Information Security Analyst (Risk and Assurance)

PSD Technology Contracts Ltd.; City Of London; Híbrido; GBP 54.000 - 66.000; Jornada completa

Descripción de la vacante

PSD Technology Contracts Ltd. in London is seeking an Information Security Analyst (Risk and Assurance) to safeguard the bank’s data and customers.

The role combines governance, risk management, and assurance across security controls and incident response in a hybrid London setting. You will maintain risk registers, coordinate audits, manage SWIFT CSP and PCI DSS activities, and align to ISO 27001 and NIST CSF.

Formación

• Experience in governance, risk management and assurance for information security.
• Ability to maintain risk registers, treatment plans and exceptions.
• Knowledge of security controls and compliance frameworks.

Responsabilidades

• Maintain the security risk register, treatment plans and exceptions.
• Run risk assessments on systems, projects, suppliers and emerging technology.
• Keep policies, standards and control mappings current.
• Produce GRC management information for governance forums.
• Own the attestation and control monitoring for SWIFT CSP and PCI DSS.
• Deliver Cyber Essentials Plus renewal and ongoing compliance.
• Coordinate audits and tests of security controls.

Conocimientos

Governance

Risk management

Assurance

Operational security

Descripción del empleo

Job title: Information Security Analyst (Risk and Assurance)

Location: London (Hybrid)

Salary: GBP60k + Benefits and Bonus

Function

Fantastic career opportunity join highly respected UK bank and specialist lender. The role requires technical expertise to support protecting the Bank, its customers and its data from cyber and information security risks through effective governance, risk management, assurance and operational security support.

Key Responsibilities

Governance, Risk and Compliance

• Maintain the security risk register, treatment plans and exceptions
• Run risk assessments on systems, projects, suppliers and emerging technology
• Keep policies, standards and control mappings current
• Produce GRC management information for governance forums

Audit and Control Assurance

• Plan the annual audit and assessment calendar
• Coordinate audits end to end and liaise with auditors
• Test internal controls and document findings
• Own the findings tracker and evidence repository

SWIFT CSP

• Own the annual attestation and KYC–SA submission
• Manage the independent assessor and control owners
• Monitor SWIFT scope and architecture, and track gap remediation

Cyber Essentials Plus

• Deliver the annual renewal, including technical testing and remediation
• Monitor scheme changes and ongoing compliance

Framework Alignment (ISO 27001, NIST CSF)

• Evidence alignment and run gap and maturity assessments
• Produce alignment statements for clients and auditors
• No formal ISO 27001 certification held or sought

PCI DSS

• Maintain scoping, segmentation and the annual assessment cycle
• Coordinate ASV scans and penetration testing
• Complete attestations with acquirers and assessors

Vulnerability Management and Security Testing

• Validate scan coverage, track remediation and report metrics
• Coordinate penetration testing through to retesting

Security Monitoring and Incident Response

• Monitor alerts and log–source health
• Triage incidents and keep records and timelines
• Support lost or compromised device response
• Maintain playbooks and procedures

Threat Intelligence

• Monitor advisories, lookalike domains and exposed credentials
• Assess relevance and escal… material findings

Security Platforms, Email Security and DLP

• Administer delegated platform functions
• Monitor tool health and support email security and DLP controls

Third–Party and Technology Assurance

• Perform supplier due diligence and contract security reviews
• Review technology changes for security impact
• Document residual risks and validate remediation

AI and Emerging Technology

• Assess AI, LLM and automation tools, including connectors, data access and sharing
• Identify unapproved AI use and recommend control updates

Governance Forums

• Prepare governance packs, minutes and action logs
• Support operational resilience, outsourcing and regulatory requests

Requirements

• Cyber Essentials Plus and SWIFT CSP maintained without lapse
• PCI DSS obligations delivered on schedule
• Current alignment to ISO 27001 and NIST CSF
• Audits delivered to plan, with findings closed on time
• Risk, exception and action registers accurate and current
• Scan coverage validated and vulnerabilities tracked
• Events triaged, recorded and escalated per procedure
• Supplier assessments completed with risks clearly documented
• Playbooks kept current

Professional certifications (desirable, not essential):

• ISO 27001 Lead Implementer or Lead Auditor
• CISA
• CRISC
• CISMP
• CompTIA Security+ or equivalent