Information Security Analyst – Security Operations & GRC

CyberProof; United Kingdom; Remote; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Remote work

Job summary

CyberProof in the United Kingdom seeks an experienced Information Security Analyst to join our Security Operations and GRC-focused team. The role blends hands-on security operations with governance, risk and compliance responsibilities, including incident investigation and third-party assessments.

You will own escalated security cases, investigate incidents, engage with users and technical teams, and help drive remediation while supporting security Controls reviews and supplier risk assessments

Qualifications

• Experience in Information Security, Cyber Security Operations or Security Incident Management.
• Strong security triage, investigation and analytical skills.
• Experience managing security incidents through investigation to resolution.
• Understanding of IAM and access governance.
• Exposure to GRC, third-party/supplier risk or security assurance.
• Familiarity with ISO 27001 and SOC 2.
• Experience with enterprise security platforms from Microsoft or similar.

Responsibilities

• Triage, investigate and manage escalated security incidents and tickets.
• Analyse suspicious sign-ins, potentially compromised accounts and data-protection events.
• Coordinate remediation and ensure incidents progress to resolution.
• Support GRC, access governance and security-control reviews.
• Review supplier questionnaires and security evidence (SOC 2, ISO 27001).
• Work with external security service providers on investigations and escalations.
• Identify false positives and suggest monitoring improvements.

Skills

Security operations

Incident management

Identity & Access Management

GRC awareness

SOC 2 / ISO 27001 knowledge

Stakeholder communication

Tools

Microsoft security technologies

Job description

Information Security Analyst – Security Operations & GRC

Location: UK | Remote

Employment: Permanent/ Fixed Term Employment

Start: ASAP

We’re looking for an experienced Information Security Analyst to join our Information & Cyber Security team, combining hands-on security operations and incident investigation with exposure to governance, risk and compliance (GRC).

This is a varied role where you’ll take ownership of escalated security cases, investigate suspicious activity, work with users and technical teams to establish risk, and drive incidents through to resolution. You’ll also support third-party security assessments, access governance, security controls and compliance activities.

If you enjoy getting beneath the surface of a security alert, understanding what actually happened, and working collaboratively to reach the right outcome, this could be a great next step.

What You’ll Do:

• Security Operations & Investigation
• Triage, investigate and manage escalated security incidents and tickets.
• Analyse suspicious sign-ins, potentially compromised accounts, unusual locations, file-download activity and data-protection events.
• Use available security telemetry and business context to distinguish genuine threats from legitimate activity and false positives.
• Maintain clear investigation notes, evidence and case outcomes.
• Coordinate remediation and ensure incidents are progressed through to resolution.
• Engage directly with users, technology teams, customers and security providers to establish facts and resolve security concerns.
• Support GRC, access governance and security-control reviews.
• Manage third-party cyber-security assessments and periodic supplier reassessments.
• Review supplier questionnaires and security evidence, including SOC 2 reports, ISO 27001 certifications and Statements of Applicability.
• Assess supplier cyber risk using RAG-based risk assessments and identify areas requiring further investigation or remediation.
• Support Access Package reviews, evidence gathering, audit activity and management reporting.
• Track outstanding supplier and governance actions through to completion.
• Security Monitoring & Continuous Improvement
• Work with Microsoft security technologies and other security platforms to investigate events and validate controls.
• Support security controls across identity, access, data protection and cloud activity.
• Work with external security service providers on investigations and escalations.
• Identify recurring false positives, detection gaps and operational issues.
• Recommend improvements to monitoring, escalation and incident-management processes.

What You’ll Bring:

We’re looking for someone with:

• Experience in Information Security, Cyber Security Operations or Security Incident Management.
• Strong security triage, investigation and analytical skills.
• Experience managing security incidents through investigation to resolution.
• Understanding of Identity & Access Management (IAM) and access governance.
• Exposure to GRC, third-party/supplier risk or security assurance.
• Familiarity with security evidence such as ISO 27001 and SOC 2.
• Experience working with Microsoft security technologies or similar enterprise security platforms.
• Strong documentation and audit-support skills.
• Confidence communicating security issues clearly to both technical and non-technical stakeholders.
• A proactive mindset and willingness to take ownership rather than simply passing incidents between teams.

Why This Role?

This is an excellent opportunity for someone looking to broaden their cyber-security experience beyond a traditional monitoring role. You’ll gain exposure across Security Operations, incident response, IAM, GRC, supplier risk and security assurance, while working on real security challenges in an international environment.

If you’re naturally curious, enjoy investigating security events and want a role where you can make an impact across both operational security and cyber risk, we’d like to hear from you.

#UST #CyberProof

Security Operations | Incident Triage | Cyber Security | GRC | IAM | Third-Party Risk | Security Assurance | ISO 27001 | SOC 2 | Audit Support | Access Governance | Incident Investigation