Information Security and Data Protection Analyst
Sideways 6
Get more replies from employers
Send a job-specific resume in minutes.
Benefits offered by this job
Job summary
Interact is seeking an Information Security and Data Protection Analyst in Manchester to strengthen our information security and GDPR compliance. You will balance security controls with business needs, working with stakeholders across Engineering and with external regulators if required.
The role covers policy development, risk assessments, incident response, and audit support, ensuring our ISO27001, SOC 2, and Cyber Essentials programs remain robust across North America, EMEA, and beyond.
Qualifications
- 2-3 years minimum in an information security or data protection role.
- Hands-on experience with at least two certification cycles (ISO 27001, SOC 2, etc.).
- Demonstrable experience managing or influencing stakeholders at a senior level.
- Involvement in penetration testing activities and remediations.
- Experience handling real security incidents or data breaches.
- Ability to pragmatically balance security risk against business need.
- Maintenance and creation of the Risk Register, ROPA & DPIAs
- Strong awareness of the GDPR, either through training or practical work.
- Strong practical understanding of security and compliance frameworks (ISO27001, SOC 2 Type II, Cyber Essentials Plus).
- Practical knowledge of Defender, Intune, Entra, Purview, AWS and Azure
Responsibilities
- Create, review, and improve security policies.
- Implement and maintain Information Security Management System (ISO27001 certification).
- Support certification/compliance activities for security standards (ISO 27001, SOC 2, Cyber Essentials).
- Experience in undergoing audits.
- Support business continuity plans and policy.
- Build and maintain relationships with technical and business stakeholders.
- Lead regular risk assessments and internal process audits.
- Collaborate with internal teams to manage risks and propose solutions.
- Support evidence collation for audits.
- Conduct vendor/supplier reviews per Internal Policy.
- Complete client security questionnaires for prospects and customers.
- Maintain and improve information security awareness within the business.
- Monitor activities under UK GDPR and other data protection laws.
- Coordinate with regulators during investigations as required.
- Be point of contact for data processing inquiries.
- Maintain security tickets with timely follow-up and cross-team collaboration.
- Oversee penetration testing remediations.
Skills
Tools
Job description
Department: Engineering
Employment Type: Full Time
Location: Manchester, UK
Reporting To: Zack King
Interact provides enterprise-grade intranet software that connects over three million employees to leading global names like Levi's, Domino’s, Teva Pharmaceuticals, and Technicolor.
Our team of customer-focused problem solvers are passionate about helping organizations to communicate better. We do this together by constantly working to improve every service and product we offer. With offices in Manchester, New York, Dubai, Tulsa, and Warsaw, we operate across North America, EMEA, and Australia.
Click on any of our vacancies and you'll see one thing in common - they all begin with this message. Why? Because at Interact we treat everyone with the same respect and honesty. Whether you're a developer fresh out of college or a seasoned salesperson, we live the motto that we uphold for our customers: our people are our most valuable assets.
Your objective will be to support and strengthen the organisation's information security and data protection framework by maintaining compliance with recognised security standards and regulatory requirements, including ISO 27001, SOC 2, Cyber Essentials and UK GDPR.
The role is responsible for identifying, assessing and mitigating security and privacy risks, managing certification and audit activities, supporting incident response and remediation, and promoting a culture of security awareness across the business. Working closely with technical and business stakeholders, the Information Security & Data Protection Analyst will balance security and compliance requirements with commercial priorities, driving continuous improvement in governance, risk management and data protection practices while helping to safeguard the organisation's information assets and reputation
- Creating, reviewing and improving the security policies.
- Implement and maintain Information Security Management System (ISO27001 certification)
- Contribute to activities towards certification/compliance to security. standards and regulations (ISO 27001, SOC 2, Cyber Essentials, etc.)
- Experience of undergoing audits
- Support progress on business continuity plans and policy
- Build and maintain relationships with technical and business stakeholders.
- Leading regular risk assessments and internal process audits.
- Working with internal teams and stakeholders to manage risks, suggest solutions, and resolving issues.
- Support and lead with evidence collation for audits.
- Conduct vendor/supplier reviews in line with Internal Policy.
- Experience in completing client security questionnaires for prospects and customers
- Maintain and improve information security awareness within the business.
- Conduct monitoring activities as required with the UK GDPR and other data protection laws, again our data protection policies
- Work with regulator investigations as required in Article 36
- Point of contact to our employees and individuals about data processing activities.
- Supporting the business maintaining the Security tickets through prompt follow-up and resolution, in collaboration with teams and other stakeholders.
- Management of penetration testing remediations.
- 2-3 years minimum in an information security or data protection role
- Hands-on experience with at least two certification cycles (ISO 27001, SOC 2, etc.) from start to finish.
- Demonstrable experience managing or influencing stakeholders at a senior level.
- Involvement in penetration testing activities and remediations.
- Experience handling real security incidents or data breaches.
- Ability to pragmatically balance security risk against business need
- Maintenance and creation of the Risk Register, ROPA & DPIAs
- Strong awareness of the GDPR, either through training from working within a business that processes personal data or independent learning.
- Strong practical understanding of security and compliance frameworks, such as ISO27001, SOC 2 type II and Cyber Essentials Plus.
- Practical working knowledge of Defender, Intune, Entra, Purview, AWS and Azure
- Knowledge of GRC tools such as Drata and Safebase.
- Knowledge of Security and Awareness training tools, campaign creation etc.
- SaaS background
- Good understanding of Risk Management and continuous improvement practices.
- 25 days annual leave (with the option to buy and sell additional days)
- Cycle to work scheme
- Access to Learning & Development platform
- Life Insurance
- Auto Enrolment Pensions
- Healthshield (Cashback on dental check-ups and fillings, eye tests, physiotherapy, prescriptions and much more
- Reimburse for usage of personal mobile phone
- Free Gym membership and Free Friday lunch for office based staff
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
