Information Security Governance Analyst

The Opportunity Hub UK Ltd; Glasgow; Hybrid; GBP 31,000 - 47,000; Full time

Benefits offered by this job

Equity in a business

Hybrid working from Glasgow base

Learning and development budget

Flat structure

Job summary

The Opportunity Hub UK Ltd in Glasgow is seeking an Information Security Governance Analyst to join our cyber security team. You will maintain the ISMS, run risk assessments, support audits, and ensure governance aligns with ISO 27001 and other frameworks.

You will write clear security policies, monitor regulatory obligations, and collaborate with engineers to embed governance checks into existing workflows. A couple of years of security or compliance experience is preferred.

Qualifications

• 2+ years in information security, risk or compliance
• Experience with ISO 27001, Cyber Essentials or SOC 2 preferred
• Able to read and write policy documents precisely
• Understanding of risk assessment methodologies and translating findings into actions
• Strong stakeholder communication to explain governance to engineers
• CISMP, CISA or CISSP in progress is a plus
• Organised with ability to track multiple moving parts

Responsibilities

• Maintain and improve the ISMS, aligning policies to ISO 27001 and other frameworks
• Run risk assessments across internal systems and client environments, track remediation to completion
• Support audit cycles by gathering evidence and closing findings
• Monitor regulatory and contractual obligations, flag gaps
• Write and update security policies, standards and procedures in plain language
• Work with engineering teams to embed governance checks into workflows

Skills

ISO 27001

Policy writing

Risk assessment

Stakeholder comms

Certifications in progress

Governance coordination

Job description

Make your mark as a Information Security Governance Analyst in the Cybersecurity sector, based in Glasgow.

Governance rarely gets the credit it deserves in cybersecurity. Everyone wants the incident response war stories, but the frameworks, policies and risk registers are what stop the war starting in the first place. This startup builds security tooling and advisory services for clients who can't afford to get it wrong, and it's grown fast enough that structure now matters as much as speed.

Here’s what you'll be doing:

• Maintain and improve the information security management system, keeping policies aligned to ISO 27001 and other relevant frameworks
• Run risk assessments across internal systems and client environments, then track remediation through to completion
• Support audit cycles by gathering evidence, liaising with assessors and closing out findings
• Monitor compliance against regulatory and contractual obligations, flagging gaps before they become problems
• Write and update security policies, standards and procedures in plain language people actually read
• Work with engineering teams to embed governance checks into existing workflows without slowing anyone down

Here are the skills you’ll need:

• A couple of years’ experience in information security, risk or compliance, ideally with exposure to ISO 27001, Cyber Essentials or SOC 2
• Comfortable reading and writing policy documents. You don’t need to be a lawyer, but precision matters
• Working knowledge of risk assessment methodologies and how to translate findings into action
• Strong stakeholder communication. You’ll be explaining governance requirements to people who’d rather be coding
• A relevant certification (CISMP, CISA, or working towards CISSP) is a plus, not a requirement
• Organised enough to track dozens of moving parts without losing the thread

Key perks and benefits:

• Salary of £30,500 to £46,500, depending on experience
• Equity in a business that’s still early enough for it to mean something
• Hybrid working from the Glasgow base, with flexible hours built around how you actually work
• A genuine learning and development budget, because this field changes every year
• Flat structure. You’ll have direct access to decision-makers, not three layers of management between you and them

Why pursue a career in Cybersecurity?

Governance and compliance roles in cybersecurity are growing faster than almost any other corner of tech, partly because regulation keeps tightening and partly because breaches keep making headlines. Glasgow has built a genuine cluster of security talent over the past decade, and an Information Security Governance Analyst role here puts you close to that network rather than isolated in a satellite office. Good people in this field don’t stay junior for long. The demand is too high and the skills gap too real.