and API gateways
• Fundamental knowledge of GitHub, Jenkins & Jira
• Basic knowledge of the OWASP Top 10, Mitre ATT&CK, NIST frameworks, PCI-DSS and Cyber Kill Chain
• Fundamental understanding of PAM, EDR, AV, IPS, SIEM, WAF and DLP technologies
• The ability to verify solutions and gain assurance that they are fit for purpose through demonstrable evidence of controls and testing
• Strong understanding of the changing threat landscape and how this may affect our systems
• The ability to challenge concerns and report through appropriate channels
• Self-drive, motivation and the ability to work independently to deliver expected outcomes
• In-depth understanding of data and security risks in a large enterprise
• Risk & Vulnerability Management experience and understanding of Risk & Vulnerability Management Frameworks
• Strong analytical and report writing skills.
• Experience with serverless cloud technologies such as AWS storage and Lambda functions.

Desirable Qualifications

• CompTIA Security+, Network+, Linux+, Cloud+, Data+, DataSys+
• CSA CCSK/CCAK
• AWS Certified Security
• Microsoft Azure Security Engineer Associate
• (ISC) CISSP/CCSP/SSCP
• ISACA CISA/CISM/CRISC/CGEIT
• MSc. Information/Cyber Security

As well as lots of on-the-job training and endless opportunities, in return you'll also enjoy:

• Colleague discount across our multi-brands - Sainsbury's, Argos, TU Clothing and Habitat
• Holiday allowance
• Bonus scheme
• Pension plan
• Special offers on gym memberships, restaurants, holidays, retail vouchers and more

Work-life balance is important to us, so we offer our colleagues as much flexibility as possible in line with the needs of their role. We trust them to decide how, where and when they work, combining remote and collaborative working with a flexible approach to hours, giving them plenty of time and space for life outside of work whilst delivering against our business goals.

We are committed to being a truly inclusive retailer, so you'll be welcomed whoever you are and wherever you work. Around here, there's always the chance to try something new - whether that's as part of an evolving team or somewhere else across the business - and we take development seriously and promise to support you. We also recognise and celebrate colleagues when they go the extra mile and where possible, offer flexible working. When you join our team, we'll also offer you an amazing range of benefits. Here are some of them: Starting off with colleague discount, you'll be able to get 10% off at Sainsbury's, Argos, TU and Habitat after 4 weeks. This increases to 15% off at Sainsbury's every Friday and Saturday and 15% off at Argos every pay day. We've also got you covered for your future with our pensions scheme and life cover. You'll also be able to share in our success as you may be eligible for a performance-related bonus of up to 10% of salary, depending on how we perform. Your wellbeing is important to us too. You'll receive an annual holiday allowance, and you can buy additional holiday. We also offer other benefits that will help your money go further such as season ticket loans, cycle to work scheme, health cash plans, pay advance (where you can access some of your pay before pay day) as well access to a great range of discounts from hundreds of other retailers. And if you ever need it there is also an employee assistance programme. Moments that matter are as important to us as they are to you which is why we give up to 26 weeks' pay for maternity or adoption leave and up to 4 weeks' pay for paternity leave.