Information Technology Security Analyst

Sanderson; England; On-site; GBP 65,000 - 90,000; Full time

Job summary

Sanderson is seeking a Senior IT Security Analyst to join its Information Security function in the UK. The role spans governance, risk, compliance and security assurance, with exposure to technical security work and business stakeholder engagement.

You will support audits, strengthen governance, and help automate evidence collection and reporting. The ideal candidate has 2–5 years of information security experience, solid ISO 27001 knowledge, and relevant certifications.

Qualifications

• Experience with ISO 27001 controls and compliance processes.
• Knowledge of cyber governance, risk management and assurance.
• Experience supporting audits and coordinating remediation.
• Exposure to risk assessments, risk registers and control reviews.
• Experience handling security questionnaires and supplier assurance.

Responsibilities

• Support development and improvement of information security policies, standards and controls.
• Coordinate internal and external security audits and track remediation.
• Maintain risk registers and work with stakeholders on mitigation.
• Contribute to governance and assurance activities across the business.
• Support customer and third‑party security assurance activities.

Skills

ISO 27001

GRC

Security governance

Risk management

Audits

Security controls

Stakeholder communication

Automation mindset

Education

ISO 27001 Foundation/Lead Implementer

Security+

CISA

Tools

Microsoft security technologies

Security governance tools

Cloud security tooling

Microsoft Defender

Azure Security Center

Job description

We're working with an established and growing technology organisation that is looking to appoint a Senior IT Security Analyst to join its Information Security function.

This is a fantastic opportunity for an Information Security professional who enjoys working across cyber governance, risk management, compliance and security assurance, while maintaining exposure to the wider technical security landscape.

Working closely with the Head of Security Operations, you'll play an important role in strengthening the organisation's security governance framework, improving internal processes, supporting audits and helping ensure security risks are effectively identified, assessed and managed.

The business is looking for someone who can bring a proactive, practical approach to information security, with the confidence to engage with stakeholders across the organisation and help drive continuous improvements.

Key Responsibilities

• Support the development, implementation and ongoing improvement of information security policies, standards, procedures and controls.
• Assist with maintaining and strengthening the organisation's alignment with ISO 27001, including supporting compliance activities, control assessments and continuous improvement initiatives.
• Coordinate internal and external security audits, gathering evidence, reviewing findings and tracking remediation activities through to completion.
• Support the identification, assessment and management of information security risks, maintaining risk registers and working with stakeholders to ensure appropriate mitigation.
• Contribute to the organisation's security governance and assurance activities, ensuring security controls remain effective and aligned with business requirements.
• Support customer and third‑party security assurance activities, including responding to security questionnaires, reviewing security requirements and providing evidence of compliance.
• Work closely with technical and operational teams to understand security vulnerabilities, risks and control weaknesses, supporting appropriate remediation.
• Identify opportunities to automate and streamline security governance, audit and compliance processes, improving efficiency and reducing manual administration.
• Assist with security reporting, risk metrics and the preparation of information for internal stakeholders.
• Promote security awareness, good governance practices and a strong security culture across the wider business.

Skills & Experience

We're particularly interested in speaking with candidates who have approximately 2–5 years of experience within Information Security, Cyber GRC, Security Assurance or a similar role.

The ideal candidate will demonstrate:

• Practical experience working with ISO 27001, information security controls and compliance frameworks.
• A good understanding of cyber security governance, risk management and assurance processes.
• Experience supporting security audits, managing audit findings and coordinating remediation activities.
• Exposure to information security risk assessments, risk registers and control reviews.
• Experience completing customer security questionnaires, supplier assurance assessments or responding to external security and compliance requests.
• A solid technical understanding of information security, including vulnerabilities, access controls, infrastructure security and common cyber threats.
• The ability to communicate effectively with technical and non-technical stakeholders.
• Strong organisational skills, attention to detail and the ability to manage multiple security and compliance activities.
• A proactive mindset, with an interest in improving existing processes and identifying opportunities for automation.
• Knowledge of frameworks such as NIST CSF, Cyber Essentials or CIS Controls.
• Experience working in an organisation with established ISO 27001 certification or ongoing compliance obligations.
• Familiarity with security governance, risk and compliance tools.
• Exposure to Microsoft security technologies, cloud environments or wider security operations.
• Experience improving or automating audit evidence collection, compliance reporting or security assurance workflows.
• Relevant certifications such as ISO 27001 Foundation/Lead Implementer, Security+, CISA or similar.

Why Consider This Opportunity?

This is an excellent opportunity to join a collaborative security function where you'll have genuine exposure to a broad range of information security activities.

Rather than being restricted to one area of cyber security, you'll have the opportunity to work across governance, risk, assurance and technical security, supporting meaningful improvements to the organisation's overall security posture.

You'll work closely with experienced security leadership, gain exposure to business-wide security initiatives and have the opportunity to take ownership of important governance and assurance activities.